sssnake/autarch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

Browse Source
This commit is contained in:
SsSnake
2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
data/ioc/spyware/citizen_lab/201510_NGO_Burma/README.md Normal file
View File

@@ -0,0 +1,8 @@
## Attacks on NGO in Burma IOCs
This directory contains IOC from the Citizen Lab report [Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites](https://citizenlab.org/2015/10/targeted-attacks-ngo-burma/) published the 16th of October 2015.
Files included in this directory:
* openioc.ioc : IOCs in OpenIOC format
* stix.xml : IOCs in STIX XML format
* iocs.csv : IOCs in csv format

24
data/ioc/spyware/citizen_lab/201510_NGO_Burma/iocs.csv Normal file
View File

@@ -0,0 +1,24 @@
uuid,event_id,category,type,value,comment,to_ids,date
581bacca-464c-4997-8812-49798e96ca05,4,Network activity,domain,"usacia.websecexp.com","c2 server from Palo Alto study",1,20151016
581bacca-5998-41ad-afb4-49798e96ca05,4,Network activity,domain,"webhttps.websecexp.com","c2 server from Palo Alto study",1,20151016
581bacca-ad18-4ff6-b8b5-49798e96ca05,4,Network activity,domain,"appeur.gnway.cc","c2 server from Palo Alto study",1,20151016
581bacca-eb70-4443-a7d1-49798e96ca05,4,Network activity,domain,"usafbi.websecexp.com","c2 server from Palo Alto study",1,20151016
581bace8-59d0-4c6e-859a-497a8e96ca05,4,Payload type,text,"9002","",0,20151016
581bacf2-d924-45bd-a930-49798e96ca05,4,Payload type,text,"3102","The variant is labeled 3102, because it always uses the string “3102” in its first communications with a C2 server",0,20151016
581bad0a-7524-46f8-9d57-497a8e96ca05,4,Network activity,ip-dst,"198.44.190.85","This IP is a Virtual Private Server (VPS) hosted in the US and owned by VpsQuan",1,20151016
581bad2c-3a60-4be9-8d21-49798e96ca05,4,Payload delivery,md5,"53f81415ccedf453d6e3ebcdc142b966","Attachments",0,20151016
581bad2c-d2d4-46f4-b0cb-49798e96ca05,4,Payload delivery,md5,"699b3d90b050cae37f65c855ec7f616a","Attachments",0,20151016
581bad2c-e744-4a48-ae12-49798e96ca05,4,Payload delivery,md5,"6701662097e274f3cd089ceec35471d2","Attachments",0,20151016
581bad50-2488-429a-b001-497a8e96ca05,4,Artifacts dropped,md5,"c4c147bdfddffec2eea6bf99661e69ee","ca-bundle.exe",1,20151016
581bad50-7890-4dcf-8436-497a8e96ca05,4,Artifacts dropped,md5,"cec071424d417a095221bf8992819388","XLBugHandler.dll",1,20151016
581bad50-8998-4012-926d-497a8e96ca05,4,Artifacts dropped,md5,"5710d567d98a8f4a6682859ce3a35336","lsass.exe",1,20151016
581bad50-a014-4095-a054-497a8e96ca05,4,Artifacts dropped,md5,"56f0e67d981024ddcc215543698f44fb","mcutil.dll",1,20151016
581bad50-aea8-4d5f-8e0c-497a8e96ca05,4,Artifacts dropped,md5,"884d46c01c762ad6ddd2759fd921bf71","mcf.exe",1,20151016
581bad50-d494-4e55-aa91-497a8e96ca05,4,Artifacts dropped,md5,"7e0081fba718fcd71753d3199a290f03","mcf.ep",1,20151016
581bad60-2a18-44cc-ac40-49798e96ca05,4,Artifacts dropped,md5,"49ceba3347d39870f15f2ab0391af234","xlbug.dat",1,20151016
581bad77-2c58-479e-833e-497a8e96ca05,4,Network activity,domain,"t1.mailsecurityservice.com","",1,20151016
581bad77-cde8-4c65-9449-497a8e96ca05,4,Network activity,domain,"t2.mailsecurityservice.com","",1,20151016
581bad90-56b0-4c8b-ba6b-497a8e96ca05,4,Internal reference,link,"https://citizenlab.org/2015/10/targeted-attacks-ngo-burma/","",0,20151016
5824e57b-8458-4669-b6a0-497a8e96ca05,4,Attribution,whois-registrant-email,"wojiaojilao2@sohu.com","",0,20151016
5824e58f-be40-407d-b91b-497a8e96ca05,4,Network activity,domain,"iyouthen.com","Identified through passive DNS",1,20151016
5824e5f1-d174-487e-9156-497a8e96ca05,4,Payload delivery,url,"http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe","",1,20151016
1 uuid event_id category type value comment to_ids date
2 581bacca-464c-4997-8812-49798e96ca05 4 Network activity domain usacia.websecexp.com c2 server from Palo Alto study 1 20151016
3 581bacca-5998-41ad-afb4-49798e96ca05 4 Network activity domain webhttps.websecexp.com c2 server from Palo Alto study 1 20151016
4 581bacca-ad18-4ff6-b8b5-49798e96ca05 4 Network activity domain appeur.gnway.cc c2 server from Palo Alto study 1 20151016
5 581bacca-eb70-4443-a7d1-49798e96ca05 4 Network activity domain usafbi.websecexp.com c2 server from Palo Alto study 1 20151016
6 581bace8-59d0-4c6e-859a-497a8e96ca05 4 Payload type text 9002 0 20151016
7 581bacf2-d924-45bd-a930-49798e96ca05 4 Payload type text 3102 The variant is labeled 3102, because it always uses the string “3102” in its first communications with a C2 server 0 20151016
8 581bad0a-7524-46f8-9d57-497a8e96ca05 4 Network activity ip-dst 198.44.190.85 This IP is a Virtual Private Server (VPS) hosted in the US and owned by VpsQuan 1 20151016
9 581bad2c-3a60-4be9-8d21-49798e96ca05 4 Payload delivery md5 53f81415ccedf453d6e3ebcdc142b966 Attachments 0 20151016
10 581bad2c-d2d4-46f4-b0cb-49798e96ca05 4 Payload delivery md5 699b3d90b050cae37f65c855ec7f616a Attachments 0 20151016
11 581bad2c-e744-4a48-ae12-49798e96ca05 4 Payload delivery md5 6701662097e274f3cd089ceec35471d2 Attachments 0 20151016
12 581bad50-2488-429a-b001-497a8e96ca05 4 Artifacts dropped md5 c4c147bdfddffec2eea6bf99661e69ee ca-bundle.exe 1 20151016
13 581bad50-7890-4dcf-8436-497a8e96ca05 4 Artifacts dropped md5 cec071424d417a095221bf8992819388 XLBugHandler.dll 1 20151016
14 581bad50-8998-4012-926d-497a8e96ca05 4 Artifacts dropped md5 5710d567d98a8f4a6682859ce3a35336 lsass.exe 1 20151016
15 581bad50-a014-4095-a054-497a8e96ca05 4 Artifacts dropped md5 56f0e67d981024ddcc215543698f44fb mcutil.dll 1 20151016
16 581bad50-aea8-4d5f-8e0c-497a8e96ca05 4 Artifacts dropped md5 884d46c01c762ad6ddd2759fd921bf71 mcf.exe 1 20151016
17 581bad50-d494-4e55-aa91-497a8e96ca05 4 Artifacts dropped md5 7e0081fba718fcd71753d3199a290f03 mcf.ep 1 20151016
18 581bad60-2a18-44cc-ac40-49798e96ca05 4 Artifacts dropped md5 49ceba3347d39870f15f2ab0391af234 xlbug.dat 1 20151016
19 581bad77-2c58-479e-833e-497a8e96ca05 4 Network activity domain t1.mailsecurityservice.com 1 20151016
20 581bad77-cde8-4c65-9449-497a8e96ca05 4 Network activity domain t2.mailsecurityservice.com 1 20151016
21 581bad90-56b0-4c8b-ba6b-497a8e96ca05 4 Internal reference link https://citizenlab.org/2015/10/targeted-attacks-ngo-burma/ 0 20151016
22 5824e57b-8458-4669-b6a0-497a8e96ca05 4 Attribution whois-registrant-email wojiaojilao2@sohu.com 0 20151016
23 5824e58f-be40-407d-b91b-497a8e96ca05 4 Network activity domain iyouthen.com Identified through passive DNS 1 20151016
24 5824e5f1-d174-487e-9156-497a8e96ca05 4 Payload delivery url http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe 1 20151016

77
data/ioc/spyware/citizen_lab/201510_NGO_Burma/openioc.ioc Normal file
View File

@@ -0,0 +1,77 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581bac8e-b478-474a-a013-49798e96ca05" last-modified="2015-10-16T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #4</short_description>
<description>Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2015-10-16T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="581bac8e-b478-474a-a013-49798e96ca05">
<IndicatorItem id="c4c147bdfddffec2eea6bf99661e69ee" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="884d46c01c762ad6ddd2759fd921bf71" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="56f0e67d981024ddcc215543698f44fb" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="7e0081fba718fcd71753d3199a290f03" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="5710d567d98a8f4a6682859ce3a35336" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="cec071424d417a095221bf8992819388" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="49ceba3347d39870f15f2ab0391af234" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="usafbi.websecexp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="usacia.websecexp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="webhttps.websecexp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="iyouthen.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="appeur.gnway.cc" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="t1.mailsecurityservice.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="t2.mailsecurityservice.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="198.44.190.85" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

736
data/ioc/spyware/citizen_lab/201510_NGO_Burma/stix.xml Normal file
View File

@@ -0,0 +1,736 @@
<stix:STIX_Package
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
xmlns:marking="http://data-marking.mitre.org/Marking-1"
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:indicator="http://stix.mitre.org/Indicator-2"
xmlns:ttp="http://stix.mitre.org/TTP-1"
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:="https://rufus.citlab.utoronto.ca"
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
xsi:schemaLocation="
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-a3126f94-8e7e-48d3-ad30-dcc198ba7c78" version="1.1.1" timestamp="2016-11-10T21:28:56.977467+00:00">
<stix:STIX_Header>
<stix:Title>Export from MISP</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Related_Packages>
<stix:Related_Package>
<stix:Package id=":STIXPackage-581bac8e-b478-474a-a013-49798e96ca05" version="1.1.1" timestamp="2016-11-10T16:26:09+00:00">
<stix:STIX_Header>
<stix:Title>Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites (MISP Event #4)</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:TTPs>
<stix:TTP id=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'>
<ttp:Title>Payload type: 9002 (MISP Attribute #87)</ttp:Title>
<ttp:Behavior>
<ttp:Malware>
<ttp:Malware_Instance>
<ttp:Name>9002</ttp:Name>
</ttp:Malware_Instance>
</ttp:Malware>
</ttp:Behavior>
</stix:TTP>
<stix:TTP id=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'>
<ttp:Title>Payload type: 3102 (MISP Attribute #88)</ttp:Title>
<ttp:Description>The variant is labeled 3102, because it always uses the string “3102” in its first communications with a C2 server</ttp:Description>
<ttp:Behavior>
<ttp:Malware>
<ttp:Malware_Instance>
<ttp:Name>3102</ttp:Name>
</ttp:Malware_Instance>
</ttp:Malware>
</ttp:Behavior>
</stix:TTP>
</stix:TTPs>
<stix:Incidents>
<stix:Incident id=":incident-581bac8e-b478-474a-a013-49798e96ca05" timestamp="2016-11-10T16:26:30+00:00" xsi:type='incident:IncidentType'>
<incident:Title>Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites</incident:Title>
<incident:External_ID source="MISP Event">4</incident:External_ID>
<incident:Time>
<incident:Incident_Discovery precision="second">2015-10-16T00:00:00+00:00</incident:Incident_Discovery>
<incident:Incident_Reported precision="second">2016-11-10T16:26:30+00:00</incident:Incident_Reported>
</incident:Time>
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">New</incident:Status>
<incident:Related_Indicators>
<incident:Related_Indicator>
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad50-2488-429a-b001-497a8e96ca05" timestamp="2016-11-10T16:22:16+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Artifacts dropped: c4c147bdfddffec2eea6bf99661e69ee (MISP Attribute #93)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Artifacts dropped: c4c147bdfddffec2eea6bf99661e69ee (MISP Attribute #93)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad50-2488-429a-b001-497a8e96ca05">
<cybox:Object id=":File-581bad50-2488-429a-b001-497a8e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">c4c147bdfddffec2eea6bf99661e69ee</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:22:16+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad50-aea8-4d5f-8e0c-497a8e96ca05" timestamp="2016-11-10T16:22:25+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Artifacts dropped: 884d46c01c762ad6ddd2759fd921bf71 (MISP Attribute #94)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Artifacts dropped: 884d46c01c762ad6ddd2759fd921bf71 (MISP Attribute #94)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad50-aea8-4d5f-8e0c-497a8e96ca05">
<cybox:Object id=":File-581bad50-aea8-4d5f-8e0c-497a8e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">884d46c01c762ad6ddd2759fd921bf71</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:22:25+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad50-a014-4095-a054-497a8e96ca05" timestamp="2016-11-10T16:22:33+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Artifacts dropped: 56f0e67d981024ddcc215543698f44fb (MISP Attribute #95)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Artifacts dropped: 56f0e67d981024ddcc215543698f44fb (MISP Attribute #95)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad50-a014-4095-a054-497a8e96ca05">
<cybox:Object id=":File-581bad50-a014-4095-a054-497a8e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">56f0e67d981024ddcc215543698f44fb</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:22:33+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad50-d494-4e55-aa91-497a8e96ca05" timestamp="2016-11-10T16:22:44+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Artifacts dropped: 7e0081fba718fcd71753d3199a290f03 (MISP Attribute #96)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Artifacts dropped: 7e0081fba718fcd71753d3199a290f03 (MISP Attribute #96)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad50-d494-4e55-aa91-497a8e96ca05">
<cybox:Object id=":File-581bad50-d494-4e55-aa91-497a8e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">7e0081fba718fcd71753d3199a290f03</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:22:44+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad50-8998-4012-926d-497a8e96ca05" timestamp="2016-11-10T16:23:13+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Artifacts dropped: 5710d567d98a8f4a6682859ce3a35336 (MISP Attribute #97)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Artifacts dropped: 5710d567d98a8f4a6682859ce3a35336 (MISP Attribute #97)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad50-8998-4012-926d-497a8e96ca05">
<cybox:Object id=":File-581bad50-8998-4012-926d-497a8e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">5710d567d98a8f4a6682859ce3a35336</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:23:13+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad50-7890-4dcf-8436-497a8e96ca05" timestamp="2016-11-10T16:23:24+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Artifacts dropped: cec071424d417a095221bf8992819388 (MISP Attribute #98)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Artifacts dropped: cec071424d417a095221bf8992819388 (MISP Attribute #98)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad50-7890-4dcf-8436-497a8e96ca05">
<cybox:Object id=":File-581bad50-7890-4dcf-8436-497a8e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">cec071424d417a095221bf8992819388</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:23:24+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad60-2a18-44cc-ac40-49798e96ca05" timestamp="2016-11-10T16:23:34+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Artifacts dropped: 49ceba3347d39870f15f2ab0391af234 (MISP Attribute #99)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Artifacts dropped: 49ceba3347d39870f15f2ab0391af234 (MISP Attribute #99)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad60-2a18-44cc-ac40-49798e96ca05">
<cybox:Object id=":File-581bad60-2a18-44cc-ac40-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">49ceba3347d39870f15f2ab0391af234</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:23:34+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Attribution</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5824e57b-8458-4669-b6a0-497a8e96ca05" timestamp="2016-11-10T16:24:11+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Attribution: wojiaojilao2@sohu.com (MISP Attribute #1876)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Description>Attribution: wojiaojilao2@sohu.com (MISP Attribute #1876)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:24:11+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bacca-eb70-4443-a7d1-49798e96ca05" timestamp="2016-11-03T17:31:54+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: usafbi.websecexp.com (MISP Attribute #83)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: usafbi.websecexp.com (MISP Attribute #83)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bacca-eb70-4443-a7d1-49798e96ca05">
<cybox:Object id=":DomainName-581bacca-eb70-4443-a7d1-49798e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">usafbi.websecexp.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:31:54+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bacca-464c-4997-8812-49798e96ca05" timestamp="2016-11-03T17:31:54+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: usacia.websecexp.com (MISP Attribute #84)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: usacia.websecexp.com (MISP Attribute #84)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bacca-464c-4997-8812-49798e96ca05">
<cybox:Object id=":DomainName-581bacca-464c-4997-8812-49798e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">usacia.websecexp.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:31:54+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bacca-5998-41ad-afb4-49798e96ca05" timestamp="2016-11-03T17:31:54+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: webhttps.websecexp.com (MISP Attribute #85)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: webhttps.websecexp.com (MISP Attribute #85)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bacca-5998-41ad-afb4-49798e96ca05">
<cybox:Object id=":DomainName-581bacca-5998-41ad-afb4-49798e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">webhttps.websecexp.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:31:54+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5824e58f-be40-407d-b91b-497a8e96ca05" timestamp="2016-11-10T16:24:31+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: iyouthen.com (MISP Attribute #1877)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: iyouthen.com (MISP Attribute #1877)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5824e58f-be40-407d-b91b-497a8e96ca05">
<cybox:Object id=":DomainName-5824e58f-be40-407d-b91b-497a8e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">iyouthen.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:24:31+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bacca-ad18-4ff6-b8b5-49798e96ca05" timestamp="2016-11-03T17:31:54+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: appeur.gnway.cc (MISP Attribute #86)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: appeur.gnway.cc (MISP Attribute #86)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bacca-ad18-4ff6-b8b5-49798e96ca05">
<cybox:Object id=":DomainName-581bacca-ad18-4ff6-b8b5-49798e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">appeur.gnway.cc</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:31:54+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad77-2c58-479e-833e-497a8e96ca05" timestamp="2016-11-03T17:34:47+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: t1.mailsecurityservice.com (MISP Attribute #100)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: t1.mailsecurityservice.com (MISP Attribute #100)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad77-2c58-479e-833e-497a8e96ca05">
<cybox:Object id=":DomainName-581bad77-2c58-479e-833e-497a8e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">t1.mailsecurityservice.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:34:47+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad77-cde8-4c65-9449-497a8e96ca05" timestamp="2016-11-03T17:34:47+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: t2.mailsecurityservice.com (MISP Attribute #101)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: t2.mailsecurityservice.com (MISP Attribute #101)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad77-cde8-4c65-9449-497a8e96ca05">
<cybox:Object id=":DomainName-581bad77-cde8-4c65-9449-497a8e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">t2.mailsecurityservice.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:34:47+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad0a-7524-46f8-9d57-497a8e96ca05" timestamp="2016-11-03T17:32:58+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 198.44.190.85 (MISP Attribute #89)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 198.44.190.85 (MISP Attribute #89)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad0a-7524-46f8-9d57-497a8e96ca05">
<cybox:Object id=":Address-581bad0a-7524-46f8-9d57-497a8e96ca05">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">198.44.190.85</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:32:58+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad2c-3a60-4be9-8d21-49798e96ca05" timestamp="2016-11-03T17:33:32+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 53f81415ccedf453d6e3ebcdc142b966 (MISP Attribute #90)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 53f81415ccedf453d6e3ebcdc142b966 (MISP Attribute #90)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad2c-3a60-4be9-8d21-49798e96ca05">
<cybox:Object id=":File-581bad2c-3a60-4be9-8d21-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">53f81415ccedf453d6e3ebcdc142b966</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:33:32+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad2c-e744-4a48-ae12-49798e96ca05" timestamp="2016-11-03T17:33:32+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 6701662097e274f3cd089ceec35471d2 (MISP Attribute #91)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 6701662097e274f3cd089ceec35471d2 (MISP Attribute #91)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad2c-e744-4a48-ae12-49798e96ca05">
<cybox:Object id=":File-581bad2c-e744-4a48-ae12-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">6701662097e274f3cd089ceec35471d2</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:33:32+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581bad2c-d2d4-46f4-b0cb-49798e96ca05" timestamp="2016-11-03T17:33:32+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 699b3d90b050cae37f65c855ec7f616a (MISP Attribute #92)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 699b3d90b050cae37f65c855ec7f616a (MISP Attribute #92)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581bad2c-d2d4-46f4-b0cb-49798e96ca05">
<cybox:Object id=":File-581bad2c-d2d4-46f4-b0cb-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">699b3d90b050cae37f65c855ec7f616a</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:33:32+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5824e5f1-d174-487e-9156-497a8e96ca05" timestamp="2016-11-10T16:26:09+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe (MISP Attribute #1878)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Payload delivery: http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe (MISP Attribute #1878)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5824e5f1-d174-487e-9156-497a8e96ca05">
<cybox:Object id=":URI-5824e5f1-d174-487e-9156-497a8e96ca05">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:26:09+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
</incident:Related_Indicators>
<incident:Leveraged_TTPs>
<incident:Leveraged_TTP>
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
<stixCommon:TTP idref=":ttp-581bace8-59d0-4c6e-859a-497a8e96ca05" timestamp="2016-11-03T17:32:24+00:00" xsi:type='ttp:TTPType'/>
</incident:Leveraged_TTP>
<incident:Leveraged_TTP>
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
<stixCommon:TTP idref=":ttp-581bacf2-d924-45bd-a930-49798e96ca05" timestamp="2016-11-03T17:32:34+00:00" xsi:type='ttp:TTPType'/>
</incident:Leveraged_TTP>
</incident:Leveraged_TTPs>
<incident:History>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">Event Threat Level: High</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: TLP:GREEN</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: PUBLISHED</incident:Journal_Entry>
</incident:History_Item>
</incident:History>
<incident:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>citizenlab</stixCommon:Name>
</stixCommon:Identity>
<stixCommon:References>
<stixCommon:Reference>https://citizenlab.org/2015/10/targeted-attacks-ngo-burma/</stixCommon:Reference>
</stixCommon:References>
</incident:Information_Source>
<incident:Handling>
<marking:Marking>
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
</marking:Marking>
</incident:Handling>
</stix:Incident>
</stix:Incidents>
</stix:Package>
</stix:Related_Package>
</stix:Related_Packages>
</stix:STIX_Package>

11
data/ioc/spyware/citizen_lab/201512_PackRAT/README.md Normal file
View File

@@ -0,0 +1,11 @@
## Packrat IOCs
This directory contains IOC from the Citizen Lab report ["Packrat: Seven Years of a South American Threat Actor"](https://citizenlab.org/2015/12/packrat-report/) published the 8th of December 2015.
Files included in this directory:
* openioc.ioc : IOCs in OpenIOC format
* stix.xml : IOCs in STIX XML format
* iocs.csv : IOCs in csv format
* domains.csv - list of domain, ip resolution at time of investigation and relevant date
* md5-c2.csv - list of MD5 hashes and their associated malware family and command and control server domains
* assorted.csv - additional miscellaneous indicators of compromise.

65
data/ioc/spyware/citizen_lab/201512_PackRAT/assorted.csv Normal file
View File

@@ -0,0 +1,65 @@
android-flash.com
apaezb@tutanota.com
autorizacion-gmail.com
bit.ly/1wl3YE2
blackboxmusic.co
boletin@no-creo.info
carlosuurbina@gmail.com
confirmation-blackberry.com
confirmation-facebook.com
confirmation-icloud.com
confirmation-outlook.com
confirmation-twitter.com
confirmation-yahoo.com
deyrep.com
ecuadorenvivo.co
emilio.palacio35@gmail.com
focusecuador.tk
focusedtior1@gmail
guillermolasso@tutanota.com
idapaez@outlook.com
info@no-creo.info
inyurl.com/q4kaf68
janethehinostroza@hotmail.com
justicia-desvinculados.com
lavozamericana.info
lavozamericana.info
login-office365.com
login-office365.com
login-outlook.com
logon-outlook.com
main-local-latam-soporte-widget.cu9.co
main-local-latam-widget-soporte.cu9.co
mgoogle.us
movimiento.anti.correista@gmail.com
movimientoanticorreista.com
no-creo.info
no.response.delivery.es@gmail.com
no.response.delivery.us@gmail.com
noticias@ecuadorenvivo.co
oficinacarlosvera@hotmail.com
Pancaliente.info
periodistasnarcos@gmail.com
soporte-gmail.com
soporte-login-account-gmail.tk
soporte-login-account-yahoo.tk
soporte-main-local-latam-es.cu9.co
soporte-main-local-latam-us.cu9.co
soporte-yahoo.com
soporte@gm-2013.twomini.com
suport-team@us-gooogle.ws
support-gmail.com
support-java.com
support-login-validate-outlook.tk
support-whatsapp.com
support-whatsapp.com
tinyurl.com/ol6qzec
tinyurl.com/pl843ws
tinyurl.com/px28gsa
tinyurl.com/q3zdyk8
tinyurl.com/q4kaf68
tinyurl.com/qxzz6ky
update-outlook.info
us-main-local-latam-soporte-widget.cu9.co
verify-gmail-support-secure.tk
web-google.cu9.co
1 android-flash.com
2 apaezb@tutanota.com
3 autorizacion-gmail.com
4 bit.ly/1wl3YE2
5 blackboxmusic.co
6 boletin@no-creo.info
7 carlosuurbina@gmail.com
8 confirmation-blackberry.com
9 confirmation-facebook.com
10 confirmation-icloud.com
11 confirmation-outlook.com
12 confirmation-twitter.com
13 confirmation-yahoo.com
14 deyrep.com
15 ecuadorenvivo.co
16 emilio.palacio35@gmail.com
17 focusecuador.tk
18 focusedtior1@gmail
19 guillermolasso@tutanota.com
20 idapaez@outlook.com
21 info@no-creo.info
22 inyurl.com/q4kaf68
23 janethehinostroza@hotmail.com
24 justicia-desvinculados.com
25 lavozamericana.info
26 lavozamericana.info
27 login-office365.com
28 login-office365.com
29 login-outlook.com
30 logon-outlook.com
31 main-local-latam-soporte-widget.cu9.co
32 main-local-latam-widget-soporte.cu9.co
33 mgoogle.us
34 movimiento.anti.correista@gmail.com
35 movimientoanticorreista.com
36 no-creo.info
37 no.response.delivery.es@gmail.com
38 no.response.delivery.us@gmail.com
39 noticias@ecuadorenvivo.co
40 oficinacarlosvera@hotmail.com
41 Pancaliente.info
42 periodistasnarcos@gmail.com
43 soporte-gmail.com
44 soporte-login-account-gmail.tk
45 soporte-login-account-yahoo.tk
46 soporte-main-local-latam-es.cu9.co
47 soporte-main-local-latam-us.cu9.co
48 soporte-yahoo.com
49 soporte@gm-2013.twomini.com
50 suport-team@us-gooogle.ws
51 support-gmail.com
52 support-java.com
53 support-login-validate-outlook.tk
54 support-whatsapp.com
55 support-whatsapp.com
56 tinyurl.com/ol6qzec
57 tinyurl.com/pl843ws
58 tinyurl.com/px28gsa
59 tinyurl.com/q3zdyk8
60 tinyurl.com/q4kaf68
61 tinyurl.com/qxzz6ky
62 update-outlook.info
63 us-main-local-latam-soporte-widget.cu9.co
64 verify-gmail-support-secure.tk
65 web-google.cu9.co

23
data/ioc/spyware/citizen_lab/201512_PackRAT/domains.csv Normal file
View File

@@ -0,0 +1,23 @@
Domain,Relevant resolution,Relevant date
deyrep24.ddns.net,50.62.133.49,"November 7th, 2014"
deyrep24.ddns.net,192.169.243.65,"March 3rd, 2015"
daynews.sytes.net,192.169.243.65,"March 3rd, 2015"
daynews.sytes.net,190.20.180.181,"March 1st, 2015"
taskmgr.serveftp.com,190.210.180.181,"August 11th, 2014"
taskmgr.serveftp.com,201.52.24.126,"July 23rd, 2014"
taskmgr.serveftp.com,186.220.1.84,July 11th 2014
taskmgr.servehttp.com,186.220.1.84,"June 24th, 2014"
taskmgr.servehttp.com,201.52.24.126,"July 23rd, 2014"
taskmgr.servehttp.com,186.220.1.84,July 11th 2014
taskmgr.servehttp.com,186.220.11.67,"August 15th, 2014"
taskmgr.redirectme.com,201.52.24.126,"July 23rd, 2014"
taskmgr.redirectme.com,186.220.1.84,July 11th 2014
ruley.no-ip.org,186.220.1.84,July 11th 2014
ruley.no-ip.org,189.100.148.188,"September 6th, 2012"
lolinha.no-ip.org,189.100.148.188,"September 6th, 2012"
wjwj.no-ip.org,189.100.148.188,"September 6th, 2012"
conhost.servehttp.com,186.220.11.67,"August 15th, 2014"
dllhost.servehttp.com,186.220.11.67,"August 15th, 2014"
wjwjwj.no-ip.org,179.208.187.216,"March 25th, 2014"
wjwjwj.no-ip.org,186.220.1.84,"June 24th, 2014"
wjwjwjwj.no-ip.org,179.208.187.216,"March 25th, 2014"
1 Domain Relevant resolution Relevant date
2 deyrep24.ddns.net 50.62.133.49 November 7th, 2014
3 deyrep24.ddns.net 192.169.243.65 March 3rd, 2015
4 daynews.sytes.net 192.169.243.65 March 3rd, 2015
5 daynews.sytes.net 190.20.180.181 March 1st, 2015
6 taskmgr.serveftp.com 190.210.180.181 August 11th, 2014
7 taskmgr.serveftp.com 201.52.24.126 July 23rd, 2014
8 taskmgr.serveftp.com 186.220.1.84 July 11th 2014
9 taskmgr.servehttp.com 186.220.1.84 June 24th, 2014
10 taskmgr.servehttp.com 201.52.24.126 July 23rd, 2014
11 taskmgr.servehttp.com 186.220.1.84 July 11th 2014
12 taskmgr.servehttp.com 186.220.11.67 August 15th, 2014
13 taskmgr.redirectme.com 201.52.24.126 July 23rd, 2014
14 taskmgr.redirectme.com 186.220.1.84 July 11th 2014
15 ruley.no-ip.org 186.220.1.84 July 11th 2014
16 ruley.no-ip.org 189.100.148.188 September 6th, 2012
17 lolinha.no-ip.org 189.100.148.188 September 6th, 2012
18 wjwj.no-ip.org 189.100.148.188 September 6th, 2012
19 conhost.servehttp.com 186.220.11.67 August 15th, 2014
20 dllhost.servehttp.com 186.220.11.67 August 15th, 2014
21 wjwjwj.no-ip.org 179.208.187.216 March 25th, 2014
22 wjwjwj.no-ip.org 186.220.1.84 June 24th, 2014
23 wjwjwjwj.no-ip.org 179.208.187.216 March 25th, 2014

137
data/ioc/spyware/citizen_lab/201512_PackRAT/iocs.csv Normal file
View File

@@ -0,0 +1,137 @@
uuid,event_id,category,type,value,comment,to_ids,date
035cef0c-ab5b-4870-8a2d-3fffb2002a86,12,Network activity,domain,"www.blackboxmusic.co","",1,20161104
04da6270-0f60-44e0-a68c-bb6d0eb89d84,12,Artifacts dropped,md5,"695db7dd3b1daf89f2c56d59faecc088","CyberGate",1,20161108
075b1d0f-b7b2-4571-bd0c-9a2ad1c98663,12,Artifacts dropped,md5,"93b630891db21a4a2350280a360c713d","CyberGate",1,20161108
078ea337-c004-430a-87d7-982e517f81c4,12,Artifacts dropped,md5,"4a23a1d6779d199aaa582cf0a5868ad1","Adzok",1,20161108
080d5bfb-0924-48a0-8b75-37104a301e1c,12,Network activity,ip-dst,"201.52.24.126","",1,20161104
09e60b2e-a849-4dc3-9910-59cd78bc3f82,12,Artifacts dropped,md5,"5a8975873f52436377d8fb0b5ab0d87a","CyberGate",1,20161108
0a4ead27-a700-45f4-bcd0-b469d002b231,12,Network activity,ip-dst,"189.100.148.188","",1,20161104
0c0abe15-22aa-433f-9a15-0b8196c3a99a,12,Network activity,domain,"venezuela365.com","",1,20161104
0e4cc2f6-8b32-489a-8f86-6279b96ff313,12,Network activity,url,"http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html","",1,20161104
0fabddd8-3837-4d33-bb62-efc4edfe67a5,12,Network activity,domain,"supportgmai1.com","",1,20161104
1013af0f-98ea-44cf-8c57-d5dfcc2a9398,12,Network activity,domain,"conhost.servehttp.com","",1,20161104
102812f0-1515-475b-85c9-fe3b9f298322,12,Network activity,domain,"mail-account-update.com","",1,20161104
11c2de46-6ded-4948-914e-a8acff9ff027,12,Artifacts dropped,md5,"ce6065346a918a813eeb58bbb0814a23","CyberGate",1,20161108
1242c1d0-3d53-48f2-a30f-f6566a46b262,12,Artifacts dropped,md5,"efc0009d76a2057f86c5f00030378c72","AlienSpy",1,20161108
17548c65-6dd6-473f-b79c-9ad3095fb9b2,12,Artifacts dropped,md5,"a73351623577f44a2b578fed1e78e37e","CyberGate",1,20161108
19da57bf-1c40-4472-a9e1-696a56ff0d12,12,Network activity,domain,"update-outlook.info","",1,20161104
1b9f7074-c66c-472d-8917-0592bd07202e,12,Network activity,domain,"verify-gmail-support-secure.tk","",1,20161104
1c9844bb-53a7-4c6d-859a-864d802fb755,12,Network activity,ip-dst,"198.12.150.249","",1,20161104
1d17b791-20fd-4a0b-b074-36282e6fe9b9,12,Network activity,domain,"support-java.com","",1,20161104
1f129d35-b9b2-42b4-81f6-8903c25c7080,12,Network activity,domain,"taskmgr.serveftp.com","",1,20161108
1fcd075d-0b8f-42d9-852d-31813ae49879,12,Network activity,domain,"chavistas24.com","",1,20161104
2034aaac-cd1a-4f24-9c9e-a622763cc35a,12,Artifacts dropped,md5,"15ebe16cd9500de534d5bfd5eeceaf73","CyberGate",1,20161108
22c32e7b-f0a5-4e57-8821-a080cb880cdb,12,Network activity,domain,"mesvr.com","",1,20161104
2738530c-979b-43ef-a7a3-6e509d38d073,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig","",1,20161104
29d3b93f-a8c7-46f0-8aaa-d5b1d3a7efa6,12,Network activity,domain,"dllhost.servehttp.com","",1,20161104
2b8e7578-2b1b-4ee4-b690-812825551490,12,Network activity,domain,"deyrep24.ddns.net","C2 server",1,20161108
2bcfdd38-8a5d-4512-b575-9b06096bed81,12,Network activity,domain,"ns1.ukraine.com.ua","",1,20161104
2cd0f135-c88d-4a89-8cd4-bbc6cd3efa0f,12,Artifacts dropped,md5,"01dec1b1d0760d5a1a562edcfeb478d1","CyberGate",1,20161108
2de6d004-f85c-4967-9aaf-f6a2bd9f4349,12,Network activity,ip-dst,"46.246.89.246","",1,20161104
32c1f9d8-b15a-4f28-a91d-1d781b28aaa0,12,Network activity,domain,"n1.login-office365.com","",1,20161104
33a05e11-fe8c-47e0-b8a2-55b568df6adf,12,Network activity,domain,"focusecuador.tk","",1,20161104
341b2a91-d835-4766-8a27-d0a04cf9af90,12,Artifacts dropped,md5,"a74ef893b1bf21c9df6d8e31285db981","CyberGate",1,20161108
378b1659-18cc-484d-aa90-df1a36849693,12,Artifacts dropped,md5,"1e6d0b59d4fb7650453c207688385f3a","CyberGate",1,20161108
395f1ba8-c107-4622-a845-f2a2e2660b64,12,Network activity,domain,"movimientoanticorreista.com","",1,20161104
3a638a7b-6cc4-4cfe-940c-921fb417e79c,12,Artifacts dropped,md5,"c2237e9d415f542ce6e73adb260af123","Xtreme RAT",1,20161108
3b6d91fc-6693-453e-b8d0-9a0955b12a9c,12,Network activity,url,"http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html","",1,20161104
3cd6d0dd-13e7-40b1-adaf-957bedfc212b,12,Artifacts dropped,md5,"7b2cb5249d704cb1df8d4210e7c3d553","CyberGate",1,20161108
438fd35d-28ff-4669-a2c6-d3606ad95501,12,Payload delivery,email-src,"enripintos123@outlook.es","",1,20161104
440b7b2b-7d18-4a95-a95c-f4d80412535c,12,Artifacts dropped,md5,"e03be1849ad7cecba1e20923074cd22f","CyberGate",1,20161108
475c2ee5-d819-4a55-bb4d-1d909905c039,12,Artifacts dropped,md5,"d2adecc6287dd4d559fe6ce2ce7a7e31","Cybergate",1,20161108
491292ff-d9e0-481e-aed8-575ac817cff9,12,Network activity,domain,"asambleanacional-gob-ec.cu9.co","",1,20161104
4982d975-2425-4c0e-8709-8ea8c3743372,12,Payload delivery,email-src,"no-responder@supportgmai1.com","",1,20161104
4e2e0b4c-8e54-40bc-9432-152d34b9980b,12,Network activity,domain,"24.com","",0,20161104
4e37e013-f1ce-4df9-ae83-f04eb6b18ba9,12,Network activity,domain,"taskmgr.redirectme.com","",1,20161104
50dd1978-ed90-48a0-8fae-f841d7d26c0e,12,Network activity,domain,"cu9.co","",1,20161104
521771b2-16c0-44e8-b1c6-0dedfe52a93f,12,Network activity,url,"http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado","",1,20161104
53063744-8009-4309-823f-44ac089a9f4d,12,Network activity,domain,"formmail.com","",1,20161104
53d09cce-3d68-4a76-bddb-118176b5eda6,12,Artifacts dropped,md5,"2de51e74fd571319bbf763ec62781096","AlienSpy",1,20161108
55ab0c50-6ba9-44f0-bbf5-e30f13396fba,12,Artifacts dropped,md5,"1e4265a0c37773c2372b97bb6630ae57","Adzok",1,20161108
55bc7d1d-b8c1-404a-ba53-0e81f893bf4f,12,Payload delivery,email-src,"movimiento.anti.correista@gmail.com","",1,20161104
568339a3-cddf-4539-8e40-f2d726a5341b,12,Network activity,domain,"ecuadorenvivo.com","",1,20161104
56e407af-b034-469f-833e-4261d12f4e3f,12,Network activity,ip-dst,"179.208.187.216","",1,20161104
576bf524-78bd-47b8-9ae0-54ecea1bb4af,12,Network activity,domain,"ns1.deyrep.com","",1,20161104
581c127f-fca8-4148-9a35-497a8e96ca05,12,External analysis,link,"https://citizenlab.org/2015/12/packrat-report/","",0,20161108
582243bb-0f34-4775-9d56-49798e96ca05,12,Payload type,text,"CyberGate","",0,20161108
582243bb-28a4-4ba0-bb04-49798e96ca05,12,Payload type,text,"Adzok","",0,20161108
582243bb-c8d8-4986-a6f6-49798e96ca05,12,Payload type,text,"Xtreme RAT","",0,20161108
582243bb-f194-4e73-8e86-49798e96ca05,12,Payload type,text,"AlienSpy","",0,20161108
5f6ed532-7034-4529-8f1f-eca4f3ead06a,12,Network activity,domain,"soporte-login-account-yahoo.tk","",1,20161104
613fc81a-9472-402a-864f-ba796bd820f9,12,Network activity,domain,"n4.pancaliente.info","",1,20161104
63f47613-ca7a-4a85-859b-55acf0440a1a,12,Network activity,ip-dst,"50.63.202.57","",1,20161104
64c9eefd-aabd-47be-8a66-56a3f777fca0,12,Network activity,domain,"taskmgr.redirectme.net","",1,20161104
65be605b-ce44-483a-9398-c9b6c1d2584f,12,Network activity,domain,"s1.mgoogle.us","",1,20161104
665a391e-0346-477b-8062-0e093fba3333,12,Artifacts dropped,md5,"a09f100ddc7cf29f8a93a3d7a79c58b9","CyberGate",1,20161108
668f1383-b9db-44fb-ab01-49537c77ad1e,12,Network activity,domain,"blackboxmusic.co","",1,20161104
694b6503-2ef8-4da9-8adf-1eaf5b0393c8,12,Artifacts dropped,md5,"2d722592a4e3c8030410dccccb221ce4","CyberGate",1,20161108
69d8d573-3f23-493b-97f4-8fa6b4cf9f1b,12,Artifacts dropped,md5,"2827450763b55c5e71fda3caaf8e75f9","Xtreme RAT",1,20161108
6cb4f4a0-1cf6-4cf4-98c2-5b9b93ff9867,12,Artifacts dropped,md5,"8fb96dfab7e4c0acb1eb9f4e950ba4b9","AlienSpy",1,20161108
74bc6c34-77bb-4328-9edc-75059585e539,12,Network activity,domain,"mgoogle.us","",1,20161104
77cc5d54-a422-4f1b-ab2f-167cdfde8bef,12,Network activity,domain,"focusecuador.net","",1,20161104
7908fe7c-4346-4810-9f79-3ad2a8b93fd6,12,Network activity,domain,"n2.login-office365.com","",1,20161104
7a7a2e9e-8e1e-45c7-ba5d-c6d6ce59465a,12,Network activity,domain,"ns1.hostinger.ru","",1,20161104
7a948702-dd5c-46da-93e6-37d7bc088693,12,Network activity,ip-dst,"190.20.180.181","",1,20161104
7b018a95-eb5d-4226-a5ca-9e32f4b288e4,12,Network activity,domain,"deyrep.com","",1,20161104
7ca51a3d-b093-497f-accf-00bca0964287,12,Network activity,domain,"ns2.deyrep.com","",1,20161104
809f7cd8-5a6f-4e4e-baca-d148180828b7,12,Network activity,url,"http://mail.asambleanacional.gob.ec","",1,20161104
8149df18-d5b8-4b8f-9ebf-48676f586058,12,Network activity,ip-dst,"193.105.134.27","",1,20161104
823b71a4-5bcc-4c16-bd79-816b1b6e70d9,12,Network activity,domain,"justicia-desvinculados.com","",1,20161104
83aa404a-cb12-407c-993c-1ff9b7fa1947,12,Network activity,domain,"ftp.server.com","",1,20161104
83bc4a8a-fe39-48d7-b26c-f4e4bfe08cde,12,Network activity,domain,"lolinha.no-ip.org","",1,20161104
85d91d34-8222-4b2e-b154-0b394ec75fe3,12,Artifacts dropped,md5,"3a61d64986ee6529cee271ab6754faa5","CyberGate",1,20161108
887aba05-4662-4967-8d93-09cb8b3d7685,12,Network activity,domain,"n1.support-java.com","",1,20161104
88a1c5b7-d445-49fc-aa75-7ee28b069510,12,Payload delivery,email-src,"focusedtior1@gmail.com","",1,20161104
89db0f38-a183-45b8-9503-69828bf29412,12,Network activity,ip-dst,"192.169.243.65","IP address linked to deyrep24.ddns.net",1,20161108
8ae2e6c9-806a-4a57-aa17-aed767339990,12,Artifacts dropped,md5,"d7f34168b1a7dd7cbd8e62a5ab1ebc0e","Xtreme RAT",1,20161108
8d8d0ac6-1cbe-4d9c-9b3c-8b7dbd1a1ce4,12,Artifacts dropped,md5,"779a79c11f581b84e7c81f321fd8d743","CyberGate",1,20161108
8ea723f1-5e6d-4984-80a1-c844988006d9,12,Network activity,url,"http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg","",1,20161104
8eecda70-e625-413f-b7fc-8451d76f4765,12,Network activity,domain,"ec.cu9.co","",1,20161104
8f38d4c7-dff5-484f-be90-3aaa3fba6753,12,Artifacts dropped,md5,"d2f151312f7dee2483ddcab9766b56db","AlienSpy",1,20161108
9096fec9-6b26-4c94-a9a1-8bfe16caf1b5,12,Artifacts dropped,md5,"8e0f021dcbbfa586a1c6780e77ac0fb6","CyberGate",1,20161108
93541388-7cc4-436a-bf73-1e1584776a59,12,Network activity,domain,"www.movimientoanticorreista.com","",1,20161104
9e0ea90e-1dae-4fd3-9fe2-a95bf8ff29c7,12,Network activity,ip-dst,"190.210.180.181","",1,20161104
9f3c0a52-cf4e-434c-852b-a93df8a857e1,12,Payload delivery,email-src,"claudiobonadio88@gmail.com","",1,20161108
9fbc655c-1010-4057-8af4-d29425574e3e,12,Artifacts dropped,md5,"13d939b2412c6adbab3cc1b539166671","CyberGate",1,20161108
a0787877-1f51-45a2-a268-99585abd3753,12,Network activity,domain,"android-flash.com","",1,20161104
a179e1f8-66e4-4055-a762-ed5d9166afa2,12,Artifacts dropped,md5,"74613eae84347183b4ca61b912a4573f","AlienSpy",1,20161108
a38d5330-38f4-4016-a6a5-82fefed9aacd,12,Network activity,domain,"wjwjwjwj.no-ip.org","",1,20161104
a391d94a-2311-4420-a315-067f450915c2,12,Network activity,domain,"ftp.ftpserver.com","",1,20161104
a723650f-2306-48f3-a588-e57822f92448,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies","",1,20161104
a8d6eb71-318f-4516-b319-5e50d6996770,12,Artifacts dropped,md5,"dd1101adc86fd282f5f183942cc2f3b7","CyberGate",1,20161108
ab318121-5622-4ea7-aca3-59e972601644,12,Network activity,domain,"n3.pancaliente.info","",1,20161104
abb6b95e-2364-4aad-b826-7c925b587d0a,12,Network activity,domain,"lavozmericana.info","",1,20161104
abc292cf-5485-4189-8c0a-b18d830cc7f2,12,Network activity,domain,"pancaliente.info","",1,20161104
ac5dde92-e97e-4b57-9305-5e439f9bbb40,12,Artifacts dropped,md5,"ea50bf8abcf9c0c40c4490dc15fb0a2a","CyberGate",1,20161108
aea5a3f5-d174-47c1-81a0-c97a5a478e00,12,Network activity,domain,"n1.lavozamericana.info","",1,20161104
b0bd3917-ba04-4d95-a5d3-928993f331a9,12,Artifacts dropped,md5,"a988235ad7d47acbeca5ccb4ea5a1ed5","CyberGate",1,20161108
b0df1407-9653-4f07-8f2e-5cd7f1c1a212,12,Network activity,domain,"n1.update-outlook.info","",1,20161104
b373771f-54f4-4559-8297-52779ee94c28,12,Network activity,domain,"soporte-login-account-gmail.tk","",1,20161104
b5b19817-6112-4eeb-b3d1-666f92b33ee7,12,Network activity,domain,"no.response.delivery.es","",1,20161104
b66ec73a-4faf-4873-bdd8-8fdde6207ca4,12,Network activity,domain,"ecuadorenvivo.co","",1,20161104
b812855c-8fdc-41f2-8857-8966aa84ea89,12,Network activity,domain,"ruley.no-ip.org","",1,20161104
bc40a9ee-df43-4ba3-ad9d-529dc845d04b,12,Network activity,domain,"s2.mgoogle.us","",1,20161104
bd9e3887-abea-465a-9f42-4ca38ea31d17,12,Artifacts dropped,md5,"0ae0038ffe8cf5c3170734a71ff2213d","AlienSpy",1,20161108
c00a3cd4-3530-4a3d-a0b2-4231aad495ad,12,Network activity,domain,"login-office365.com","",1,20161104
c103e0dc-7fb4-4e6d-a3d1-d6dfadc90045,12,Artifacts dropped,md5,"08a3bb5b220eb1e0dc2ecccbbc6859f5","Adzok",1,20161108
c67572b2-b7f4-4f32-9e4d-a8892079fec4,12,Network activity,domain,"wjwjwj.no-ip.org","",1,20161104
c6f40987-2e22-495f-9fcf-ce681c67e901,12,Network activity,domain,"daynews.sytes.net","domain linked to deyrep24.ddns.net",1,20161108
c7d3ba98-9951-45a1-864f-ad1c6c000aad,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Active","",1,20161104
c891c678-1cf0-4842-bcec-fe93b9479a28,12,Network activity,ip-dst,"50.62.133.49","IP address linked to deyrep24.ddns.net",1,20161108
cbdf99c3-ac02-49e1-bd44-aa95c5e2acac,12,Network activity,domain,"wjwj.no-ip.org","",1,20161104
ced4acdc-8a7e-4766-b6c6-431b37b0e332,12,Payload delivery,email-src,"cfed.bonadio@gmail.com","Phishing source pretending to be Claudio Bonadio",1,20161108
cf896608-add9-45a1-8a66-8a04096b70f1,12,Network activity,domain,"mail.asambleanacional.gob.ec","",1,20161104
cfd9e067-855e-4c38-af7b-b1ec7b9c5e0f,12,Network activity,domain,"support-whatsapp.com","",1,20161104
d036cf1a-59fb-4c11-9da9-cbf99f5733a7,12,Artifacts dropped,md5,"ed8d7ed45b64890b8901b735018318f3","CyberGate",1,20161108
d605e928-93ec-4aec-897e-0de476fe3f0e,12,Network activity,domain,"s1.support","",1,20161104
d736d788-19c3-47d3-85ba-6f1b8a3f0897,12,Network activity,ip-dst,"186.220.1.84","",1,20161104
d79f9f17-548f-4712-afdf-a8dc5dc43be1,12,Network activity,domain,"taskmgr.servehttp.com","",1,20161104
da13fa70-4007-4c44-b611-a890dd8b1f31,12,Artifacts dropped,md5,"ea7bcf58a4ccdecb0c64e56b9998a4ac","Adzok",1,20161108
dad67427-90fd-429f-94cc-15aab9efefc7,12,Artifacts dropped,md5,"bc97437fec7e7e8634c2eabae3cc4832","CyberGate",1,20161108
e4567864-ed20-4a52-8ebc-280bb84bc259,12,Payload delivery,email-src,"no.response.delivery.es@gmail.com","",1,20161104
ec9d62d6-4906-45a7-a781-a4b3939e77bc,12,Network activity,domain,"gmail.com.msg07.xyz","",1,20161104
f4ce5713-8486-4eff-be64-f04899ad0e63,12,Network activity,ip-dst,"186.220.11.67","",1,20161104
f5818138-37c1-412a-8cf7-2d7bcb538367,12,Network activity,domain,"lavozamericana.info","",1,20161104
f7508074-3443-4ceb-a1b6-08e87bc65b44,12,Network activity,domain,"support-login-validate-outlook.tk","",1,20161104
f7dbcb2a-96c1-48d9-8bda-785348f8d91b,12,Artifacts dropped,md5,"6c34d4296126679d9c6a0bc2660dc453","CyberGate",1,20161108
fd6b3ff2-e441-4bc1-ba2d-d3d9dd50ab24,12,Network activity,domain,"ns.update-outlook.info","",1,20161104
1 uuid event_id category type value comment to_ids date
2 035cef0c-ab5b-4870-8a2d-3fffb2002a86 12 Network activity domain www.blackboxmusic.co 1 20161104
3 04da6270-0f60-44e0-a68c-bb6d0eb89d84 12 Artifacts dropped md5 695db7dd3b1daf89f2c56d59faecc088 CyberGate 1 20161108
4 075b1d0f-b7b2-4571-bd0c-9a2ad1c98663 12 Artifacts dropped md5 93b630891db21a4a2350280a360c713d CyberGate 1 20161108
5 078ea337-c004-430a-87d7-982e517f81c4 12 Artifacts dropped md5 4a23a1d6779d199aaa582cf0a5868ad1 Adzok 1 20161108
6 080d5bfb-0924-48a0-8b75-37104a301e1c 12 Network activity ip-dst 201.52.24.126 1 20161104
7 09e60b2e-a849-4dc3-9910-59cd78bc3f82 12 Artifacts dropped md5 5a8975873f52436377d8fb0b5ab0d87a CyberGate 1 20161108
8 0a4ead27-a700-45f4-bcd0-b469d002b231 12 Network activity ip-dst 189.100.148.188 1 20161104
9 0c0abe15-22aa-433f-9a15-0b8196c3a99a 12 Network activity domain venezuela365.com 1 20161104
10 0e4cc2f6-8b32-489a-8f86-6279b96ff313 12 Network activity url http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html 1 20161104
11 0fabddd8-3837-4d33-bb62-efc4edfe67a5 12 Network activity domain supportgmai1.com 1 20161104
12 1013af0f-98ea-44cf-8c57-d5dfcc2a9398 12 Network activity domain conhost.servehttp.com 1 20161104
13 102812f0-1515-475b-85c9-fe3b9f298322 12 Network activity domain mail-account-update.com 1 20161104
14 11c2de46-6ded-4948-914e-a8acff9ff027 12 Artifacts dropped md5 ce6065346a918a813eeb58bbb0814a23 CyberGate 1 20161108
15 1242c1d0-3d53-48f2-a30f-f6566a46b262 12 Artifacts dropped md5 efc0009d76a2057f86c5f00030378c72 AlienSpy 1 20161108
16 17548c65-6dd6-473f-b79c-9ad3095fb9b2 12 Artifacts dropped md5 a73351623577f44a2b578fed1e78e37e CyberGate 1 20161108
17 19da57bf-1c40-4472-a9e1-696a56ff0d12 12 Network activity domain update-outlook.info 1 20161104
18 1b9f7074-c66c-472d-8917-0592bd07202e 12 Network activity domain verify-gmail-support-secure.tk 1 20161104
19 1c9844bb-53a7-4c6d-859a-864d802fb755 12 Network activity ip-dst 198.12.150.249 1 20161104
20 1d17b791-20fd-4a0b-b074-36282e6fe9b9 12 Network activity domain support-java.com 1 20161104
21 1f129d35-b9b2-42b4-81f6-8903c25c7080 12 Network activity domain taskmgr.serveftp.com 1 20161108
22 1fcd075d-0b8f-42d9-852d-31813ae49879 12 Network activity domain chavistas24.com 1 20161104
23 2034aaac-cd1a-4f24-9c9e-a622763cc35a 12 Artifacts dropped md5 15ebe16cd9500de534d5bfd5eeceaf73 CyberGate 1 20161108
24 22c32e7b-f0a5-4e57-8821-a080cb880cdb 12 Network activity domain mesvr.com 1 20161104
25 2738530c-979b-43ef-a7a3-6e509d38d073 12 Artifacts dropped regkey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig 1 20161104
26 29d3b93f-a8c7-46f0-8aaa-d5b1d3a7efa6 12 Network activity domain dllhost.servehttp.com 1 20161104
27 2b8e7578-2b1b-4ee4-b690-812825551490 12 Network activity domain deyrep24.ddns.net C2 server 1 20161108
28 2bcfdd38-8a5d-4512-b575-9b06096bed81 12 Network activity domain ns1.ukraine.com.ua 1 20161104
29 2cd0f135-c88d-4a89-8cd4-bbc6cd3efa0f 12 Artifacts dropped md5 01dec1b1d0760d5a1a562edcfeb478d1 CyberGate 1 20161108
30 2de6d004-f85c-4967-9aaf-f6a2bd9f4349 12 Network activity ip-dst 46.246.89.246 1 20161104
31 32c1f9d8-b15a-4f28-a91d-1d781b28aaa0 12 Network activity domain n1.login-office365.com 1 20161104
32 33a05e11-fe8c-47e0-b8a2-55b568df6adf 12 Network activity domain focusecuador.tk 1 20161104
33 341b2a91-d835-4766-8a27-d0a04cf9af90 12 Artifacts dropped md5 a74ef893b1bf21c9df6d8e31285db981 CyberGate 1 20161108
34 378b1659-18cc-484d-aa90-df1a36849693 12 Artifacts dropped md5 1e6d0b59d4fb7650453c207688385f3a CyberGate 1 20161108
35 395f1ba8-c107-4622-a845-f2a2e2660b64 12 Network activity domain movimientoanticorreista.com 1 20161104
36 3a638a7b-6cc4-4cfe-940c-921fb417e79c 12 Artifacts dropped md5 c2237e9d415f542ce6e73adb260af123 Xtreme RAT 1 20161108
37 3b6d91fc-6693-453e-b8d0-9a0955b12a9c 12 Network activity url http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html 1 20161104
38 3cd6d0dd-13e7-40b1-adaf-957bedfc212b 12 Artifacts dropped md5 7b2cb5249d704cb1df8d4210e7c3d553 CyberGate 1 20161108
39 438fd35d-28ff-4669-a2c6-d3606ad95501 12 Payload delivery email-src enripintos123@outlook.es 1 20161104
40 440b7b2b-7d18-4a95-a95c-f4d80412535c 12 Artifacts dropped md5 e03be1849ad7cecba1e20923074cd22f CyberGate 1 20161108
41 475c2ee5-d819-4a55-bb4d-1d909905c039 12 Artifacts dropped md5 d2adecc6287dd4d559fe6ce2ce7a7e31 Cybergate 1 20161108
42 491292ff-d9e0-481e-aed8-575ac817cff9 12 Network activity domain asambleanacional-gob-ec.cu9.co 1 20161104
43 4982d975-2425-4c0e-8709-8ea8c3743372 12 Payload delivery email-src no-responder@supportgmai1.com 1 20161104
44 4e2e0b4c-8e54-40bc-9432-152d34b9980b 12 Network activity domain 24.com 0 20161104
45 4e37e013-f1ce-4df9-ae83-f04eb6b18ba9 12 Network activity domain taskmgr.redirectme.com 1 20161104
46 50dd1978-ed90-48a0-8fae-f841d7d26c0e 12 Network activity domain cu9.co 1 20161104
47 521771b2-16c0-44e8-b1c6-0dedfe52a93f 12 Network activity url http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado 1 20161104
48 53063744-8009-4309-823f-44ac089a9f4d 12 Network activity domain formmail.com 1 20161104
49 53d09cce-3d68-4a76-bddb-118176b5eda6 12 Artifacts dropped md5 2de51e74fd571319bbf763ec62781096 AlienSpy 1 20161108
50 55ab0c50-6ba9-44f0-bbf5-e30f13396fba 12 Artifacts dropped md5 1e4265a0c37773c2372b97bb6630ae57 Adzok 1 20161108
51 55bc7d1d-b8c1-404a-ba53-0e81f893bf4f 12 Payload delivery email-src movimiento.anti.correista@gmail.com 1 20161104
52 568339a3-cddf-4539-8e40-f2d726a5341b 12 Network activity domain ecuadorenvivo.com 1 20161104
53 56e407af-b034-469f-833e-4261d12f4e3f 12 Network activity ip-dst 179.208.187.216 1 20161104
54 576bf524-78bd-47b8-9ae0-54ecea1bb4af 12 Network activity domain ns1.deyrep.com 1 20161104
55 581c127f-fca8-4148-9a35-497a8e96ca05 12 External analysis link https://citizenlab.org/2015/12/packrat-report/ 0 20161108
56 582243bb-0f34-4775-9d56-49798e96ca05 12 Payload type text CyberGate 0 20161108
57 582243bb-28a4-4ba0-bb04-49798e96ca05 12 Payload type text Adzok 0 20161108
58 582243bb-c8d8-4986-a6f6-49798e96ca05 12 Payload type text Xtreme RAT 0 20161108
59 582243bb-f194-4e73-8e86-49798e96ca05 12 Payload type text AlienSpy 0 20161108
60 5f6ed532-7034-4529-8f1f-eca4f3ead06a 12 Network activity domain soporte-login-account-yahoo.tk 1 20161104
61 613fc81a-9472-402a-864f-ba796bd820f9 12 Network activity domain n4.pancaliente.info 1 20161104
62 63f47613-ca7a-4a85-859b-55acf0440a1a 12 Network activity ip-dst 50.63.202.57 1 20161104
63 64c9eefd-aabd-47be-8a66-56a3f777fca0 12 Network activity domain taskmgr.redirectme.net 1 20161104
64 65be605b-ce44-483a-9398-c9b6c1d2584f 12 Network activity domain s1.mgoogle.us 1 20161104
65 665a391e-0346-477b-8062-0e093fba3333 12 Artifacts dropped md5 a09f100ddc7cf29f8a93a3d7a79c58b9 CyberGate 1 20161108
66 668f1383-b9db-44fb-ab01-49537c77ad1e 12 Network activity domain blackboxmusic.co 1 20161104
67 694b6503-2ef8-4da9-8adf-1eaf5b0393c8 12 Artifacts dropped md5 2d722592a4e3c8030410dccccb221ce4 CyberGate 1 20161108
68 69d8d573-3f23-493b-97f4-8fa6b4cf9f1b 12 Artifacts dropped md5 2827450763b55c5e71fda3caaf8e75f9 Xtreme RAT 1 20161108
69 6cb4f4a0-1cf6-4cf4-98c2-5b9b93ff9867 12 Artifacts dropped md5 8fb96dfab7e4c0acb1eb9f4e950ba4b9 AlienSpy 1 20161108
70 74bc6c34-77bb-4328-9edc-75059585e539 12 Network activity domain mgoogle.us 1 20161104
71 77cc5d54-a422-4f1b-ab2f-167cdfde8bef 12 Network activity domain focusecuador.net 1 20161104
72 7908fe7c-4346-4810-9f79-3ad2a8b93fd6 12 Network activity domain n2.login-office365.com 1 20161104
73 7a7a2e9e-8e1e-45c7-ba5d-c6d6ce59465a 12 Network activity domain ns1.hostinger.ru 1 20161104
74 7a948702-dd5c-46da-93e6-37d7bc088693 12 Network activity ip-dst 190.20.180.181 1 20161104
75 7b018a95-eb5d-4226-a5ca-9e32f4b288e4 12 Network activity domain deyrep.com 1 20161104
76 7ca51a3d-b093-497f-accf-00bca0964287 12 Network activity domain ns2.deyrep.com 1 20161104
77 809f7cd8-5a6f-4e4e-baca-d148180828b7 12 Network activity url http://mail.asambleanacional.gob.ec 1 20161104
78 8149df18-d5b8-4b8f-9ebf-48676f586058 12 Network activity ip-dst 193.105.134.27 1 20161104
79 823b71a4-5bcc-4c16-bd79-816b1b6e70d9 12 Network activity domain justicia-desvinculados.com 1 20161104
80 83aa404a-cb12-407c-993c-1ff9b7fa1947 12 Network activity domain ftp.server.com 1 20161104
81 83bc4a8a-fe39-48d7-b26c-f4e4bfe08cde 12 Network activity domain lolinha.no-ip.org 1 20161104
82 85d91d34-8222-4b2e-b154-0b394ec75fe3 12 Artifacts dropped md5 3a61d64986ee6529cee271ab6754faa5 CyberGate 1 20161108
83 887aba05-4662-4967-8d93-09cb8b3d7685 12 Network activity domain n1.support-java.com 1 20161104
84 88a1c5b7-d445-49fc-aa75-7ee28b069510 12 Payload delivery email-src focusedtior1@gmail.com 1 20161104
85 89db0f38-a183-45b8-9503-69828bf29412 12 Network activity ip-dst 192.169.243.65 IP address linked to deyrep24.ddns.net 1 20161108
86 8ae2e6c9-806a-4a57-aa17-aed767339990 12 Artifacts dropped md5 d7f34168b1a7dd7cbd8e62a5ab1ebc0e Xtreme RAT 1 20161108
87 8d8d0ac6-1cbe-4d9c-9b3c-8b7dbd1a1ce4 12 Artifacts dropped md5 779a79c11f581b84e7c81f321fd8d743 CyberGate 1 20161108
88 8ea723f1-5e6d-4984-80a1-c844988006d9 12 Network activity url http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg 1 20161104
89 8eecda70-e625-413f-b7fc-8451d76f4765 12 Network activity domain ec.cu9.co 1 20161104
90 8f38d4c7-dff5-484f-be90-3aaa3fba6753 12 Artifacts dropped md5 d2f151312f7dee2483ddcab9766b56db AlienSpy 1 20161108
91 9096fec9-6b26-4c94-a9a1-8bfe16caf1b5 12 Artifacts dropped md5 8e0f021dcbbfa586a1c6780e77ac0fb6 CyberGate 1 20161108
92 93541388-7cc4-436a-bf73-1e1584776a59 12 Network activity domain www.movimientoanticorreista.com 1 20161104
93 9e0ea90e-1dae-4fd3-9fe2-a95bf8ff29c7 12 Network activity ip-dst 190.210.180.181 1 20161104
94 9f3c0a52-cf4e-434c-852b-a93df8a857e1 12 Payload delivery email-src claudiobonadio88@gmail.com 1 20161108
95 9fbc655c-1010-4057-8af4-d29425574e3e 12 Artifacts dropped md5 13d939b2412c6adbab3cc1b539166671 CyberGate 1 20161108
96 a0787877-1f51-45a2-a268-99585abd3753 12 Network activity domain android-flash.com 1 20161104
97 a179e1f8-66e4-4055-a762-ed5d9166afa2 12 Artifacts dropped md5 74613eae84347183b4ca61b912a4573f AlienSpy 1 20161108
98 a38d5330-38f4-4016-a6a5-82fefed9aacd 12 Network activity domain wjwjwjwj.no-ip.org 1 20161104
99 a391d94a-2311-4420-a315-067f450915c2 12 Network activity domain ftp.ftpserver.com 1 20161104
100 a723650f-2306-48f3-a588-e57822f92448 12 Artifacts dropped regkey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies 1 20161104
101 a8d6eb71-318f-4516-b319-5e50d6996770 12 Artifacts dropped md5 dd1101adc86fd282f5f183942cc2f3b7 CyberGate 1 20161108
102 ab318121-5622-4ea7-aca3-59e972601644 12 Network activity domain n3.pancaliente.info 1 20161104
103 abb6b95e-2364-4aad-b826-7c925b587d0a 12 Network activity domain lavozmericana.info 1 20161104
104 abc292cf-5485-4189-8c0a-b18d830cc7f2 12 Network activity domain pancaliente.info 1 20161104
105 ac5dde92-e97e-4b57-9305-5e439f9bbb40 12 Artifacts dropped md5 ea50bf8abcf9c0c40c4490dc15fb0a2a CyberGate 1 20161108
106 aea5a3f5-d174-47c1-81a0-c97a5a478e00 12 Network activity domain n1.lavozamericana.info 1 20161104
107 b0bd3917-ba04-4d95-a5d3-928993f331a9 12 Artifacts dropped md5 a988235ad7d47acbeca5ccb4ea5a1ed5 CyberGate 1 20161108
108 b0df1407-9653-4f07-8f2e-5cd7f1c1a212 12 Network activity domain n1.update-outlook.info 1 20161104
109 b373771f-54f4-4559-8297-52779ee94c28 12 Network activity domain soporte-login-account-gmail.tk 1 20161104
110 b5b19817-6112-4eeb-b3d1-666f92b33ee7 12 Network activity domain no.response.delivery.es 1 20161104
111 b66ec73a-4faf-4873-bdd8-8fdde6207ca4 12 Network activity domain ecuadorenvivo.co 1 20161104
112 b812855c-8fdc-41f2-8857-8966aa84ea89 12 Network activity domain ruley.no-ip.org 1 20161104
113 bc40a9ee-df43-4ba3-ad9d-529dc845d04b 12 Network activity domain s2.mgoogle.us 1 20161104
114 bd9e3887-abea-465a-9f42-4ca38ea31d17 12 Artifacts dropped md5 0ae0038ffe8cf5c3170734a71ff2213d AlienSpy 1 20161108
115 c00a3cd4-3530-4a3d-a0b2-4231aad495ad 12 Network activity domain login-office365.com 1 20161104
116 c103e0dc-7fb4-4e6d-a3d1-d6dfadc90045 12 Artifacts dropped md5 08a3bb5b220eb1e0dc2ecccbbc6859f5 Adzok 1 20161108
117 c67572b2-b7f4-4f32-9e4d-a8892079fec4 12 Network activity domain wjwjwj.no-ip.org 1 20161104
118 c6f40987-2e22-495f-9fcf-ce681c67e901 12 Network activity domain daynews.sytes.net domain linked to deyrep24.ddns.net 1 20161108
119 c7d3ba98-9951-45a1-864f-ad1c6c000aad 12 Artifacts dropped regkey HKLM\SOFTWARE\Microsoft\Active 1 20161104
120 c891c678-1cf0-4842-bcec-fe93b9479a28 12 Network activity ip-dst 50.62.133.49 IP address linked to deyrep24.ddns.net 1 20161108
121 cbdf99c3-ac02-49e1-bd44-aa95c5e2acac 12 Network activity domain wjwj.no-ip.org 1 20161104
122 ced4acdc-8a7e-4766-b6c6-431b37b0e332 12 Payload delivery email-src cfed.bonadio@gmail.com Phishing source pretending to be Claudio Bonadio 1 20161108
123 cf896608-add9-45a1-8a66-8a04096b70f1 12 Network activity domain mail.asambleanacional.gob.ec 1 20161104
124 cfd9e067-855e-4c38-af7b-b1ec7b9c5e0f 12 Network activity domain support-whatsapp.com 1 20161104
125 d036cf1a-59fb-4c11-9da9-cbf99f5733a7 12 Artifacts dropped md5 ed8d7ed45b64890b8901b735018318f3 CyberGate 1 20161108
126 d605e928-93ec-4aec-897e-0de476fe3f0e 12 Network activity domain s1.support 1 20161104
127 d736d788-19c3-47d3-85ba-6f1b8a3f0897 12 Network activity ip-dst 186.220.1.84 1 20161104
128 d79f9f17-548f-4712-afdf-a8dc5dc43be1 12 Network activity domain taskmgr.servehttp.com 1 20161104
129 da13fa70-4007-4c44-b611-a890dd8b1f31 12 Artifacts dropped md5 ea7bcf58a4ccdecb0c64e56b9998a4ac Adzok 1 20161108
130 dad67427-90fd-429f-94cc-15aab9efefc7 12 Artifacts dropped md5 bc97437fec7e7e8634c2eabae3cc4832 CyberGate 1 20161108
131 e4567864-ed20-4a52-8ebc-280bb84bc259 12 Payload delivery email-src no.response.delivery.es@gmail.com 1 20161104
132 ec9d62d6-4906-45a7-a781-a4b3939e77bc 12 Network activity domain gmail.com.msg07.xyz 1 20161104
133 f4ce5713-8486-4eff-be64-f04899ad0e63 12 Network activity ip-dst 186.220.11.67 1 20161104
134 f5818138-37c1-412a-8cf7-2d7bcb538367 12 Network activity domain lavozamericana.info 1 20161104
135 f7508074-3443-4ceb-a1b6-08e87bc65b44 12 Network activity domain support-login-validate-outlook.tk 1 20161104
136 f7dbcb2a-96c1-48d9-8bda-785348f8d91b 12 Artifacts dropped md5 6c34d4296126679d9c6a0bc2660dc453 CyberGate 1 20161108
137 fd6b3ff2-e441-4bc1-ba2d-d3d9dd50ab24 12 Network activity domain ns.update-outlook.info 1 20161104

51
data/ioc/spyware/citizen_lab/201512_PackRAT/md5-c2.csv Normal file
View File

@@ -0,0 +1,51 @@
MD5,,C2,Malware Family
dd1101adc86fd282f5f183942cc2f3b7,,wjwj.no-ip.org,CyberGate
dd1101adc86fd282f5f183942cc2f3b7,,ruley.no-ip.org,CyberGate
dd1101adc86fd282f5f183942cc2f3b7,,lolinha.no-ip.org,CyberGate
2d722592a4e3c8030410dccccb221ce4,,wjwj.no-ip.org,CyberGate
d2adecc6287dd4d559fe6ce2ce7a7e31,,wjwj.no-ip.org,Cybergate
d2adecc6287dd4d559fe6ce2ce7a7e31,,ruley.no-ip.org,Cybergate
d2adecc6287dd4d559fe6ce2ce7a7e31,,lolinha.no-ip.org,Cybergate
93b630891db21a4a2350280a360c713d,,wjwj.no-ip.org,CyberGate
93b630891db21a4a2350280a360c713d,,ruley.no-ip.org,CyberGate
93b630891db21a4a2350280a360c713d,,lolinha.no-ip.org,CyberGate
a73351623577f44a2b578fed1e78e37e,,ruley.no-ip.org,CyberGate
a73351623577f44a2b578fed1e78e37e,,wjwj.no-ip.org,CyberGate
5a8975873f52436377d8fb0b5ab0d87a,,ruley.no-ip.org,CyberGate
ed8d7ed45b64890b8901b735018318f3,,ruley.no-ip.org,CyberGate
ed8d7ed45b64890b8901b735018318f3,,wjwj.no-ip.org,CyberGate
c2237e9d415f542ce6e73adb260af123,,wjwj.no-ip.org,Xtreme RAT
2827450763b55c5e71fda3caaf8e75f9,,wjwj.no-ip.org,Xtreme RAT
bc97437fec7e7e8634c2eabae3cc4832,,ruley.no-ip.org,CyberGate
bc97437fec7e7e8634c2eabae3cc4832,,taskmgr.serveftp.com,CyberGate
d7f34168b1a7dd7cbd8e62a5ab1ebc0e,,taskmgr.serveftp.com,Xtreme RAT
d7f34168b1a7dd7cbd8e62a5ab1ebc0e,,taskmgr.servehttp.com,Xtreme RAT
6c34d4296126679d9c6a0bc2660dc453,,taskmgr.servehttp.com,CyberGate
6c34d4296126679d9c6a0bc2660dc453,,taskmgr.serveftp.com,CyberGate
efc0009d76a2057f86c5f00030378c72,,daynews.sytes.net,AlienSpy
74613eae84347183b4ca61b912a4573f,,daynews.sytes.net,AlienSpy
d2f151312f7dee2483ddcab9766b56db,,daynews.sytes.net,AlienSpy
ea7bcf58a4ccdecb0c64e56b9998a4ac,,daynews.sytes.net,Adzok
1e4265a0c37773c2372b97bb6630ae57,,daynews.sytes.net,Adzok
08a3bb5b220eb1e0dc2ecccbbc6859f5,,daynews.sytes.net,Adzok
2de51e74fd571319bbf763ec62781096,,deyrep24.ddns.net,AlienSpy
8fb96dfab7e4c0acb1eb9f4e950ba4b9,,deyrep24.ddns.net,AlienSpy
4a23a1d6779d199aaa582cf0a5868ad1,,deyrep24.ddns.net,Adzok
0ae0038ffe8cf5c3170734a71ff2213d,,deyrep24.ddns.net,AlienSpy
8e0f021dcbbfa586a1c6780e77ac0fb6,,taskmgr.servehttp.com,CyberGate
a74ef893b1bf21c9df6d8e31285db981,,taskmgr.servehttp.com,CyberGate
a988235ad7d47acbeca5ccb4ea5a1ed5,,taskmgr.servehttp.com,CyberGate
15ebe16cd9500de534d5bfd5eeceaf73,,taskmgr.servehttp.com,CyberGate
01dec1b1d0760d5a1a562edcfeb478d1,,taskmgr.servehttp.com,CyberGate
1e6d0b59d4fb7650453c207688385f3a,,taskmgr.servehttp.com,CyberGate
e03be1849ad7cecba1e20923074cd22f,,taskmgr.servehttp.com,CyberGate
779a79c11f581b84e7c81f321fd8d743,,conhost.servehttp.com,CyberGate
13d939b2412c6adbab3cc1b539166671,,conhost.servehttp.com,CyberGate
13d939b2412c6adbab3cc1b539166671,,dllhost.servehttp.com,CyberGate
7b2cb5249d704cb1df8d4210e7c3d553,,dllhost.servehttp.com,CyberGate
7b2cb5249d704cb1df8d4210e7c3d553,,conhost.servehttp.com,CyberGate
a09f100ddc7cf29f8a93a3d7a79c58b9,,taskmgr.servehttp.com,CyberGate
ce6065346a918a813eeb58bbb0814a23,,taskmgr.servehttp.com,CyberGate
ea50bf8abcf9c0c40c4490dc15fb0a2a,,taskmgr.servehttp.com,CyberGate
3a61d64986ee6529cee271ab6754faa5,,taskmgr.servehttp.com,CyberGate
695db7dd3b1daf89f2c56d59faecc088,,taskmgr.servehttp.com,CyberGate
1 MD5 C2 Malware Family
2 dd1101adc86fd282f5f183942cc2f3b7 wjwj.no-ip.org CyberGate
3 dd1101adc86fd282f5f183942cc2f3b7 ruley.no-ip.org CyberGate
4 dd1101adc86fd282f5f183942cc2f3b7 lolinha.no-ip.org CyberGate
5 2d722592a4e3c8030410dccccb221ce4 wjwj.no-ip.org CyberGate
6 d2adecc6287dd4d559fe6ce2ce7a7e31 wjwj.no-ip.org Cybergate
7 d2adecc6287dd4d559fe6ce2ce7a7e31 ruley.no-ip.org Cybergate
8 d2adecc6287dd4d559fe6ce2ce7a7e31 lolinha.no-ip.org Cybergate
9 93b630891db21a4a2350280a360c713d wjwj.no-ip.org CyberGate
10 93b630891db21a4a2350280a360c713d ruley.no-ip.org CyberGate
11 93b630891db21a4a2350280a360c713d lolinha.no-ip.org CyberGate
12 a73351623577f44a2b578fed1e78e37e ruley.no-ip.org CyberGate
13 a73351623577f44a2b578fed1e78e37e wjwj.no-ip.org CyberGate
14 5a8975873f52436377d8fb0b5ab0d87a ruley.no-ip.org CyberGate
15 ed8d7ed45b64890b8901b735018318f3 ruley.no-ip.org CyberGate
16 ed8d7ed45b64890b8901b735018318f3 wjwj.no-ip.org CyberGate
17 c2237e9d415f542ce6e73adb260af123 wjwj.no-ip.org Xtreme RAT
18 2827450763b55c5e71fda3caaf8e75f9 wjwj.no-ip.org Xtreme RAT
19 bc97437fec7e7e8634c2eabae3cc4832 ruley.no-ip.org CyberGate
20 bc97437fec7e7e8634c2eabae3cc4832 taskmgr.serveftp.com CyberGate
21 d7f34168b1a7dd7cbd8e62a5ab1ebc0e taskmgr.serveftp.com Xtreme RAT
22 d7f34168b1a7dd7cbd8e62a5ab1ebc0e taskmgr.servehttp.com Xtreme RAT
23 6c34d4296126679d9c6a0bc2660dc453 taskmgr.servehttp.com CyberGate
24 6c34d4296126679d9c6a0bc2660dc453 taskmgr.serveftp.com CyberGate
25 efc0009d76a2057f86c5f00030378c72 daynews.sytes.net AlienSpy
26 74613eae84347183b4ca61b912a4573f daynews.sytes.net AlienSpy
27 d2f151312f7dee2483ddcab9766b56db daynews.sytes.net AlienSpy
28 ea7bcf58a4ccdecb0c64e56b9998a4ac daynews.sytes.net Adzok
29 1e4265a0c37773c2372b97bb6630ae57 daynews.sytes.net Adzok
30 08a3bb5b220eb1e0dc2ecccbbc6859f5 daynews.sytes.net Adzok
31 2de51e74fd571319bbf763ec62781096 deyrep24.ddns.net AlienSpy
32 8fb96dfab7e4c0acb1eb9f4e950ba4b9 deyrep24.ddns.net AlienSpy
33 4a23a1d6779d199aaa582cf0a5868ad1 deyrep24.ddns.net Adzok
34 0ae0038ffe8cf5c3170734a71ff2213d deyrep24.ddns.net AlienSpy
35 8e0f021dcbbfa586a1c6780e77ac0fb6 taskmgr.servehttp.com CyberGate
36 a74ef893b1bf21c9df6d8e31285db981 taskmgr.servehttp.com CyberGate
37 a988235ad7d47acbeca5ccb4ea5a1ed5 taskmgr.servehttp.com CyberGate
38 15ebe16cd9500de534d5bfd5eeceaf73 taskmgr.servehttp.com CyberGate
39 01dec1b1d0760d5a1a562edcfeb478d1 taskmgr.servehttp.com CyberGate
40 1e6d0b59d4fb7650453c207688385f3a taskmgr.servehttp.com CyberGate
41 e03be1849ad7cecba1e20923074cd22f taskmgr.servehttp.com CyberGate
42 779a79c11f581b84e7c81f321fd8d743 conhost.servehttp.com CyberGate
43 13d939b2412c6adbab3cc1b539166671 conhost.servehttp.com CyberGate
44 13d939b2412c6adbab3cc1b539166671 dllhost.servehttp.com CyberGate
45 7b2cb5249d704cb1df8d4210e7c3d553 dllhost.servehttp.com CyberGate
46 7b2cb5249d704cb1df8d4210e7c3d553 conhost.servehttp.com CyberGate
47 a09f100ddc7cf29f8a93a3d7a79c58b9 taskmgr.servehttp.com CyberGate
48 ce6065346a918a813eeb58bbb0814a23 taskmgr.servehttp.com CyberGate
49 ea50bf8abcf9c0c40c4490dc15fb0a2a taskmgr.servehttp.com CyberGate
50 3a61d64986ee6529cee271ab6754faa5 taskmgr.servehttp.com CyberGate
51 695db7dd3b1daf89f2c56d59faecc088 taskmgr.servehttp.com CyberGate

533
data/ioc/spyware/citizen_lab/201512_PackRAT/openioc.ioc Normal file
View File

@@ -0,0 +1,533 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581c11ef-a8c4-4c26-a4ea-49798e96ca05" last-modified="2015-12-08T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #12</short_description>
<description>Packrat: Seven Years of a South American Threat Actor</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2015-12-08T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="581c11ef-a8c4-4c26-a4ea-49798e96ca05">
<IndicatorItem id="a988235ad7d47acbeca5ccb4ea5a1ed5" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="15ebe16cd9500de534d5bfd5eeceaf73" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="01dec1b1d0760d5a1a562edcfeb478d1" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="1e6d0b59d4fb7650453c207688385f3a" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="e03be1849ad7cecba1e20923074cd22f" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="779a79c11f581b84e7c81f321fd8d743" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="13d939b2412c6adbab3cc1b539166671" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="7b2cb5249d704cb1df8d4210e7c3d553" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="a09f100ddc7cf29f8a93a3d7a79c58b9" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="ce6065346a918a813eeb58bbb0814a23" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="ea50bf8abcf9c0c40c4490dc15fb0a2a" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="3a61d64986ee6529cee271ab6754faa5" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="695db7dd3b1daf89f2c56d59faecc088" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="ea7bcf58a4ccdecb0c64e56b9998a4ac" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="efc0009d76a2057f86c5f00030378c72" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="74613eae84347183b4ca61b912a4573f" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="bc97437fec7e7e8634c2eabae3cc4832" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="dd1101adc86fd282f5f183942cc2f3b7" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="2d722592a4e3c8030410dccccb221ce4" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="d2adecc6287dd4d559fe6ce2ce7a7e31" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="93b630891db21a4a2350280a360c713d" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="a73351623577f44a2b578fed1e78e37e" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="5a8975873f52436377d8fb0b5ab0d87a" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="ed8d7ed45b64890b8901b735018318f3" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="c2237e9d415f542ce6e73adb260af123" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="2827450763b55c5e71fda3caaf8e75f9" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="d7f34168b1a7dd7cbd8e62a5ab1ebc0e" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="6c34d4296126679d9c6a0bc2660dc453" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="d2f151312f7dee2483ddcab9766b56db" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="1e4265a0c37773c2372b97bb6630ae57" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="08a3bb5b220eb1e0dc2ecccbbc6859f5" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="2de51e74fd571319bbf763ec62781096" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="8fb96dfab7e4c0acb1eb9f4e950ba4b9" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="4a23a1d6779d199aaa582cf0a5868ad1" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="0ae0038ffe8cf5c3170734a71ff2213d" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="8e0f021dcbbfa586a1c6780e77ac0fb6" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="a74ef893b1bf21c9df6d8e31285db981" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="HKLM\SOFTWARE\Microsoft\Active" condition="is">
<Context document="Network" search="RegistryItem/KeyPath" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies" condition="is">
<Context document="Network" search="RegistryItem/KeyPath" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig" condition="is">
<Context document="Network" search="RegistryItem/KeyPath" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="taskmgr.redirectme.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ftp.server.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="update-outlook.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="deyrep.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="support-whatsapp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="blackboxmusic.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.blackboxmusic.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mail-account-update.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="lavozmericana.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="support-java.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="n3.pancaliente.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="n4.pancaliente.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ns1.deyrep.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ns2.deyrep.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="n1.login-office365.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="n2.login-office365.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="n1.update-outlook.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ns.update-outlook.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="s1.mgoogle.us" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="s2.mgoogle.us" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="support-login-validate-outlook.tk" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="verify-gmail-support-secure.tk" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="soporte-login-account-gmail.tk" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="soporte-login-account-yahoo.tk" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="n1.support-java.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="n1.lavozamericana.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="s1.support" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ns1.ukraine.com.ua" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="android-flash.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="deyrep24.ddns.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="daynews.sytes.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="taskmgr.serveftp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="taskmgr.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="taskmgr.redirectme.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ruley.no-ip.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="lolinha.no-ip.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="wjwj.no-ip.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="conhost.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dllhost.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="wjwjwj.no-ip.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="wjwjwjwj.no-ip.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ecuadorenvivo.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ecuadorenvivo.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.movimientoanticorreista.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="focusecuador.tk" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mesvr.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ftp.ftpserver.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="lavozamericana.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ec.cu9.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="movimientoanticorreista.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mgoogle.us" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="no.response.delivery.es" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="cu9.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="asambleanacional-gob-ec.cu9.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mail.asambleanacional.gob.ec" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="formmail.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="login-office365.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="pancaliente.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="focusecuador.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="gmail.com.msg07.xyz" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="supportgmai1.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="chavistas24.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ns1.hostinger.ru" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="venezuela365.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="justicia-desvinculados.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="50.62.133.49" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="192.169.243.65" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="190.210.180.181" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="201.52.24.126" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="190.20.180.181" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="186.220.1.84" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="186.220.11.67" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="189.100.148.188" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="179.208.187.216" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="46.246.89.246" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="198.12.150.249" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="50.63.202.57" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="193.105.134.27" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://mail.asambleanacional.gob.ec" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="claudiobonadio88@gmail.com" condition="is">
<Context document="Email" search="Email/From" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="cfed.bonadio@gmail.com" condition="is">
<Context document="Email" search="Email/From" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="focusedtior1@gmail.com" condition="is">
<Context document="Email" search="Email/From" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="no.response.delivery.es@gmail.com" condition="is">
<Context document="Email" search="Email/From" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="enripintos123@outlook.es" condition="is">
<Context document="Email" search="Email/From" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="movimiento.anti.correista@gmail.com" condition="is">
<Context document="Email" search="Email/From" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="no-responder@supportgmai1.com" condition="is">
<Context document="Email" search="Email/From" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

5242
data/ioc/spyware/citizen_lab/201512_PackRAT/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff

8
data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/README.md Normal file
View File

@@ -0,0 +1,8 @@
## Shifting Tactics IOCs
This directory contains IOC from the Citizen Lab report [Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans](https://citizenlab.org/2016/03/shifting-tactics/) published the 10th of May 2016.
Files included in this directory:
* openioc.ioc : IOCs in OpenIOC format
* stix.xml : IOCs in STIX XML format
* iocs.csv : IOCs in csv format

37
data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/iocs.csv Normal file
View File

@@ -0,0 +1,37 @@
uuid,event_id,category,type,value,comment,to_ids,date
11bb35af-5ad7-4a10-844c-fb4482603b0b,11,Network activity,url,"http://accountgoogle.firewall-gateway.com/serviclogin","Decoy webpage",0,20160310
11cf9c54-4d35-4a58-8128-a1076025ff25,11,Network activity,domain,"sys.firewall-gateway.net","C2 domain",1,20160310
1f0bc371-f681-4049-855d-235e6bc5eb8e,11,Network activity,ip-dst,"5.54.19.17","",1,20160310
228f765c-d5ab-4fcf-a190-775b9ed2ad70,11,Network activity,domain,"firewallupdate.firewall-gateway.com","Domain found through passive DNS",1,20160310
23403344-c52e-4c19-9f7b-f5291b451bee,11,Payload delivery,md5,"fef27f432e0ae8218143bc410fda340e","",1,20160310
26fb914b-1601-4049-a8b5-c9afc3a16bc0,11,Network activity,domain,"accountgoogle.firewall-gateway.com","Phishing Campaign Infrastructure",1,20160310
318dd748-c9d9-4f7b-9b42-75a60001f9e1,11,Network activity,ip-dst,"95.154.195.171","",1,20160310
35a7486a-38a7-4d3a-bdd8-1284d464484b,11,Network activity,domain,"firewallupdate.firewall-gateway.net","Domain found through passive DNS",1,20160310
3baf841e-c377-44ba-ba20-dcfd7aa8ba22,11,Network activity,domain,"accounts-google.firewall-gateway.com","Domain found through passive DNS",1,20160310
40edc447-3aaa-4f79-8268-16eddff19b33,11,Network activity,domain,"accountsgoogles.firewall-gateway.com","Domain found through passive DNS",1,20160310
53477c01-59ad-47be-b808-4c6b518523fc,11,Network activity,ip-dst,"109.169.77.230","Resolve domain news[.]firewall-gateway[.]com",1,20160310
581c1169-35f8-439b-ad90-49798e96ca05,11,External analysis,link,"https://citizenlab.org/2016/03/shifting-tactics/","",0,20161104
5824e149-ba7c-4e04-b905-69fe8e96ca05,11,Artifacts dropped,md5,"ea45265fe98b25e719d5a9cc3b412d66","uroyh.exe",1,20160310
5824e1e5-e340-40b0-b3fa-69fe8e96ca05,11,Attribution,threat-actor,"Scarlet Mimic","",0,20160310
5824e33f-4c08-4b5f-8092-497a8e96ca05,11,Payload type,text,"FakeM","",0,20160310
6308d2e1-a83a-44b2-b96f-267bc24efbd1,11,Network activity,domain,"filegoogle.firewall-gateway.com","Phishing Campaign Infrastructure",1,20160310
633179a0-3d6e-4ca5-9b89-02d8522ef275,11,Payload delivery,filename,"Reappraisal_of_India_Tibet_Policy.doc","",0,20160310
6d15c4fe-2de7-4abc-9593-c9eeae9b928f,11,Payload delivery,md5,"3b869c8e23d66ad0527882fc79ff7237","",1,20160310
712c9cc1-2b2b-4636-87d2-12bd313376dc,11,Payload delivery,md5,"1bf438b5744db73eea58379a3b9f30e5","",1,20160310
73e5412a-1252-495d-956d-28cfdd8edaed,11,Network activity,domain,"news.firewall-gateway.com","",1,20160310
86627daf-07c8-467f-babc-426d586e7d4a,11,Network activity,domain,"detail43.myfirewall.org","",1,20160310
8b0a371b-0c73-455d-a7ae-d0a530f23b04,11,Network activity,domain,"drivgoogle.firewall-gateway.com","Domain found through passive DNS",1,20160310
8ce49cb3-e458-4568-b560-04a314ce9539,11,Network activity,ip-dst,"192.253.251.118","",1,20160310
99702482-486a-4b63-8fa9-f094835827b2,11,Payload delivery,md5,"5c030802ad411fea059cc9cc4c118125","uroyh-unpacked.exe",1,20160310
a31a03ec-f99e-4bec-95dc-3574c3512217,11,Network activity,ip-dst,"95.154.195.159","",1,20160310
a95b5c9c-7ec9-42ff-a12c-075b3255de77,11,Payload delivery,md5,"7735e571d0450e2a31e97e4f8e0f66fa","Attached file",1,20160310
ad5c4c3d-6194-4059-9aa1-1593b62d32a9,11,Network activity,ip-dst,"109.169.40.172","",1,20160310
b2cebdea-e90b-416f-9a0f-94a566b32a2a,11,Network activity,ip-dst,"46.127.56.109","",1,20160310
b84e33b7-1958-4507-b7bb-6bb63304842c,11,Network activity,domain,"googlefile.firewall-gateway.net","Domain found through passive DNS",1,20160310
baf16087-e811-438d-bcdd-9779043dfb06,11,Payload delivery,md5,"d2e9412428c3bcf3ec98dba8a78adb7b","iph.bat",1,20160310
c379b263-55d3-464d-b94f-178f02f883a8,11,Network activity,ip-dst,"87.117.229.109","",1,20160310
cda51492-e33b-4521-be3b-35ec4b8bc9b4,11,Network activity,url,"http://accountgoogle.firewall-gateway.com/servicclogin","Decoy webpage",0,20160310
dbabd2ee-213d-4b02-951f-a020cfc3582e,11,Payload delivery,md5,"8b83fc5d3a6a80281269f9e337fe3fff","pshvb.exe",1,20160310
ebbe87e2-7f84-4f68-b766-f63820da7966,11,Network activity,domain,"accountsgoogle.firewall-gateway.com","Domain found through passive DNS",1,20160310
f48470fd-c782-4831-a20d-4704b62f1358,11,Network activity,ip-dst,"78.129.252.159","",1,20160310
fc6d0f74-9e43-44a7-b7b8-0ca5c7c487e6,11,Network activity,url,"http://filegoogle.firewall-gateway.com/servicelogin","Decoy webpage",1,20160310
1 uuid event_id category type value comment to_ids date
2 11bb35af-5ad7-4a10-844c-fb4482603b0b 11 Network activity url http://accountgoogle.firewall-gateway.com/serviclogin Decoy webpage 0 20160310
3 11cf9c54-4d35-4a58-8128-a1076025ff25 11 Network activity domain sys.firewall-gateway.net C2 domain 1 20160310
4 1f0bc371-f681-4049-855d-235e6bc5eb8e 11 Network activity ip-dst 5.54.19.17 1 20160310
5 228f765c-d5ab-4fcf-a190-775b9ed2ad70 11 Network activity domain firewallupdate.firewall-gateway.com Domain found through passive DNS 1 20160310
6 23403344-c52e-4c19-9f7b-f5291b451bee 11 Payload delivery md5 fef27f432e0ae8218143bc410fda340e 1 20160310
7 26fb914b-1601-4049-a8b5-c9afc3a16bc0 11 Network activity domain accountgoogle.firewall-gateway.com Phishing Campaign Infrastructure 1 20160310
8 318dd748-c9d9-4f7b-9b42-75a60001f9e1 11 Network activity ip-dst 95.154.195.171 1 20160310
9 35a7486a-38a7-4d3a-bdd8-1284d464484b 11 Network activity domain firewallupdate.firewall-gateway.net Domain found through passive DNS 1 20160310
10 3baf841e-c377-44ba-ba20-dcfd7aa8ba22 11 Network activity domain accounts-google.firewall-gateway.com Domain found through passive DNS 1 20160310
11 40edc447-3aaa-4f79-8268-16eddff19b33 11 Network activity domain accountsgoogles.firewall-gateway.com Domain found through passive DNS 1 20160310
12 53477c01-59ad-47be-b808-4c6b518523fc 11 Network activity ip-dst 109.169.77.230 Resolve domain news[.]firewall-gateway[.]com 1 20160310
13 581c1169-35f8-439b-ad90-49798e96ca05 11 External analysis link https://citizenlab.org/2016/03/shifting-tactics/ 0 20161104
14 5824e149-ba7c-4e04-b905-69fe8e96ca05 11 Artifacts dropped md5 ea45265fe98b25e719d5a9cc3b412d66 uroyh.exe 1 20160310
15 5824e1e5-e340-40b0-b3fa-69fe8e96ca05 11 Attribution threat-actor Scarlet Mimic 0 20160310
16 5824e33f-4c08-4b5f-8092-497a8e96ca05 11 Payload type text FakeM 0 20160310
17 6308d2e1-a83a-44b2-b96f-267bc24efbd1 11 Network activity domain filegoogle.firewall-gateway.com Phishing Campaign Infrastructure 1 20160310
18 633179a0-3d6e-4ca5-9b89-02d8522ef275 11 Payload delivery filename Reappraisal_of_India_Tibet_Policy.doc 0 20160310
19 6d15c4fe-2de7-4abc-9593-c9eeae9b928f 11 Payload delivery md5 3b869c8e23d66ad0527882fc79ff7237 1 20160310
20 712c9cc1-2b2b-4636-87d2-12bd313376dc 11 Payload delivery md5 1bf438b5744db73eea58379a3b9f30e5 1 20160310
21 73e5412a-1252-495d-956d-28cfdd8edaed 11 Network activity domain news.firewall-gateway.com 1 20160310
22 86627daf-07c8-467f-babc-426d586e7d4a 11 Network activity domain detail43.myfirewall.org 1 20160310
23 8b0a371b-0c73-455d-a7ae-d0a530f23b04 11 Network activity domain drivgoogle.firewall-gateway.com Domain found through passive DNS 1 20160310
24 8ce49cb3-e458-4568-b560-04a314ce9539 11 Network activity ip-dst 192.253.251.118 1 20160310
25 99702482-486a-4b63-8fa9-f094835827b2 11 Payload delivery md5 5c030802ad411fea059cc9cc4c118125 uroyh-unpacked.exe 1 20160310
26 a31a03ec-f99e-4bec-95dc-3574c3512217 11 Network activity ip-dst 95.154.195.159 1 20160310
27 a95b5c9c-7ec9-42ff-a12c-075b3255de77 11 Payload delivery md5 7735e571d0450e2a31e97e4f8e0f66fa Attached file 1 20160310
28 ad5c4c3d-6194-4059-9aa1-1593b62d32a9 11 Network activity ip-dst 109.169.40.172 1 20160310
29 b2cebdea-e90b-416f-9a0f-94a566b32a2a 11 Network activity ip-dst 46.127.56.109 1 20160310
30 b84e33b7-1958-4507-b7bb-6bb63304842c 11 Network activity domain googlefile.firewall-gateway.net Domain found through passive DNS 1 20160310
31 baf16087-e811-438d-bcdd-9779043dfb06 11 Payload delivery md5 d2e9412428c3bcf3ec98dba8a78adb7b iph.bat 1 20160310
32 c379b263-55d3-464d-b94f-178f02f883a8 11 Network activity ip-dst 87.117.229.109 1 20160310
33 cda51492-e33b-4521-be3b-35ec4b8bc9b4 11 Network activity url http://accountgoogle.firewall-gateway.com/servicclogin Decoy webpage 0 20160310
34 dbabd2ee-213d-4b02-951f-a020cfc3582e 11 Payload delivery md5 8b83fc5d3a6a80281269f9e337fe3fff pshvb.exe 1 20160310
35 ebbe87e2-7f84-4f68-b766-f63820da7966 11 Network activity domain accountsgoogle.firewall-gateway.com Domain found through passive DNS 1 20160310
36 f48470fd-c782-4831-a20d-4704b62f1358 11 Network activity ip-dst 78.129.252.159 1 20160310
37 fc6d0f74-9e43-44a7-b7b8-0ca5c7c487e6 11 Network activity url http://filegoogle.firewall-gateway.com/servicelogin Decoy webpage 1 20160310

133
data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/openioc.ioc Normal file
View File

@@ -0,0 +1,133 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581c1131-3fec-4068-bb74-49798e96ca05" last-modified="2016-03-10T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #11</short_description>
<description>Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2016-03-10T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="581c1131-3fec-4068-bb74-49798e96ca05">
<IndicatorItem id="ea45265fe98b25e719d5a9cc3b412d66" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="filegoogle.firewall-gateway.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="accountgoogle.firewall-gateway.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="sys.firewall-gateway.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="news.firewall-gateway.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="accountsgoogle.firewall-gateway.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="accounts-google.firewall-gateway.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="accountsgoogles.firewall-gateway.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googlefile.firewall-gateway.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="firewallupdate.firewall-gateway.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="firewallupdate.firewall-gateway.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="drivgoogle.firewall-gateway.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="detail43.myfirewall.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="95.154.195.159" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="95.154.195.171" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="5.54.19.17" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="78.129.252.159" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="87.117.229.109" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="109.169.40.172" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="46.127.56.109" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="192.253.251.118" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="109.169.77.230" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="http://filegoogle.firewall-gateway.com/servicelogin" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="5c030802ad411fea059cc9cc4c118125" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="7735e571d0450e2a31e97e4f8e0f66fa" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="d2e9412428c3bcf3ec98dba8a78adb7b" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="1bf438b5744db73eea58379a3b9f30e5" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="3b869c8e23d66ad0527882fc79ff7237" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="fef27f432e0ae8218143bc410fda340e" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="8b83fc5d3a6a80281269f9e337fe3fff" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

982
data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/stix.xml Normal file
View File

@@ -0,0 +1,982 @@
<stix:STIX_Package
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
xmlns:marking="http://data-marking.mitre.org/Marking-1"
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:indicator="http://stix.mitre.org/Indicator-2"
xmlns:ttp="http://stix.mitre.org/TTP-1"
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:="https://rufus.citlab.utoronto.ca"
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
xsi:schemaLocation="
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-dab87d63-6901-4da5-b7ba-2088de90f322" version="1.1.1" timestamp="2016-11-10T21:17:23.793648+00:00">
<stix:STIX_Header>
<stix:Title>Export from MISP</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Related_Packages>
<stix:Related_Package>
<stix:Package id=":STIXPackage-581c1131-3fec-4068-bb74-49798e96ca05" version="1.1.1" timestamp="2016-11-10T16:14:39+00:00">
<stix:STIX_Header>
<stix:Title>Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans (MISP Event #11)</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:TTPs>
<stix:TTP id=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'>
<ttp:Title>Payload type: FakeM (MISP Attribute #1875)</ttp:Title>
<ttp:Behavior>
<ttp:Malware>
<ttp:Malware_Instance>
<ttp:Name>FakeM</ttp:Name>
</ttp:Malware_Instance>
</ttp:Malware>
</ttp:Behavior>
</stix:TTP>
</stix:TTPs>
<stix:Incidents>
<stix:Incident id=":incident-581c1131-3fec-4068-bb74-49798e96ca05" timestamp="2016-11-10T16:15:08+00:00" xsi:type='incident:IncidentType'>
<incident:Title>Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans</incident:Title>
<incident:External_ID source="MISP Event">11</incident:External_ID>
<incident:Time>
<incident:Incident_Discovery precision="second">2016-03-10T00:00:00+00:00</incident:Incident_Discovery>
<incident:Incident_Reported precision="second">2016-11-10T16:15:08+00:00</incident:Incident_Reported>
</incident:Time>
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
<incident:Related_Indicators>
<incident:Related_Indicator>
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5824e149-ba7c-4e04-b905-69fe8e96ca05" timestamp="2016-11-10T16:06:17+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Artifacts dropped: ea45265fe98b25e719d5a9cc3b412d66 (MISP Attribute #1873)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Artifacts dropped: ea45265fe98b25e719d5a9cc3b412d66 (MISP Attribute #1873)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5824e149-ba7c-4e04-b905-69fe8e96ca05">
<cybox:Object id=":File-5824e149-ba7c-4e04-b905-69fe8e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">ea45265fe98b25e719d5a9cc3b412d66</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:06:17+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Attribution</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5824e1e5-e340-40b0-b3fa-69fe8e96ca05" timestamp="2016-11-10T16:08:53+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Attribution: Scarlet Mimic (MISP Attribute #1874)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Description>Attribution: Scarlet Mimic (MISP Attribute #1874)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:08:53+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-6308d2e1-a83a-44b2-b96f-267bc24efbd1" timestamp="2016-11-10T16:07:04+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: filegoogle.firewall-gateway.com (MISP Attribute #499)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: filegoogle.firewall-gateway.com (MISP Attribute #499)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-6308d2e1-a83a-44b2-b96f-267bc24efbd1">
<cybox:Object id=":DomainName-6308d2e1-a83a-44b2-b96f-267bc24efbd1">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">filegoogle.firewall-gateway.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:07:04+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-26fb914b-1601-4049-a8b5-c9afc3a16bc0" timestamp="2016-11-10T16:07:11+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: accountgoogle.firewall-gateway.com (MISP Attribute #500)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: accountgoogle.firewall-gateway.com (MISP Attribute #500)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-26fb914b-1601-4049-a8b5-c9afc3a16bc0">
<cybox:Object id=":DomainName-26fb914b-1601-4049-a8b5-c9afc3a16bc0">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">accountgoogle.firewall-gateway.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:07:11+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-11cf9c54-4d35-4a58-8128-a1076025ff25" timestamp="2016-11-10T16:06:49+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: sys.firewall-gateway.net (MISP Attribute #501)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: sys.firewall-gateway.net (MISP Attribute #501)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-11cf9c54-4d35-4a58-8128-a1076025ff25">
<cybox:Object id=":DomainName-11cf9c54-4d35-4a58-8128-a1076025ff25">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">sys.firewall-gateway.net</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:06:49+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-73e5412a-1252-495d-956d-28cfdd8edaed" timestamp="2016-11-10T16:04:39+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: news.firewall-gateway.com (MISP Attribute #502)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: news.firewall-gateway.com (MISP Attribute #502)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-73e5412a-1252-495d-956d-28cfdd8edaed">
<cybox:Object id=":DomainName-73e5412a-1252-495d-956d-28cfdd8edaed">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">news.firewall-gateway.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:04:39+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-ebbe87e2-7f84-4f68-b766-f63820da7966" timestamp="2016-11-10T16:09:17+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: accountsgoogle.firewall-gateway.com (MISP Attribute #503)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: accountsgoogle.firewall-gateway.com (MISP Attribute #503)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-ebbe87e2-7f84-4f68-b766-f63820da7966">
<cybox:Object id=":DomainName-ebbe87e2-7f84-4f68-b766-f63820da7966">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">accountsgoogle.firewall-gateway.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:09:17+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-3baf841e-c377-44ba-ba20-dcfd7aa8ba22" timestamp="2016-11-10T16:09:27+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: accounts-google.firewall-gateway.com (MISP Attribute #504)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: accounts-google.firewall-gateway.com (MISP Attribute #504)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-3baf841e-c377-44ba-ba20-dcfd7aa8ba22">
<cybox:Object id=":DomainName-3baf841e-c377-44ba-ba20-dcfd7aa8ba22">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">accounts-google.firewall-gateway.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:09:27+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-40edc447-3aaa-4f79-8268-16eddff19b33" timestamp="2016-11-10T16:09:38+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: accountsgoogles.firewall-gateway.com (MISP Attribute #505)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: accountsgoogles.firewall-gateway.com (MISP Attribute #505)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-40edc447-3aaa-4f79-8268-16eddff19b33">
<cybox:Object id=":DomainName-40edc447-3aaa-4f79-8268-16eddff19b33">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">accountsgoogles.firewall-gateway.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:09:38+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-b84e33b7-1958-4507-b7bb-6bb63304842c" timestamp="2016-11-10T16:09:47+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: googlefile.firewall-gateway.net (MISP Attribute #506)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: googlefile.firewall-gateway.net (MISP Attribute #506)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-b84e33b7-1958-4507-b7bb-6bb63304842c">
<cybox:Object id=":DomainName-b84e33b7-1958-4507-b7bb-6bb63304842c">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">googlefile.firewall-gateway.net</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:09:47+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-228f765c-d5ab-4fcf-a190-775b9ed2ad70" timestamp="2016-11-10T16:09:57+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: firewallupdate.firewall-gateway.com (MISP Attribute #507)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: firewallupdate.firewall-gateway.com (MISP Attribute #507)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-228f765c-d5ab-4fcf-a190-775b9ed2ad70">
<cybox:Object id=":DomainName-228f765c-d5ab-4fcf-a190-775b9ed2ad70">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">firewallupdate.firewall-gateway.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:09:57+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-35a7486a-38a7-4d3a-bdd8-1284d464484b" timestamp="2016-11-10T16:10:06+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: firewallupdate.firewall-gateway.net (MISP Attribute #508)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: firewallupdate.firewall-gateway.net (MISP Attribute #508)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-35a7486a-38a7-4d3a-bdd8-1284d464484b">
<cybox:Object id=":DomainName-35a7486a-38a7-4d3a-bdd8-1284d464484b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">firewallupdate.firewall-gateway.net</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:10:06+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-8b0a371b-0c73-455d-a7ae-d0a530f23b04" timestamp="2016-11-10T16:10:18+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: drivgoogle.firewall-gateway.com (MISP Attribute #509)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: drivgoogle.firewall-gateway.com (MISP Attribute #509)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-8b0a371b-0c73-455d-a7ae-d0a530f23b04">
<cybox:Object id=":DomainName-8b0a371b-0c73-455d-a7ae-d0a530f23b04">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">drivgoogle.firewall-gateway.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:10:18+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-86627daf-07c8-467f-babc-426d586e7d4a" timestamp="2016-11-10T16:05:44+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: detail43.myfirewall.org (MISP Attribute #510)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: detail43.myfirewall.org (MISP Attribute #510)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-86627daf-07c8-467f-babc-426d586e7d4a">
<cybox:Object id=":DomainName-86627daf-07c8-467f-babc-426d586e7d4a">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">detail43.myfirewall.org</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:05:44+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-a31a03ec-f99e-4bec-95dc-3574c3512217" timestamp="2016-11-10T16:11:07+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 95.154.195.159 (MISP Attribute #512)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 95.154.195.159 (MISP Attribute #512)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-a31a03ec-f99e-4bec-95dc-3574c3512217">
<cybox:Object id=":Address-a31a03ec-f99e-4bec-95dc-3574c3512217">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">95.154.195.159</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:11:07+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-318dd748-c9d9-4f7b-9b42-75a60001f9e1" timestamp="2016-11-10T16:11:12+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 95.154.195.171 (MISP Attribute #513)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 95.154.195.171 (MISP Attribute #513)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-318dd748-c9d9-4f7b-9b42-75a60001f9e1">
<cybox:Object id=":Address-318dd748-c9d9-4f7b-9b42-75a60001f9e1">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">95.154.195.171</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:11:12+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-1f0bc371-f681-4049-855d-235e6bc5eb8e" timestamp="2016-11-10T16:11:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 5.54.19.17 (MISP Attribute #514)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 5.54.19.17 (MISP Attribute #514)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-1f0bc371-f681-4049-855d-235e6bc5eb8e">
<cybox:Object id=":Address-1f0bc371-f681-4049-855d-235e6bc5eb8e">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">5.54.19.17</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:11:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-f48470fd-c782-4831-a20d-4704b62f1358" timestamp="2016-11-10T16:12:49+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 78.129.252.159 (MISP Attribute #515)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 78.129.252.159 (MISP Attribute #515)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-f48470fd-c782-4831-a20d-4704b62f1358">
<cybox:Object id=":Address-f48470fd-c782-4831-a20d-4704b62f1358">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">78.129.252.159</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:12:49+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-c379b263-55d3-464d-b94f-178f02f883a8" timestamp="2016-11-10T16:12:57+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 87.117.229.109 (MISP Attribute #516)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 87.117.229.109 (MISP Attribute #516)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-c379b263-55d3-464d-b94f-178f02f883a8">
<cybox:Object id=":Address-c379b263-55d3-464d-b94f-178f02f883a8">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">87.117.229.109</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:12:57+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-ad5c4c3d-6194-4059-9aa1-1593b62d32a9" timestamp="2016-11-10T16:13:04+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 109.169.40.172 (MISP Attribute #517)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 109.169.40.172 (MISP Attribute #517)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-ad5c4c3d-6194-4059-9aa1-1593b62d32a9">
<cybox:Object id=":Address-ad5c4c3d-6194-4059-9aa1-1593b62d32a9">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">109.169.40.172</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:13:04+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-b2cebdea-e90b-416f-9a0f-94a566b32a2a" timestamp="2016-11-10T16:13:12+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 46.127.56.109 (MISP Attribute #518)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 46.127.56.109 (MISP Attribute #518)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-b2cebdea-e90b-416f-9a0f-94a566b32a2a">
<cybox:Object id=":Address-b2cebdea-e90b-416f-9a0f-94a566b32a2a">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">46.127.56.109</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:13:12+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-8ce49cb3-e458-4568-b560-04a314ce9539" timestamp="2016-11-10T16:13:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 192.253.251.118 (MISP Attribute #519)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 192.253.251.118 (MISP Attribute #519)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-8ce49cb3-e458-4568-b560-04a314ce9539">
<cybox:Object id=":Address-8ce49cb3-e458-4568-b560-04a314ce9539">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">192.253.251.118</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:13:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-53477c01-59ad-47be-b808-4c6b518523fc" timestamp="2016-11-10T16:08:11+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 109.169.77.230 (MISP Attribute #511)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 109.169.77.230 (MISP Attribute #511)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-53477c01-59ad-47be-b808-4c6b518523fc">
<cybox:Object id=":Address-53477c01-59ad-47be-b808-4c6b518523fc">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">109.169.77.230</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:08:11+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-fc6d0f74-9e43-44a7-b7b8-0ca5c7c487e6" timestamp="2016-11-10T16:12:23+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://filegoogle.firewall-gateway.com/servicelogin (MISP Attribute #520)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://filegoogle.firewall-gateway.com/servicelogin (MISP Attribute #520)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-fc6d0f74-9e43-44a7-b7b8-0ca5c7c487e6">
<cybox:Object id=":URI-fc6d0f74-9e43-44a7-b7b8-0ca5c7c487e6">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://filegoogle.firewall-gateway.com/servicelogin</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:12:23+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-11bb35af-5ad7-4a10-844c-fb4482603b0b" timestamp="2016-11-10T16:12:41+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://accountgoogle.firewall-gateway.com/serviclogin (MISP Attribute #521)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://accountgoogle.firewall-gateway.com/serviclogin (MISP Attribute #521)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-11bb35af-5ad7-4a10-844c-fb4482603b0b">
<cybox:Object id=":URI-11bb35af-5ad7-4a10-844c-fb4482603b0b">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://accountgoogle.firewall-gateway.com/serviclogin</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:12:41+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-cda51492-e33b-4521-be3b-35ec4b8bc9b4" timestamp="2016-11-10T16:12:15+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://accountgoogle.firewall-gateway.com/servicclogin (MISP Attribute #522)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://accountgoogle.firewall-gateway.com/servicclogin (MISP Attribute #522)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-cda51492-e33b-4521-be3b-35ec4b8bc9b4">
<cybox:Object id=":URI-cda51492-e33b-4521-be3b-35ec4b8bc9b4">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://accountgoogle.firewall-gateway.com/servicclogin</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:12:15+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-633179a0-3d6e-4ca5-9b89-02d8522ef275" timestamp="2016-11-10T16:10:34+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: Reappraisal_of_India_Tibet_Policy.doc (MISP Attribute #530)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Description>Payload delivery: Reappraisal_of_India_Tibet_Policy.doc (MISP Attribute #530)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:10:34+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-99702482-486a-4b63-8fa9-f094835827b2" timestamp="2016-11-10T16:06:29+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 5c030802ad411fea059cc9cc4c118125 (MISP Attribute #531)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 5c030802ad411fea059cc9cc4c118125 (MISP Attribute #531)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-99702482-486a-4b63-8fa9-f094835827b2">
<cybox:Object id=":File-99702482-486a-4b63-8fa9-f094835827b2">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">5c030802ad411fea059cc9cc4c118125</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:06:29+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-a95b5c9c-7ec9-42ff-a12c-075b3255de77" timestamp="2016-11-10T16:05:58+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 7735e571d0450e2a31e97e4f8e0f66fa (MISP Attribute #532)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 7735e571d0450e2a31e97e4f8e0f66fa (MISP Attribute #532)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-a95b5c9c-7ec9-42ff-a12c-075b3255de77">
<cybox:Object id=":File-a95b5c9c-7ec9-42ff-a12c-075b3255de77">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">7735e571d0450e2a31e97e4f8e0f66fa</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:05:58+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-baf16087-e811-438d-bcdd-9779043dfb06" timestamp="2016-11-10T16:05:33+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: d2e9412428c3bcf3ec98dba8a78adb7b (MISP Attribute #533)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: d2e9412428c3bcf3ec98dba8a78adb7b (MISP Attribute #533)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-baf16087-e811-438d-bcdd-9779043dfb06">
<cybox:Object id=":File-baf16087-e811-438d-bcdd-9779043dfb06">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">d2e9412428c3bcf3ec98dba8a78adb7b</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:05:33+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-712c9cc1-2b2b-4636-87d2-12bd313376dc" timestamp="2016-11-10T16:05:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 1bf438b5744db73eea58379a3b9f30e5 (MISP Attribute #534)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 1bf438b5744db73eea58379a3b9f30e5 (MISP Attribute #534)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-712c9cc1-2b2b-4636-87d2-12bd313376dc">
<cybox:Object id=":File-712c9cc1-2b2b-4636-87d2-12bd313376dc">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">1bf438b5744db73eea58379a3b9f30e5</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:05:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-6d15c4fe-2de7-4abc-9593-c9eeae9b928f" timestamp="2016-11-10T16:05:09+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 3b869c8e23d66ad0527882fc79ff7237 (MISP Attribute #535)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 3b869c8e23d66ad0527882fc79ff7237 (MISP Attribute #535)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-6d15c4fe-2de7-4abc-9593-c9eeae9b928f">
<cybox:Object id=":File-6d15c4fe-2de7-4abc-9593-c9eeae9b928f">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">3b869c8e23d66ad0527882fc79ff7237</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:05:09+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-23403344-c52e-4c19-9f7b-f5291b451bee" timestamp="2016-11-10T16:04:24+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: fef27f432e0ae8218143bc410fda340e (MISP Attribute #536)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: fef27f432e0ae8218143bc410fda340e (MISP Attribute #536)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-23403344-c52e-4c19-9f7b-f5291b451bee">
<cybox:Object id=":File-23403344-c52e-4c19-9f7b-f5291b451bee">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">fef27f432e0ae8218143bc410fda340e</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:04:24+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-dbabd2ee-213d-4b02-951f-a020cfc3582e" timestamp="2016-11-10T16:07:46+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 8b83fc5d3a6a80281269f9e337fe3fff (MISP Attribute #537)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 8b83fc5d3a6a80281269f9e337fe3fff (MISP Attribute #537)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-dbabd2ee-213d-4b02-951f-a020cfc3582e">
<cybox:Object id=":File-dbabd2ee-213d-4b02-951f-a020cfc3582e">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">8b83fc5d3a6a80281269f9e337fe3fff</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T16:07:46+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
</incident:Related_Indicators>
<incident:Leveraged_TTPs>
<incident:Leveraged_TTP>
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
<stixCommon:TTP idref=":ttp-5824e33f-4c08-4b5f-8092-497a8e96ca05" timestamp="2016-11-10T16:14:39+00:00" xsi:type='ttp:TTPType'/>
</incident:Leveraged_TTP>
</incident:Leveraged_TTPs>
<incident:History>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">Event Threat Level: Medium</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: TLP:GREEN</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: PUBLISHED</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: TARGET:TIBETAN</incident:Journal_Entry>
</incident:History_Item>
</incident:History>
<incident:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>citizenlab</stixCommon:Name>
</stixCommon:Identity>
<stixCommon:References>
<stixCommon:Reference>https://citizenlab.org/2016/03/shifting-tactics/</stixCommon:Reference>
</stixCommon:References>
</incident:Information_Source>
<incident:Handling>
<marking:Marking>
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
</marking:Marking>
</incident:Handling>
</stix:Incident>
</stix:Incidents>
</stix:Package>
</stix:Related_Package>
</stix:Related_Packages>
</stix:STIX_Package>

9
data/ioc/spyware/citizen_lab/201604_UP007_SLServer/README.md Normal file
View File

@@ -0,0 +1,9 @@
## UP007 & SLServer IOCs
This directory contains IOC from the Citizen Lab report ["Between Hong Kong and Burma: Tracking UP007 and SLServer Espionage Campaigns"](https://citizenlab.org/2016/04/between-hong-kong-and-burma/) published the 18th of April 2016.
Files included in this directory:
* openioc.ioc : IOCs in OpenIOC format
* stix.xml : IOCs in STIX XML format
* iocs.csv : IOCs in csv format
* rules.yar : Yara rules

25
data/ioc/spyware/citizen_lab/201604_UP007_SLServer/iocs.csv Normal file
View File

@@ -0,0 +1,25 @@
uuid,event_id,category,type,value,comment,to_ids,date
581ba7b8-59f4-402f-95d9-497a8e96ca05,2,Payload type,text,"UP007","",0,20160418
581ba817-0954-44a7-afce-49798e96ca05,2,Payload delivery,md5,"6a541de84074a2c4ff99eb43252d9030","",1,20160418
581ba817-1620-457c-ae64-49798e96ca05,2,Payload delivery,md5,"cfcd2a90e87156e1a811f9c7b0051002","",1,20160418
581ba817-1d18-4479-997f-49798e96ca05,2,Payload delivery,md5,"d8becbd6f188e3fb2c4d23a2d36d137b","",1,20160418
581ba817-2ce0-4046-9865-49798e96ca05,2,Payload delivery,md5,"09ddd70517cb48a46d9f93644b29c72f","",1,20160418
581ba817-4924-41de-9ce9-49798e96ca05,2,Payload delivery,md5,"dc195d814ec16fe91690b7e949e696f6","",1,20160418
581ba817-5a08-4dff-a2d8-49798e96ca05,2,Payload delivery,md5,"ce8ec932be16b69ffa06626b3b423395","",1,20160418
581ba817-8010-4c55-a7c9-49798e96ca05,2,Payload delivery,md5,"397021af7c0284c28db65297a6711235","",1,20160418
581ba817-8d0c-4716-90dc-49798e96ca05,2,Payload delivery,md5,"d8ede9e6c3a1a30398b0b98130ee3b38","",1,20160418
581ba817-91f4-4e92-9164-49798e96ca05,2,Payload delivery,md5,"f70b295c6a5121b918682310ce0c2165","",1,20160418
581ba817-9adc-4354-9b03-49798e96ca05,2,Payload delivery,md5,"d07b2738840ce3419df651d3a0a3a246","",1,20160418
581ba817-ad74-4d70-bc5a-49798e96ca05,2,Payload delivery,md5,"639c7239f40d95f677a99abb059e8338","",1,20160418
581ba817-c96c-4e46-bd92-49798e96ca05,2,Payload delivery,md5,"e0eb981ad6be0bd16246d5d442028687","",1,20160418
581ba817-cf4c-42ae-b661-49798e96ca05,2,Payload delivery,md5,"f80edbb0fcfe7cec17592f61a06e4df2","",1,20160418
581ba817-d2a4-4dcb-b1b3-49798e96ca05,2,Payload delivery,md5,"d579d7a42ff140952da57264614c37bc","",1,20160418
581ba833-2410-4a7c-a67f-497a8e96ca05,2,Network activity,domain,"computer.security-centers.com","C2 servers",1,20160418
581ba833-4eb8-4589-ad6e-497a8e96ca05,2,Network activity,domain,"tenday.mysecondarydns.com","C2 servers",1,20160418
581ba833-5f7c-40f0-b2d4-497a8e96ca05,2,Network activity,domain,"safetyssl.security-centers.com","C2 servers",1,20160418
581ba833-6060-4ce6-b102-497a8e96ca05,2,Network activity,domain,"hkemail.f3322.org","C2 servers",1,20160418
581ba833-71b8-4f00-b1f8-497a8e96ca05,2,Network activity,domain,"www.olinaodi.com","C2 servers",1,20160418
581ba849-3730-4528-a94e-49798e96ca05,2,Network activity,ip-dst,"59.188.12.123","IP behind C2 domains",1,20161110
581ba849-a850-4cbf-a6b2-49798e96ca05,2,Network activity,ip-dst,"210.61.12.153","IP behind C2 domains",1,20161110
581ba88c-c144-41d1-ad67-497a8e96ca05,2,Payload type,text,"SLServer","",0,20160418
581ba8ac-e8a4-4fa0-b8f1-49798e96ca05,2,Internal reference,link,"https://citizenlab.org/2016/04/between-hong-kong-and-burma/","",0,20160418
1 uuid event_id category type value comment to_ids date
2 581ba7b8-59f4-402f-95d9-497a8e96ca05 2 Payload type text UP007 0 20160418
3 581ba817-0954-44a7-afce-49798e96ca05 2 Payload delivery md5 6a541de84074a2c4ff99eb43252d9030 1 20160418
4 581ba817-1620-457c-ae64-49798e96ca05 2 Payload delivery md5 cfcd2a90e87156e1a811f9c7b0051002 1 20160418
5 581ba817-1d18-4479-997f-49798e96ca05 2 Payload delivery md5 d8becbd6f188e3fb2c4d23a2d36d137b 1 20160418
6 581ba817-2ce0-4046-9865-49798e96ca05 2 Payload delivery md5 09ddd70517cb48a46d9f93644b29c72f 1 20160418
7 581ba817-4924-41de-9ce9-49798e96ca05 2 Payload delivery md5 dc195d814ec16fe91690b7e949e696f6 1 20160418
8 581ba817-5a08-4dff-a2d8-49798e96ca05 2 Payload delivery md5 ce8ec932be16b69ffa06626b3b423395 1 20160418
9 581ba817-8010-4c55-a7c9-49798e96ca05 2 Payload delivery md5 397021af7c0284c28db65297a6711235 1 20160418
10 581ba817-8d0c-4716-90dc-49798e96ca05 2 Payload delivery md5 d8ede9e6c3a1a30398b0b98130ee3b38 1 20160418
11 581ba817-91f4-4e92-9164-49798e96ca05 2 Payload delivery md5 f70b295c6a5121b918682310ce0c2165 1 20160418
12 581ba817-9adc-4354-9b03-49798e96ca05 2 Payload delivery md5 d07b2738840ce3419df651d3a0a3a246 1 20160418
13 581ba817-ad74-4d70-bc5a-49798e96ca05 2 Payload delivery md5 639c7239f40d95f677a99abb059e8338 1 20160418
14 581ba817-c96c-4e46-bd92-49798e96ca05 2 Payload delivery md5 e0eb981ad6be0bd16246d5d442028687 1 20160418
15 581ba817-cf4c-42ae-b661-49798e96ca05 2 Payload delivery md5 f80edbb0fcfe7cec17592f61a06e4df2 1 20160418
16 581ba817-d2a4-4dcb-b1b3-49798e96ca05 2 Payload delivery md5 d579d7a42ff140952da57264614c37bc 1 20160418
17 581ba833-2410-4a7c-a67f-497a8e96ca05 2 Network activity domain computer.security-centers.com C2 servers 1 20160418
18 581ba833-4eb8-4589-ad6e-497a8e96ca05 2 Network activity domain tenday.mysecondarydns.com C2 servers 1 20160418
19 581ba833-5f7c-40f0-b2d4-497a8e96ca05 2 Network activity domain safetyssl.security-centers.com C2 servers 1 20160418
20 581ba833-6060-4ce6-b102-497a8e96ca05 2 Network activity domain hkemail.f3322.org C2 servers 1 20160418
21 581ba833-71b8-4f00-b1f8-497a8e96ca05 2 Network activity domain www.olinaodi.com C2 servers 1 20160418
22 581ba849-3730-4528-a94e-49798e96ca05 2 Network activity ip-dst 59.188.12.123 IP behind C2 domains 1 20161110
23 581ba849-a850-4cbf-a6b2-49798e96ca05 2 Network activity ip-dst 210.61.12.153 IP behind C2 domains 1 20161110
24 581ba88c-c144-41d1-ad67-497a8e96ca05 2 Payload type text SLServer 0 20160418
25 581ba8ac-e8a4-4fa0-b8f1-49798e96ca05 2 Internal reference link https://citizenlab.org/2016/04/between-hong-kong-and-burma/ 0 20160418

97
data/ioc/spyware/citizen_lab/201604_UP007_SLServer/openioc.ioc Normal file
View File

@@ -0,0 +1,97 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581ba774-6db4-441c-b981-49798e96ca05" last-modified="2016-04-18T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #2</short_description>
<description>Tracking UP007 and SLServer Espionage Campaigns</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2016-04-18T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="581ba774-6db4-441c-b981-49798e96ca05">
<IndicatorItem id="safetyssl.security-centers.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="computer.security-centers.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="hkemail.f3322.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.olinaodi.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="tenday.mysecondarydns.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="59.188.12.123" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="210.61.12.153" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="d579d7a42ff140952da57264614c37bc" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="d8becbd6f188e3fb2c4d23a2d36d137b" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="09ddd70517cb48a46d9f93644b29c72f" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="f70b295c6a5121b918682310ce0c2165" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="f80edbb0fcfe7cec17592f61a06e4df2" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="d8ede9e6c3a1a30398b0b98130ee3b38" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="ce8ec932be16b69ffa06626b3b423395" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="6a541de84074a2c4ff99eb43252d9030" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="e0eb981ad6be0bd16246d5d442028687" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="639c7239f40d95f677a99abb059e8338" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="d07b2738840ce3419df651d3a0a3a246" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="397021af7c0284c28db65297a6711235" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="dc195d814ec16fe91690b7e949e696f6" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="cfcd2a90e87156e1a811f9c7b0051002" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

190
data/ioc/spyware/citizen_lab/201604_UP007_SLServer/rules.yar Normal file
View File

@@ -0,0 +1,190 @@
rule dubseven_file_set
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for service files loading UP007"
strings:
$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
$file7 = "\\Microsoft\\Internet Explorer\\mon"
$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
//Just a few of these as they differ
3 of ($file*)
}
rule dubseven_dropper_registry_checks
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for registry keys checked for by the dropper"
strings:
$reg1 = "SOFTWARE\\360Safe\\Liveup"
$reg2 = "Software\\360safe"
$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
$reg4 = "SOFTWARE\\Avira\\Avira Destop"
$reg5 = "SOFTWARE\\rising\\RAV"
$reg6 = "SOFTWARE\\JiangMin"
$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
all of ($reg*)
}
rule dubseven_dropper_dialog_remains
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for related dialog remnants. How rude."
strings:
$dia1 = "fuckMessageBox 1.0" wide
$dia2 = "Rundll 1.0" wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
any of them
}
rule maindll_mutex
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches on the maindll mutex"
strings:
$mutex = "h31415927tttt"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$mutex
}
rule SLServer_dialog_remains
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for related dialog remnants."
strings:
$slserver = "SLServer" wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$slserver
}
rule SLServer_mutex
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for the mutex."
strings:
$mutex = "M&GX^DSF&DA@F"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$mutex
}
rule SLServer_command_and_control
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for the C2 server."
strings:
$c2 = "safetyssl.security-centers.com"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$c2
}
rule SLServer_campaign_code
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for the related campaign code."
strings:
$campaign = "wthkdoc0106"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$campaign
}
rule SLServer_unknown_string
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for a unique string."
strings:
$string = "test-b7fa835a39"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$string
}

982
data/ioc/spyware/citizen_lab/201604_UP007_SLServer/stix.xml Normal file
View File

@@ -0,0 +1,982 @@
<stix:STIX_Package
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
xmlns:marking="http://data-marking.mitre.org/Marking-1"
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:indicator="http://stix.mitre.org/Indicator-2"
xmlns:ttp="http://stix.mitre.org/TTP-1"
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:="https://rufus.citlab.utoronto.ca"
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
xsi:schemaLocation="
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-c2b4b6fc-b3a6-407c-b4dc-da81c5b00eec" version="1.1.1" timestamp="2016-11-10T20:57:45.659431+00:00">
<stix:STIX_Header>
<stix:Title>Export from MISP</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Related_Packages>
<stix:Related_Package>
<stix:Package id=":STIXPackage-581ba774-6db4-441c-b981-49798e96ca05" version="1.1.1" timestamp="2016-11-10T15:54:41+00:00">
<stix:STIX_Header>
<stix:Title>Tracking UP007 and SLServer Espionage Campaigns (MISP Event #2)</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:TTPs>
<stix:TTP id=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'>
<ttp:Title>Payload type: UP007 (MISP Attribute #30)</ttp:Title>
<ttp:Behavior>
<ttp:Malware>
<ttp:Malware_Instance>
<ttp:Name>UP007</ttp:Name>
</ttp:Malware_Instance>
</ttp:Malware>
</ttp:Behavior>
</stix:TTP>
<stix:TTP id=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'>
<ttp:Title>Payload type: SLServer (MISP Attribute #52)</ttp:Title>
<ttp:Behavior>
<ttp:Malware>
<ttp:Malware_Instance>
<ttp:Name>SLServer</ttp:Name>
</ttp:Malware_Instance>
</ttp:Malware>
</ttp:Behavior>
</stix:TTP>
</stix:TTPs>
<stix:Incidents>
<stix:Incident id=":incident-581ba774-6db4-441c-b981-49798e96ca05" timestamp="2016-11-10T15:57:11+00:00" xsi:type='incident:IncidentType'>
<incident:Title>Tracking UP007 and SLServer Espionage Campaigns</incident:Title>
<incident:External_ID source="MISP Event">2</incident:External_ID>
<incident:Time>
<incident:Incident_Discovery precision="second">2016-04-18T00:00:00+00:00</incident:Incident_Discovery>
<incident:Incident_Reported precision="second">2016-11-10T15:57:11+00:00</incident:Incident_Reported>
</incident:Time>
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
<incident:Related_Indicators>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba833-5f7c-40f0-b2d4-497a8e96ca05" timestamp="2016-11-03T17:12:19+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: safetyssl.security-centers.com (MISP Attribute #45)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: safetyssl.security-centers.com (MISP Attribute #45)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba833-5f7c-40f0-b2d4-497a8e96ca05">
<cybox:Object id=":DomainName-581ba833-5f7c-40f0-b2d4-497a8e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">safetyssl.security-centers.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:12:19+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba833-2410-4a7c-a67f-497a8e96ca05" timestamp="2016-11-03T17:12:19+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: computer.security-centers.com (MISP Attribute #46)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: computer.security-centers.com (MISP Attribute #46)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba833-2410-4a7c-a67f-497a8e96ca05">
<cybox:Object id=":DomainName-581ba833-2410-4a7c-a67f-497a8e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">computer.security-centers.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:12:19+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba833-6060-4ce6-b102-497a8e96ca05" timestamp="2016-11-03T17:12:19+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: hkemail.f3322.org (MISP Attribute #47)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: hkemail.f3322.org (MISP Attribute #47)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba833-6060-4ce6-b102-497a8e96ca05">
<cybox:Object id=":DomainName-581ba833-6060-4ce6-b102-497a8e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">hkemail.f3322.org</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:12:19+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba833-71b8-4f00-b1f8-497a8e96ca05" timestamp="2016-11-03T17:12:19+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: www.olinaodi.com (MISP Attribute #48)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: www.olinaodi.com (MISP Attribute #48)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba833-71b8-4f00-b1f8-497a8e96ca05">
<cybox:Object id=":DomainName-581ba833-71b8-4f00-b1f8-497a8e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">www.olinaodi.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:12:19+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba833-4eb8-4589-ad6e-497a8e96ca05" timestamp="2016-11-03T17:12:19+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: tenday.mysecondarydns.com (MISP Attribute #49)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: tenday.mysecondarydns.com (MISP Attribute #49)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba833-4eb8-4589-ad6e-497a8e96ca05">
<cybox:Object id=":DomainName-581ba833-4eb8-4589-ad6e-497a8e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">tenday.mysecondarydns.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:12:19+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba849-3730-4528-a94e-49798e96ca05" timestamp="2016-11-10T15:54:41+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 59.188.12.123 (MISP Attribute #50)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 59.188.12.123 (MISP Attribute #50)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba849-3730-4528-a94e-49798e96ca05">
<cybox:Object id=":Address-581ba849-3730-4528-a94e-49798e96ca05">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">59.188.12.123</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T15:54:41+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba849-a850-4cbf-a6b2-49798e96ca05" timestamp="2016-11-10T15:54:32+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 210.61.12.153 (MISP Attribute #51)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 210.61.12.153 (MISP Attribute #51)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba849-a850-4cbf-a6b2-49798e96ca05">
<cybox:Object id=":Address-581ba849-a850-4cbf-a6b2-49798e96ca05">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">210.61.12.153</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-10T15:54:32+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-d2a4-4dcb-b1b3-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: d579d7a42ff140952da57264614c37bc (MISP Attribute #31)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: d579d7a42ff140952da57264614c37bc (MISP Attribute #31)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-d2a4-4dcb-b1b3-49798e96ca05">
<cybox:Object id=":File-581ba817-d2a4-4dcb-b1b3-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">d579d7a42ff140952da57264614c37bc</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-1d18-4479-997f-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: d8becbd6f188e3fb2c4d23a2d36d137b (MISP Attribute #32)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: d8becbd6f188e3fb2c4d23a2d36d137b (MISP Attribute #32)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-1d18-4479-997f-49798e96ca05">
<cybox:Object id=":File-581ba817-1d18-4479-997f-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">d8becbd6f188e3fb2c4d23a2d36d137b</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-2ce0-4046-9865-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 09ddd70517cb48a46d9f93644b29c72f (MISP Attribute #33)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 09ddd70517cb48a46d9f93644b29c72f (MISP Attribute #33)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-2ce0-4046-9865-49798e96ca05">
<cybox:Object id=":File-581ba817-2ce0-4046-9865-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">09ddd70517cb48a46d9f93644b29c72f</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-91f4-4e92-9164-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: f70b295c6a5121b918682310ce0c2165 (MISP Attribute #34)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: f70b295c6a5121b918682310ce0c2165 (MISP Attribute #34)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-91f4-4e92-9164-49798e96ca05">
<cybox:Object id=":File-581ba817-91f4-4e92-9164-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">f70b295c6a5121b918682310ce0c2165</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-cf4c-42ae-b661-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: f80edbb0fcfe7cec17592f61a06e4df2 (MISP Attribute #35)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: f80edbb0fcfe7cec17592f61a06e4df2 (MISP Attribute #35)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-cf4c-42ae-b661-49798e96ca05">
<cybox:Object id=":File-581ba817-cf4c-42ae-b661-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">f80edbb0fcfe7cec17592f61a06e4df2</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-8d0c-4716-90dc-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: d8ede9e6c3a1a30398b0b98130ee3b38 (MISP Attribute #36)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: d8ede9e6c3a1a30398b0b98130ee3b38 (MISP Attribute #36)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-8d0c-4716-90dc-49798e96ca05">
<cybox:Object id=":File-581ba817-8d0c-4716-90dc-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">d8ede9e6c3a1a30398b0b98130ee3b38</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-5a08-4dff-a2d8-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: ce8ec932be16b69ffa06626b3b423395 (MISP Attribute #37)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: ce8ec932be16b69ffa06626b3b423395 (MISP Attribute #37)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-5a08-4dff-a2d8-49798e96ca05">
<cybox:Object id=":File-581ba817-5a08-4dff-a2d8-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">ce8ec932be16b69ffa06626b3b423395</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-0954-44a7-afce-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 6a541de84074a2c4ff99eb43252d9030 (MISP Attribute #38)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 6a541de84074a2c4ff99eb43252d9030 (MISP Attribute #38)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-0954-44a7-afce-49798e96ca05">
<cybox:Object id=":File-581ba817-0954-44a7-afce-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">6a541de84074a2c4ff99eb43252d9030</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-c96c-4e46-bd92-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: e0eb981ad6be0bd16246d5d442028687 (MISP Attribute #39)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: e0eb981ad6be0bd16246d5d442028687 (MISP Attribute #39)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-c96c-4e46-bd92-49798e96ca05">
<cybox:Object id=":File-581ba817-c96c-4e46-bd92-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">e0eb981ad6be0bd16246d5d442028687</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-ad74-4d70-bc5a-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 639c7239f40d95f677a99abb059e8338 (MISP Attribute #40)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 639c7239f40d95f677a99abb059e8338 (MISP Attribute #40)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-ad74-4d70-bc5a-49798e96ca05">
<cybox:Object id=":File-581ba817-ad74-4d70-bc5a-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">639c7239f40d95f677a99abb059e8338</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-9adc-4354-9b03-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: d07b2738840ce3419df651d3a0a3a246 (MISP Attribute #41)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: d07b2738840ce3419df651d3a0a3a246 (MISP Attribute #41)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-9adc-4354-9b03-49798e96ca05">
<cybox:Object id=":File-581ba817-9adc-4354-9b03-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">d07b2738840ce3419df651d3a0a3a246</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-8010-4c55-a7c9-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 397021af7c0284c28db65297a6711235 (MISP Attribute #42)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 397021af7c0284c28db65297a6711235 (MISP Attribute #42)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-8010-4c55-a7c9-49798e96ca05">
<cybox:Object id=":File-581ba817-8010-4c55-a7c9-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">397021af7c0284c28db65297a6711235</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-4924-41de-9ce9-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: dc195d814ec16fe91690b7e949e696f6 (MISP Attribute #43)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: dc195d814ec16fe91690b7e949e696f6 (MISP Attribute #43)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-4924-41de-9ce9-49798e96ca05">
<cybox:Object id=":File-581ba817-4924-41de-9ce9-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">dc195d814ec16fe91690b7e949e696f6</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-581ba817-1620-457c-ae64-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: cfcd2a90e87156e1a811f9c7b0051002 (MISP Attribute #44)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: cfcd2a90e87156e1a811f9c7b0051002 (MISP Attribute #44)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-581ba817-1620-457c-ae64-49798e96ca05">
<cybox:Object id=":File-581ba817-1620-457c-ae64-49798e96ca05">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">cfcd2a90e87156e1a811f9c7b0051002</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
</incident:Related_Indicators>
<incident:Leveraged_TTPs>
<incident:Leveraged_TTP>
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
</incident:Leveraged_TTP>
<incident:Leveraged_TTP>
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
</incident:Leveraged_TTP>
</incident:Leveraged_TTPs>
<incident:History>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">Event Threat Level: High</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: PUBLISHED</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule dubseven_file_set
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for service files loading UP007"
strings:
$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
$file7 = "\\Microsoft\\Internet Explorer\\mon"
$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
//Just a few of these as they differ
3 of ($file*)
}</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule dubseven_dropper_registry_checks
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for registry keys checked for by the dropper"
strings:
$reg1 = "SOFTWARE\\360Safe\\Liveup"
$reg2 = "Software\\360safe"
$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
$reg4 = "SOFTWARE\\Avira\\Avira Destop"
$reg5 = "SOFTWARE\\rising\\RAV"
$reg6 = "SOFTWARE\\JiangMin"
$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
all of ($reg*)
}</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule dubseven_dropper_dialog_remains
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for related dialog remnants. How rude."
strings:
$dia1 = "fuckMessageBox 1.0" wide
$dia2 = "Rundll 1.0" wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
any of them
}</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule maindll_mutex
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches on the maindll mutex"
strings:
$mutex = "h31415927tttt"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$mutex
}</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_dialog_remains
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for related dialog remnants."
strings:
$slserver = "SLServer" wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$slserver
}</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_mutex
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for the mutex."
strings:
$mutex = "M&amp;GX^DSF&amp;DA@F"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$mutex
}</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_command_and_control
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for the C2 server."
strings:
$c2 = "safetyssl.security-centers.com"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$c2
}</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_campaign_code
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for the related campaign code."
strings:
$campaign = "wthkdoc0106"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$campaign
}</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_unknown_string
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Searches for a unique string."
strings:
$string = "test-b7fa835a39"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
$string
}</incident:Journal_Entry>
</incident:History_Item>
</incident:History>
<incident:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>citizenlab</stixCommon:Name>
</stixCommon:Identity>
<stixCommon:References>
<stixCommon:Reference>https://citizenlab.org/2016/04/between-hong-kong-and-burma/</stixCommon:Reference>
</stixCommon:References>
</incident:Information_Source>
<incident:Handling>
<marking:Marking>
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
</marking:Marking>
</incident:Handling>
</stix:Incident>
</stix:Incidents>
</stix:Package>
</stix:Related_Package>
</stix:Related_Packages>
</stix:STIX_Package>

8
data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/README.md Normal file
View File

@@ -0,0 +1,8 @@
## UAE Threat Actor IOCs
This directory contains IOC from the Citizen Lab report ["Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents"](https://citizenlab.org/2016/05/stealth-falcon/) published the 29th of May 2016.
Files included in this directory:
* openioc.ioc : IOCs in OpenIOC format
* stix.xml : IOCs in STIX XML format
* iocs.csv : IOCs in csv format

35
data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/iocs.csv Normal file
View File

@@ -0,0 +1,35 @@
uuid,event_id,category,type,value,comment,to_ids,date
007694f1-b73a-40a5-bcf5-dded27746669,8,Network activity,url,"http://aax.me/0b152","",0,20161108
19e97c58-4992-4f0b-8f49-6a6378a289eb,8,Payload delivery,sha256,"4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be","message_032456944343.docm",0,20161108
280056b8-69aa-432c-9826-6d5b820eb44e,8,Payload delivery,email-src,"andrew.dwight389@outlook.com","The Case of the Fake Journalist",0,20161108
35aa025c-2f62-4f9d-9fb7-391542226a7a,8,Network activity,domain,"optimizedimghosting.com","The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL",1,20161108
3813bc78-21d9-40a2-b76e-61016eb71ccb,8,Network activity,domain,"adhostingcache.com","",1,20161108
41c48554-6911-48eb-88a0-411dc4bd9047,8,Payload delivery,sha1,"1c3757006f972ca957d925accf8bbb3023550d1b","message_032456944343.docm",0,20161108
45dbee97-3aa0-487d-bd73-a3c10a511403,8,Network activity,ip-dst,"95.215.44.37","IP linked to adhostingcache.com",0,20161108
537df72e-b2b9-4016-b337-06930c42c455,8,Network activity,url,"http://goo.gl/60HAqJ","redirects to http://aax.me/0b152",0,20161108
58224765-51f8-4d28-9040-49798e96ca05,8,Attribution,threat-actor,"Stealth Falcon","",0,20161108
582247a8-11b4-4da0-9ca1-69fe8e96ca05,8,Payload delivery,domain,"aax.me","",1,20161108
582247d0-d7a0-49c3-a6ae-69fe8e96ca05,8,Payload delivery,url,"http://aax.me/a6faa","Link sent in a phishing email",1,20161108
582247f6-eeec-47b0-b6d8-69fe8e96ca05,8,Payload delivery,url,"https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate","ownCloud15 instance",0,20161108
5822492e-087c-4fa8-afe1-49798e96ca05,8,Network activity,domain,"simpleadbanners.com","Domains linked to adhostingcache.com",0,20161108
5822492e-1d40-4098-a87b-49798e96ca05,8,Network activity,domain,"clickstatistic.com","Domains linked to adhostingcache.com",0,20161108
5822492e-7490-4c3f-9a10-49798e96ca05,8,Network activity,domain,"bestairlinepricetags.com","Domains linked to adhostingcache.com",0,20161108
5822492e-d888-418e-906d-49798e96ca05,8,Network activity,domain,"fasttravelclearance.com","Domains linked to adhostingcache.com",0,20161108
5822494d-792c-4d8c-9be0-49798e96ca05,8,Network activity,domain,"airlineadverts.com","Domain linked to incapsulawebcache.com",0,20161108
5822494d-7ab0-42bd-bd9d-49798e96ca05,8,Network activity,domain,"ministrynewschannel.com","Domain linked to incapsulawebcache.com",0,20161108
5822494d-bf14-4b41-803a-49798e96ca05,8,Network activity,domain,"ministrynewsinfo.com","Domain linked to incapsulawebcache.com",0,20161108
62fcd7b4-5d95-49bd-a9ff-3c2e1854839b,8,Network activity,url,"http://optimizedimghosting.com/wddf/hrrw/ggrr.txt","The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL",0,20161108
6c1856f6-0068-4c83-8aba-9fd4bb4277a1,8,Payload delivery,url,"http://aax.me/d0dde","loaded a page containing a redirect to the website of Al Jazeera. Before completing the redirect, it invoked JavaScript to profile the target’s computer.",0,20161108
707eed9b-bb2c-4951-af0d-060b4c860e89,8,External analysis,link,"https://citizenlab.org/2016/05/stealth-falcon/","",0,20161108
70881ae4-3da1-409e-8bd3-7f508092a2c9,8,Payload delivery,sha256,"5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f","right2fight.docm (malicious document)",0,20161108
7fd6e683-9615-4f4e-b901-03e7dbb81337,8,Network activity,url,"https://incapsulawebcache.com/cache/cache.nfo","",0,20161108
8010c934-027b-40c5-ba1e-3efca8e52d5a,8,Network activity,domain,"incapsulawebcache.com","stage two server",1,20161108
8682a3ad-80da-4732-bf5a-e675e27c56fe,8,Network activity,domain,"edgecacheimagehosting.com","stage two server",1,20161108
9ca61973-d717-496a-a158-82d9b2e37965,8,Payload delivery,md5,"87e1df6f36b96b56186444e37e2a1ef5","message_032456944343.docm",0,20161108
bc8e2ca7-cd3c-4205-9028-b8b106f12389,8,Payload delivery,email-src,"the_right_to_fight@openmailbox.org","Fake invitation",0,20161108
cd191e4e-a5a1-4009-93b7-92cc6a3d6984,8,Payload delivery,sha1,"f25466e4820404c817eaf75818b7177891735886","right2fight.docm (malicious document)",0,20161108
d9a62cda-db4c-4d70-858c-6bbaaa041e63,8,Network activity,domain,"adhostingcaches.com","registered on December 3rd",1,20161108
decfcbf1-1331-4624-88b7-a88c94637dd0,8,Network activity,url,"http://adhostingcache.com/ehhe/eh4g4/adcache.txt","Gathered information is returned to and the server’s response is executed as a PowerShell command.",0,20161108
e8f3b924-1221-4d08-8fef-f689529a7b6d,8,Network activity,url,"http://aax.me/redirect.js","to profile a user’s system, perhaps to gather intelligence about potentially exploitable vulnerabilities.",0,20161108
f0215c0c-b708-43d8-873e-80a3e8e54cfa,8,Network activity,url,"https://edgecacheimagehosting.com/images/image.nfo","The Stage Two in this case reported back to",0,20161108
f4f40c31-dd17-4dc6-baa3-6beb35c04c00,8,Payload delivery,md5,"80e8ef78b9e28015cde4205aaa65da97","right2fight.docm (malicious document)",0,20161108
1 uuid event_id category type value comment to_ids date
2 007694f1-b73a-40a5-bcf5-dded27746669 8 Network activity url http://aax.me/0b152 0 20161108
3 19e97c58-4992-4f0b-8f49-6a6378a289eb 8 Payload delivery sha256 4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be message_032456944343.docm 0 20161108
4 280056b8-69aa-432c-9826-6d5b820eb44e 8 Payload delivery email-src andrew.dwight389@outlook.com The Case of the Fake Journalist 0 20161108
5 35aa025c-2f62-4f9d-9fb7-391542226a7a 8 Network activity domain optimizedimghosting.com The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL 1 20161108
6 3813bc78-21d9-40a2-b76e-61016eb71ccb 8 Network activity domain adhostingcache.com 1 20161108
7 41c48554-6911-48eb-88a0-411dc4bd9047 8 Payload delivery sha1 1c3757006f972ca957d925accf8bbb3023550d1b message_032456944343.docm 0 20161108
8 45dbee97-3aa0-487d-bd73-a3c10a511403 8 Network activity ip-dst 95.215.44.37 IP linked to adhostingcache.com 0 20161108
9 537df72e-b2b9-4016-b337-06930c42c455 8 Network activity url http://goo.gl/60HAqJ redirects to http://aax.me/0b152 0 20161108
10 58224765-51f8-4d28-9040-49798e96ca05 8 Attribution threat-actor Stealth Falcon 0 20161108
11 582247a8-11b4-4da0-9ca1-69fe8e96ca05 8 Payload delivery domain aax.me 1 20161108
12 582247d0-d7a0-49c3-a6ae-69fe8e96ca05 8 Payload delivery url http://aax.me/a6faa Link sent in a phishing email 1 20161108
13 582247f6-eeec-47b0-b6d8-69fe8e96ca05 8 Payload delivery url https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate ownCloud15 instance 0 20161108
14 5822492e-087c-4fa8-afe1-49798e96ca05 8 Network activity domain simpleadbanners.com Domains linked to adhostingcache.com 0 20161108
15 5822492e-1d40-4098-a87b-49798e96ca05 8 Network activity domain clickstatistic.com Domains linked to adhostingcache.com 0 20161108
16 5822492e-7490-4c3f-9a10-49798e96ca05 8 Network activity domain bestairlinepricetags.com Domains linked to adhostingcache.com 0 20161108
17 5822492e-d888-418e-906d-49798e96ca05 8 Network activity domain fasttravelclearance.com Domains linked to adhostingcache.com 0 20161108
18 5822494d-792c-4d8c-9be0-49798e96ca05 8 Network activity domain airlineadverts.com Domain linked to incapsulawebcache.com 0 20161108
19 5822494d-7ab0-42bd-bd9d-49798e96ca05 8 Network activity domain ministrynewschannel.com Domain linked to incapsulawebcache.com 0 20161108
20 5822494d-bf14-4b41-803a-49798e96ca05 8 Network activity domain ministrynewsinfo.com Domain linked to incapsulawebcache.com 0 20161108
21 62fcd7b4-5d95-49bd-a9ff-3c2e1854839b 8 Network activity url http://optimizedimghosting.com/wddf/hrrw/ggrr.txt The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL 0 20161108
22 6c1856f6-0068-4c83-8aba-9fd4bb4277a1 8 Payload delivery url http://aax.me/d0dde loaded a page containing a redirect to the website of Al Jazeera. Before completing the redirect, it invoked JavaScript to profile the target’s computer. 0 20161108
23 707eed9b-bb2c-4951-af0d-060b4c860e89 8 External analysis link https://citizenlab.org/2016/05/stealth-falcon/ 0 20161108
24 70881ae4-3da1-409e-8bd3-7f508092a2c9 8 Payload delivery sha256 5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f right2fight.docm (malicious document) 0 20161108
25 7fd6e683-9615-4f4e-b901-03e7dbb81337 8 Network activity url https://incapsulawebcache.com/cache/cache.nfo 0 20161108
26 8010c934-027b-40c5-ba1e-3efca8e52d5a 8 Network activity domain incapsulawebcache.com stage two server 1 20161108
27 8682a3ad-80da-4732-bf5a-e675e27c56fe 8 Network activity domain edgecacheimagehosting.com stage two server 1 20161108
28 9ca61973-d717-496a-a158-82d9b2e37965 8 Payload delivery md5 87e1df6f36b96b56186444e37e2a1ef5 message_032456944343.docm 0 20161108
29 bc8e2ca7-cd3c-4205-9028-b8b106f12389 8 Payload delivery email-src the_right_to_fight@openmailbox.org Fake invitation 0 20161108
30 cd191e4e-a5a1-4009-93b7-92cc6a3d6984 8 Payload delivery sha1 f25466e4820404c817eaf75818b7177891735886 right2fight.docm (malicious document) 0 20161108
31 d9a62cda-db4c-4d70-858c-6bbaaa041e63 8 Network activity domain adhostingcaches.com registered on December 3rd 1 20161108
32 decfcbf1-1331-4624-88b7-a88c94637dd0 8 Network activity url http://adhostingcache.com/ehhe/eh4g4/adcache.txt Gathered information is returned to and the server’s response is executed as a PowerShell command. 0 20161108
33 e8f3b924-1221-4d08-8fef-f689529a7b6d 8 Network activity url http://aax.me/redirect.js to profile a user’s system, perhaps to gather intelligence about potentially exploitable vulnerabilities. 0 20161108
34 f0215c0c-b708-43d8-873e-80a3e8e54cfa 8 Network activity url https://edgecacheimagehosting.com/images/image.nfo The Stage Two in this case reported back to 0 20161108
35 f4f40c31-dd17-4dc6-baa3-6beb35c04c00 8 Payload delivery md5 80e8ef78b9e28015cde4205aaa65da97 right2fight.docm (malicious document) 0 20161108

41
data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/openioc.ioc Normal file
View File

@@ -0,0 +1,41 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581c05a7-1888-402a-b435-49798e96ca05" last-modified="2016-05-29T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #8</short_description>
<description>Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2016-05-29T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="581c05a7-1888-402a-b435-49798e96ca05">
<IndicatorItem id="adhostingcache.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="adhostingcaches.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="optimizedimghosting.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="edgecacheimagehosting.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="incapsulawebcache.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="aax.me" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://aax.me/a6faa" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

844
data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/stix.xml Normal file
View File

@@ -0,0 +1,844 @@
<stix:STIX_Package
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
xmlns:marking="http://data-marking.mitre.org/Marking-1"
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:indicator="http://stix.mitre.org/Indicator-2"
xmlns:ttp="http://stix.mitre.org/TTP-1"
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:="https://rufus.citlab.utoronto.ca"
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
xsi:schemaLocation="
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-7e377b3f-5c5a-403a-9575-64593685b0a8" version="1.1.1" timestamp="2016-11-08T21:57:05.578284+00:00">
<stix:STIX_Header>
<stix:Title>Export from MISP</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Related_Packages>
<stix:Related_Package>
<stix:Package id=":STIXPackage-581c05a7-1888-402a-b435-49798e96ca05" version="1.1.1" timestamp="2016-11-08T16:56:04+00:00">
<stix:STIX_Header>
<stix:Title>Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents (MISP Event #8)</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Incidents>
<stix:Incident id=":incident-581c05a7-1888-402a-b435-49798e96ca05" timestamp="2016-11-08T16:56:19+00:00" xsi:type='incident:IncidentType'>
<incident:Title>Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents</incident:Title>
<incident:External_ID source="MISP Event">8</incident:External_ID>
<incident:Time>
<incident:Incident_Discovery precision="second">2016-05-29T00:00:00+00:00</incident:Incident_Discovery>
<incident:Incident_Reported precision="second">2016-11-08T16:56:19+00:00</incident:Incident_Reported>
</incident:Time>
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
<incident:Related_Indicators>
<incident:Related_Indicator>
<stixCommon:Relationship>Attribution</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-58224765-51f8-4d28-9040-49798e96ca05" timestamp="2016-11-08T16:45:09+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Attribution: Stealth Falcon (MISP Attribute #1354)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Description>Attribution: Stealth Falcon (MISP Attribute #1354)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Confidence timestamp="2016-11-08T16:45:09+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5822492e-087c-4fa8-afe1-49798e96ca05" timestamp="2016-11-08T16:52:46+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: simpleadbanners.com (MISP Attribute #1358)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: simpleadbanners.com (MISP Attribute #1358)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5822492e-087c-4fa8-afe1-49798e96ca05">
<cybox:Object id=":DomainName-5822492e-087c-4fa8-afe1-49798e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">simpleadbanners.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:52:46+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5822492e-1d40-4098-a87b-49798e96ca05" timestamp="2016-11-08T16:52:46+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: clickstatistic.com (MISP Attribute #1359)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: clickstatistic.com (MISP Attribute #1359)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5822492e-1d40-4098-a87b-49798e96ca05">
<cybox:Object id=":DomainName-5822492e-1d40-4098-a87b-49798e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">clickstatistic.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:52:46+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5822492e-7490-4c3f-9a10-49798e96ca05" timestamp="2016-11-08T16:52:46+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: bestairlinepricetags.com (MISP Attribute #1360)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: bestairlinepricetags.com (MISP Attribute #1360)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5822492e-7490-4c3f-9a10-49798e96ca05">
<cybox:Object id=":DomainName-5822492e-7490-4c3f-9a10-49798e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">bestairlinepricetags.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:52:46+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5822492e-d888-418e-906d-49798e96ca05" timestamp="2016-11-08T16:52:46+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: fasttravelclearance.com (MISP Attribute #1361)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: fasttravelclearance.com (MISP Attribute #1361)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5822492e-d888-418e-906d-49798e96ca05">
<cybox:Object id=":DomainName-5822492e-d888-418e-906d-49798e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">fasttravelclearance.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:52:46+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5822494d-792c-4d8c-9be0-49798e96ca05" timestamp="2016-11-08T16:53:17+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: airlineadverts.com (MISP Attribute #1362)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: airlineadverts.com (MISP Attribute #1362)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5822494d-792c-4d8c-9be0-49798e96ca05">
<cybox:Object id=":DomainName-5822494d-792c-4d8c-9be0-49798e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">airlineadverts.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:53:17+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5822494d-7ab0-42bd-bd9d-49798e96ca05" timestamp="2016-11-08T16:53:17+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: ministrynewschannel.com (MISP Attribute #1363)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: ministrynewschannel.com (MISP Attribute #1363)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5822494d-7ab0-42bd-bd9d-49798e96ca05">
<cybox:Object id=":DomainName-5822494d-7ab0-42bd-bd9d-49798e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">ministrynewschannel.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:53:17+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5822494d-bf14-4b41-803a-49798e96ca05" timestamp="2016-11-08T16:53:17+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: ministrynewsinfo.com (MISP Attribute #1364)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: ministrynewsinfo.com (MISP Attribute #1364)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5822494d-bf14-4b41-803a-49798e96ca05">
<cybox:Object id=":DomainName-5822494d-bf14-4b41-803a-49798e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">ministrynewsinfo.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:53:17+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-3813bc78-21d9-40a2-b76e-61016eb71ccb" timestamp="2016-11-08T16:48:19+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: adhostingcache.com (MISP Attribute #425)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: adhostingcache.com (MISP Attribute #425)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-3813bc78-21d9-40a2-b76e-61016eb71ccb">
<cybox:Object id=":DomainName-3813bc78-21d9-40a2-b76e-61016eb71ccb">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">adhostingcache.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:48:19+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-d9a62cda-db4c-4d70-858c-6bbaaa041e63" timestamp="2016-11-08T16:49:00+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: adhostingcaches.com (MISP Attribute #426)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: adhostingcaches.com (MISP Attribute #426)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-d9a62cda-db4c-4d70-858c-6bbaaa041e63">
<cybox:Object id=":DomainName-d9a62cda-db4c-4d70-858c-6bbaaa041e63">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">adhostingcaches.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:49:00+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-35aa025c-2f62-4f9d-9fb7-391542226a7a" timestamp="2016-11-08T16:54:01+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: optimizedimghosting.com (MISP Attribute #427)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: optimizedimghosting.com (MISP Attribute #427)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-35aa025c-2f62-4f9d-9fb7-391542226a7a">
<cybox:Object id=":DomainName-35aa025c-2f62-4f9d-9fb7-391542226a7a">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">optimizedimghosting.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:54:01+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-8682a3ad-80da-4732-bf5a-e675e27c56fe" timestamp="2016-11-08T16:54:09+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: edgecacheimagehosting.com (MISP Attribute #428)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: edgecacheimagehosting.com (MISP Attribute #428)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-8682a3ad-80da-4732-bf5a-e675e27c56fe">
<cybox:Object id=":DomainName-8682a3ad-80da-4732-bf5a-e675e27c56fe">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">edgecacheimagehosting.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:54:09+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-8010c934-027b-40c5-ba1e-3efca8e52d5a" timestamp="2016-11-08T16:49:14+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: incapsulawebcache.com (MISP Attribute #429)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: incapsulawebcache.com (MISP Attribute #429)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-8010c934-027b-40c5-ba1e-3efca8e52d5a">
<cybox:Object id=":DomainName-8010c934-027b-40c5-ba1e-3efca8e52d5a">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">incapsulawebcache.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:49:14+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-45dbee97-3aa0-487d-bd73-a3c10a511403" timestamp="2016-11-08T16:48:42+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 95.215.44.37 (MISP Attribute #430)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 95.215.44.37 (MISP Attribute #430)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-45dbee97-3aa0-487d-bd73-a3c10a511403">
<cybox:Object id=":Address-45dbee97-3aa0-487d-bd73-a3c10a511403">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">95.215.44.37</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:48:42+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-decfcbf1-1331-4624-88b7-a88c94637dd0" timestamp="2016-11-08T16:55:41+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://adhostingcache.com/ehhe/eh4g4/adcache.txt (MISP Attribute #432)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://adhostingcache.com/ehhe/eh4g4/adcache.txt (MISP Attribute #432)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-decfcbf1-1331-4624-88b7-a88c94637dd0">
<cybox:Object id=":URI-decfcbf1-1331-4624-88b7-a88c94637dd0">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://adhostingcache.com/ehhe/eh4g4/adcache.txt</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:55:41+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-7fd6e683-9615-4f4e-b901-03e7dbb81337" timestamp="2016-11-08T16:49:23+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: https://incapsulawebcache.com/cache/cache.nfo (MISP Attribute #433)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: https://incapsulawebcache.com/cache/cache.nfo (MISP Attribute #433)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-7fd6e683-9615-4f4e-b901-03e7dbb81337">
<cybox:Object id=":URI-7fd6e683-9615-4f4e-b901-03e7dbb81337">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">https://incapsulawebcache.com/cache/cache.nfo</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:49:23+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-e8f3b924-1221-4d08-8fef-f689529a7b6d" timestamp="2016-11-08T16:49:42+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://aax.me/redirect.js (MISP Attribute #434)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://aax.me/redirect.js (MISP Attribute #434)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-e8f3b924-1221-4d08-8fef-f689529a7b6d">
<cybox:Object id=":URI-e8f3b924-1221-4d08-8fef-f689529a7b6d">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://aax.me/redirect.js</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:49:42+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-537df72e-b2b9-4016-b337-06930c42c455" timestamp="2016-11-08T16:50:51+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://goo.gl/60HAqJ (MISP Attribute #435)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://goo.gl/60HAqJ (MISP Attribute #435)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-537df72e-b2b9-4016-b337-06930c42c455">
<cybox:Object id=":URI-537df72e-b2b9-4016-b337-06930c42c455">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://goo.gl/60HAqJ</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:50:51+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-007694f1-b73a-40a5-bcf5-dded27746669" timestamp="2016-11-08T16:51:04+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://aax.me/0b152 (MISP Attribute #436)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://aax.me/0b152 (MISP Attribute #436)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-007694f1-b73a-40a5-bcf5-dded27746669">
<cybox:Object id=":URI-007694f1-b73a-40a5-bcf5-dded27746669">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://aax.me/0b152</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:51:04+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-62fcd7b4-5d95-49bd-a9ff-3c2e1854839b" timestamp="2016-11-08T16:55:52+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://optimizedimghosting.com/wddf/hrrw/ggrr.txt (MISP Attribute #437)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://optimizedimghosting.com/wddf/hrrw/ggrr.txt (MISP Attribute #437)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-62fcd7b4-5d95-49bd-a9ff-3c2e1854839b">
<cybox:Object id=":URI-62fcd7b4-5d95-49bd-a9ff-3c2e1854839b">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://optimizedimghosting.com/wddf/hrrw/ggrr.txt</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:55:52+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-f0215c0c-b708-43d8-873e-80a3e8e54cfa" timestamp="2016-11-08T16:56:04+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: https://edgecacheimagehosting.com/images/image.nfo (MISP Attribute #438)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: https://edgecacheimagehosting.com/images/image.nfo (MISP Attribute #438)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-f0215c0c-b708-43d8-873e-80a3e8e54cfa">
<cybox:Object id=":URI-f0215c0c-b708-43d8-873e-80a3e8e54cfa">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">https://edgecacheimagehosting.com/images/image.nfo</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:56:04+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-582247a8-11b4-4da0-9ca1-69fe8e96ca05" timestamp="2016-11-08T16:46:16+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: aax.me (MISP Attribute #1355)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: aax.me (MISP Attribute #1355)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-582247a8-11b4-4da0-9ca1-69fe8e96ca05">
<cybox:Object id=":DomainName-582247a8-11b4-4da0-9ca1-69fe8e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">aax.me</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:46:16+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-bc8e2ca7-cd3c-4205-9028-b8b106f12389" timestamp="2016-11-08T16:45:32+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: the_right_to_fight@openmailbox.org (MISP Attribute #439)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
<indicator:Description>Payload delivery: the_right_to_fight@openmailbox.org (MISP Attribute #439)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-bc8e2ca7-cd3c-4205-9028-b8b106f12389">
<cybox:Object id=":EmailMessage-bc8e2ca7-cd3c-4205-9028-b8b106f12389">
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
<EmailMessageObj:Header>
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
<AddressObj:Address_Value condition="Equals">the_right_to_fight@openmailbox.org</AddressObj:Address_Value>
</EmailMessageObj:From>
</EmailMessageObj:Header>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:45:32+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-280056b8-69aa-432c-9826-6d5b820eb44e" timestamp="2016-11-08T16:50:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: andrew.dwight389@outlook.com (MISP Attribute #440)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
<indicator:Description>Payload delivery: andrew.dwight389@outlook.com (MISP Attribute #440)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-280056b8-69aa-432c-9826-6d5b820eb44e">
<cybox:Object id=":EmailMessage-280056b8-69aa-432c-9826-6d5b820eb44e">
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
<EmailMessageObj:Header>
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
<AddressObj:Address_Value condition="Equals">andrew.dwight389@outlook.com</AddressObj:Address_Value>
</EmailMessageObj:From>
</EmailMessageObj:Header>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:50:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-f4f40c31-dd17-4dc6-baa3-6beb35c04c00" timestamp="2016-11-08T16:47:46+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 80e8ef78b9e28015cde4205aaa65da97 (MISP Attribute #441)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 80e8ef78b9e28015cde4205aaa65da97 (MISP Attribute #441)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-f4f40c31-dd17-4dc6-baa3-6beb35c04c00">
<cybox:Object id=":File-f4f40c31-dd17-4dc6-baa3-6beb35c04c00">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">80e8ef78b9e28015cde4205aaa65da97</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:47:46+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-9ca61973-d717-496a-a158-82d9b2e37965" timestamp="2016-11-08T16:53:31+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 87e1df6f36b96b56186444e37e2a1ef5 (MISP Attribute #442)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 87e1df6f36b96b56186444e37e2a1ef5 (MISP Attribute #442)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-9ca61973-d717-496a-a158-82d9b2e37965">
<cybox:Object id=":File-9ca61973-d717-496a-a158-82d9b2e37965">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">87e1df6f36b96b56186444e37e2a1ef5</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:53:31+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-cd191e4e-a5a1-4009-93b7-92cc6a3d6984" timestamp="2016-11-08T16:47:54+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: f25466e4820404c817eaf75818b7177891735886 (MISP Attribute #443)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: f25466e4820404c817eaf75818b7177891735886 (MISP Attribute #443)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-cd191e4e-a5a1-4009-93b7-92cc6a3d6984">
<cybox:Object id=":File-cd191e4e-a5a1-4009-93b7-92cc6a3d6984">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">f25466e4820404c817eaf75818b7177891735886</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:47:54+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-41c48554-6911-48eb-88a0-411dc4bd9047" timestamp="2016-11-08T16:53:39+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 1c3757006f972ca957d925accf8bbb3023550d1b (MISP Attribute #444)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 1c3757006f972ca957d925accf8bbb3023550d1b (MISP Attribute #444)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-41c48554-6911-48eb-88a0-411dc4bd9047">
<cybox:Object id=":File-41c48554-6911-48eb-88a0-411dc4bd9047">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">1c3757006f972ca957d925accf8bbb3023550d1b</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:53:39+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-70881ae4-3da1-409e-8bd3-7f508092a2c9" timestamp="2016-11-08T16:48:02+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f (MISP Attribute #445)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f (MISP Attribute #445)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-70881ae4-3da1-409e-8bd3-7f508092a2c9">
<cybox:Object id=":File-70881ae4-3da1-409e-8bd3-7f508092a2c9">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:48:02+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-19e97c58-4992-4f0b-8f49-6a6378a289eb" timestamp="2016-11-08T16:53:48+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be (MISP Attribute #446)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be (MISP Attribute #446)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-19e97c58-4992-4f0b-8f49-6a6378a289eb">
<cybox:Object id=":File-19e97c58-4992-4f0b-8f49-6a6378a289eb">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:53:48+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-582247d0-d7a0-49c3-a6ae-69fe8e96ca05" timestamp="2016-11-08T16:46:56+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: http://aax.me/a6faa (MISP Attribute #1356)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Payload delivery: http://aax.me/a6faa (MISP Attribute #1356)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-582247d0-d7a0-49c3-a6ae-69fe8e96ca05">
<cybox:Object id=":URI-582247d0-d7a0-49c3-a6ae-69fe8e96ca05">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://aax.me/a6faa</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:46:56+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-582247f6-eeec-47b0-b6d8-69fe8e96ca05" timestamp="2016-11-08T16:47:34+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate (MISP Attribute #1357)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Payload delivery: https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate (MISP Attribute #1357)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-582247f6-eeec-47b0-b6d8-69fe8e96ca05">
<cybox:Object id=":URI-582247f6-eeec-47b0-b6d8-69fe8e96ca05">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:47:34+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-6c1856f6-0068-4c83-8aba-9fd4bb4277a1" timestamp="2016-11-08T16:45:55+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: http://aax.me/d0dde (MISP Attribute #447)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Payload delivery: http://aax.me/d0dde (MISP Attribute #447)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-6c1856f6-0068-4c83-8aba-9fd4bb4277a1">
<cybox:Object id=":URI-6c1856f6-0068-4c83-8aba-9fd4bb4277a1">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://aax.me/d0dde</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2016-11-08T16:45:55+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
</incident:Related_Indicators>
<incident:History>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">Event Threat Level: Medium</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: TLP:GREEN</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: PUBLISHED</incident:Journal_Entry>
</incident:History_Item>
</incident:History>
<incident:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>citizenlab</stixCommon:Name>
</stixCommon:Identity>
<stixCommon:References>
<stixCommon:Reference>https://citizenlab.org/2016/05/stealth-falcon/</stixCommon:Reference>
</stixCommon:References>
</incident:Information_Source>
<incident:Handling>
<marking:Marking>
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
</marking:Marking>
</incident:Handling>
</stix:Incident>
</stix:Incidents>
</stix:Package>
</stix:Related_Package>
</stix:Related_Packages>
</stix:STIX_Package>

9
data/ioc/spyware/citizen_lab/201608_Group5/README.md Normal file
View File

@@ -0,0 +1,9 @@
## Group5 IOCs
This directory contains IOC from the Citizen Lab report ["Group5: Syria and the Iranian Connection"](https://citizenlab.org/2016/08/group5-syria/) published the 2nd of August 2016.
Files included in this directory:
* openioc.ioc : IOCs in OpenIOC format
* stix.xml : IOCs in STIX XML format
* iocs.csv : IOCs in csv format
* hashes.csv : list of hashes

18
data/ioc/spyware/citizen_lab/201608_Group5/hashes.csv Normal file
View File

@@ -0,0 +1,18 @@
File,MD5,VirusTotal (26-Jul-2016),First Sub. on VT
assadcrimes.ppsx,76F8142B4E52C671871B3DF87F10C30C,N/A,N/A
putty.exe [stage1 downloader],366908F6C5C4F4329478D60586ECA5BC,N/A,N/A
dvm.exe [stage 2 payload],7D898530D2E77F15F5BADCE8D7DF215E,N/A,N/A
Unpacked dvm.exe,A4F1F4921BB11FF9D22FAD89B19B155D,N/A,N/A
NanoCore RAT payload,DD5BEDD915967C5EFE00733CF7478CB4,N/A,N/A
assadcrimes1.ppsx,F1F84EA3229DCA0CCACB7381A2F49F99,N/A,N/A
dvm.exe,7D898530D2E77F15F5BADCE8D7DF215E,N/A,N/A
assadcrimes.info.ppsx,30BB678DB3AD0140FC33ACD9803385C3,N/A,N/A
putty.exe,5C4EC3D93A664E4BFA1CE6286CCF0249,N/A,N/A
Unpacked putty.exe,6161083021B695814434450C1882F9F3,N/A,N/A
njRAT payload,B4121C3A1892332402000EF0D587C0EE,N/A,N/A
alshohadaa alatfal.exe [decoy app],2FC276E1C06C3C78C6D7B66A141213BE,N/A,N/A
dvm.exe [dropped by decoy app],494BAB7FD0B42B0B14051ED9ABBD651F,14 / 55,2-Mar-2016
Unpacked dvm.exe,6161083021B695814434450C1882F9F3,N/A,N/A
njRAT payload,B4121C3A1892332402000EF0D587C0EE,N/A,N/A
Android Malicious APK (DroidJack),,,
adobe_flash_player.apk,8EBEB3F91CDA8E985A9C61BEB8CDDE9D,23 / 53,5-Jul-2016
1 File MD5 VirusTotal (26-Jul-2016) First Sub. on VT
2 assadcrimes.ppsx 76F8142B4E52C671871B3DF87F10C30C N/A N/A
3 putty.exe [stage1 downloader] 366908F6C5C4F4329478D60586ECA5BC N/A N/A
4 dvm.exe [stage 2 payload] 7D898530D2E77F15F5BADCE8D7DF215E N/A N/A
5 Unpacked dvm.exe A4F1F4921BB11FF9D22FAD89B19B155D N/A N/A
6 NanoCore RAT payload DD5BEDD915967C5EFE00733CF7478CB4 N/A N/A
7 assadcrimes1.ppsx F1F84EA3229DCA0CCACB7381A2F49F99 N/A N/A
8 dvm.exe 7D898530D2E77F15F5BADCE8D7DF215E N/A N/A
9 assadcrimes.info.ppsx 30BB678DB3AD0140FC33ACD9803385C3 N/A N/A
10 putty.exe 5C4EC3D93A664E4BFA1CE6286CCF0249 N/A N/A
11 Unpacked putty.exe 6161083021B695814434450C1882F9F3 N/A N/A
12 njRAT payload B4121C3A1892332402000EF0D587C0EE N/A N/A
13 alshohadaa alatfal.exe [decoy app] 2FC276E1C06C3C78C6D7B66A141213BE N/A N/A
14 dvm.exe [dropped by decoy app] 494BAB7FD0B42B0B14051ED9ABBD651F 14 / 55 2-Mar-2016
15 Unpacked dvm.exe 6161083021B695814434450C1882F9F3 N/A N/A
16 njRAT payload B4121C3A1892332402000EF0D587C0EE N/A N/A
17 Android Malicious APK (DroidJack)
18 adobe_flash_player.apk 8EBEB3F91CDA8E985A9C61BEB8CDDE9D 23 / 53 5-Jul-2016

22
data/ioc/spyware/citizen_lab/201608_Group5/iocs.csv Normal file
View File

@@ -0,0 +1,22 @@
uuid,event_id,category,type,value,comment,to_ids,date
3f6407bd-cfd7-4bb6-9338-34132bdc3c62,9,Network activity,ip-dst,"88.198.222.163","C2 for malware dropped",1,20161108
47690aa0-910d-478d-b0ea-fff1f40631ee,9,Payload delivery,md5,"8ebeb3f91cda8e985a9c61beb8cdde9d","adobe_flash_player.apk Droid Jack",1,20161108
4bf52b9f-f004-4793-a0ba-bf1e211c089d,9,Payload delivery,md5,"76f8142b4e52c671871b3df87f10c30c","Assadcrimes.ppsx",1,20161108
58223ba8-5da0-4111-8b1b-69fe8e96ca05,9,Payload delivery,email-src,"office@assadcrimes.info","email used for targeted phishing",1,20161108
58223cbc-ec7c-43f6-a95a-69fe8e96ca05,9,Network activity,domain,"assadcrimes.info","Fake activist website used as a watering hole",1,20161108
58223d3d-5864-453a-8c70-69fe8e96ca05,9,Payload delivery,vulnerability,"CVE-2014-4114","",0,20161108
58223dcd-63c0-45f1-9516-69fe8e96ca05,9,Payload type,text,"njRat","",0,20161108
58223dd5-ca58-4ad4-98d6-69fe8e96ca05,9,Payload type,text,"NanoCore RAT","",0,20161108
58223e40-64f4-47ca-b56b-69fe8e96ca05,9,Payload type,text,"DroidJack","",0,20161108
58223f8a-1820-476b-823c-497a8e96ca05,9,Network activity,ip-dst,"212.7.195.171","IP hosting assadcrimes.info website",0,20161108
588e5189-3408-4430-b4de-7f3a04c1107b,9,Payload delivery,md5,"a4f1f4921bb11ff9d22fad89b19b155d","Doc Dropper 1 Crypter",1,20161108
593c7165-8933-46ba-8b6b-36db6e65c1b3,9,External analysis,link,"https://citizenlab.org/2016/08/group5-syria/","",0,20161108
7aa1122f-33ee-422b-acae-8820e0664fdb,9,Payload delivery,md5,"7d898530d2e77f15f5badce8d7df215e","second stage executable, saved to disk as %temp%\dwm.exe",1,20161108
7af948f4-01b5-43f9-b9be-3746a9ce0fcf,9,Payload delivery,md5,"6161083021b695814434450c1882f9f3","Doc Dropper 3 Crypter",1,20161108
87004645-e8b6-4b7e-a79b-ca643e1446ec,9,Payload delivery,md5,"494bab7fd0b42b0b14051ed9abbd651f","dvm.exe [dropped by decoy app]",1,20161108
b02858c1-6bfb-4097-a00e-98182b0ec121,9,Payload delivery,md5,"b4121c3a1892332402000ef0d587c0ee","njRat binary",1,20161108
b98003bc-640e-442e-99ec-8ab90190bd4c,9,Payload delivery,md5,"366908f6c5c4f4329478d60586eca5bc","putty.exe [stage1 downloader]",0,20161108
dc028130-bdaf-462a-acd8-81f8ea0eec51,9,Payload delivery,md5,"f1f84ea3229dca0ccacb7381a2f49f99","Assadcrimes1.ppsx",1,20161108
dd6a607c-1ffb-4f02-bf84-3cc3292f66b7,9,Payload delivery,md5,"2fc276e1c06c3c78c6d7b66a141213be","alshohadaa alatfal.exe",1,20161108
e03c93a5-5b27-4242-8725-e82079d84a02,9,Payload delivery,md5,"30bb678db3ad0140fc33acd9803385c3","Assadcrimes.info.ppsx",1,20161108
e900b943-c875-4125-b4a7-f53de2620468,9,Payload delivery,md5,"dd5bedd915967c5efe00733cf7478cb4","",1,20161108
1 uuid event_id category type value comment to_ids date
2 3f6407bd-cfd7-4bb6-9338-34132bdc3c62 9 Network activity ip-dst 88.198.222.163 C2 for malware dropped 1 20161108
3 47690aa0-910d-478d-b0ea-fff1f40631ee 9 Payload delivery md5 8ebeb3f91cda8e985a9c61beb8cdde9d adobe_flash_player.apk Droid Jack 1 20161108
4 4bf52b9f-f004-4793-a0ba-bf1e211c089d 9 Payload delivery md5 76f8142b4e52c671871b3df87f10c30c Assadcrimes.ppsx 1 20161108
5 58223ba8-5da0-4111-8b1b-69fe8e96ca05 9 Payload delivery email-src office@assadcrimes.info email used for targeted phishing 1 20161108
6 58223cbc-ec7c-43f6-a95a-69fe8e96ca05 9 Network activity domain assadcrimes.info Fake activist website used as a watering hole 1 20161108
7 58223d3d-5864-453a-8c70-69fe8e96ca05 9 Payload delivery vulnerability CVE-2014-4114 0 20161108
8 58223dcd-63c0-45f1-9516-69fe8e96ca05 9 Payload type text njRat 0 20161108
9 58223dd5-ca58-4ad4-98d6-69fe8e96ca05 9 Payload type text NanoCore RAT 0 20161108
10 58223e40-64f4-47ca-b56b-69fe8e96ca05 9 Payload type text DroidJack 0 20161108
11 58223f8a-1820-476b-823c-497a8e96ca05 9 Network activity ip-dst 212.7.195.171 IP hosting assadcrimes.info website 0 20161108
12 588e5189-3408-4430-b4de-7f3a04c1107b 9 Payload delivery md5 a4f1f4921bb11ff9d22fad89b19b155d Doc Dropper 1 Crypter 1 20161108
13 593c7165-8933-46ba-8b6b-36db6e65c1b3 9 External analysis link https://citizenlab.org/2016/08/group5-syria/ 0 20161108
14 7aa1122f-33ee-422b-acae-8820e0664fdb 9 Payload delivery md5 7d898530d2e77f15f5badce8d7df215e second stage executable, saved to disk as %temp%\dwm.exe 1 20161108
15 7af948f4-01b5-43f9-b9be-3746a9ce0fcf 9 Payload delivery md5 6161083021b695814434450c1882f9f3 Doc Dropper 3 Crypter 1 20161108
16 87004645-e8b6-4b7e-a79b-ca643e1446ec 9 Payload delivery md5 494bab7fd0b42b0b14051ed9abbd651f dvm.exe [dropped by decoy app] 1 20161108
17 b02858c1-6bfb-4097-a00e-98182b0ec121 9 Payload delivery md5 b4121c3a1892332402000ef0d587c0ee njRat binary 1 20161108
18 b98003bc-640e-442e-99ec-8ab90190bd4c 9 Payload delivery md5 366908f6c5c4f4329478d60586eca5bc putty.exe [stage1 downloader] 0 20161108
19 dc028130-bdaf-462a-acd8-81f8ea0eec51 9 Payload delivery md5 f1f84ea3229dca0ccacb7381a2f49f99 Assadcrimes1.ppsx 1 20161108
20 dd6a607c-1ffb-4f02-bf84-3cc3292f66b7 9 Payload delivery md5 2fc276e1c06c3c78c6d7b66a141213be alshohadaa alatfal.exe 1 20161108
21 e03c93a5-5b27-4242-8725-e82079d84a02 9 Payload delivery md5 30bb678db3ad0140fc33acd9803385c3 Assadcrimes.info.ppsx 1 20161108
22 e900b943-c875-4125-b4a7-f53de2620468 9 Payload delivery md5 dd5bedd915967c5efe00733cf7478cb4 1 20161108

69
data/ioc/spyware/citizen_lab/201608_Group5/openioc.ioc Normal file
View File

@@ -0,0 +1,69 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581c0e7b-7ec8-40ad-b52a-49798e96ca05" last-modified="2016-08-02T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #9</short_description>
<description>Group5: Syria and the Iranian Connection</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2016-08-02T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="581c0e7b-7ec8-40ad-b52a-49798e96ca05">
<IndicatorItem id="assadcrimes.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="88.198.222.163" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="office@assadcrimes.info" condition="is">
<Context document="Email" search="Email/From" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="7d898530d2e77f15f5badce8d7df215e" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="a4f1f4921bb11ff9d22fad89b19b155d" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="dd5bedd915967c5efe00733cf7478cb4" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="f1f84ea3229dca0ccacb7381a2f49f99" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="30bb678db3ad0140fc33acd9803385c3" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="6161083021b695814434450c1882f9f3" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="b4121c3a1892332402000ef0d587c0ee" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="2fc276e1c06c3c78c6d7b66a141213be" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="494bab7fd0b42b0b14051ed9abbd651f" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="8ebeb3f91cda8e985a9c61beb8cdde9d" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="76f8142b4e52c671871b3df87f10c30c" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

776
data/ioc/spyware/citizen_lab/201608_Group5/stix.xml Normal file
View File

@@ -0,0 +1,776 @@
<stix:STIX_Package
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
xmlns:marking="http://data-marking.mitre.org/Marking-1"
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:indicator="http://stix.mitre.org/Indicator-2"
xmlns:ttp="http://stix.mitre.org/TTP-1"
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:="https://rufus.citlab.utoronto.ca"
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
xsi:schemaLocation="
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-2e541d2a-b044-433a-b2fd-9be56b16a6ea" version="1.1.1" timestamp="2016-11-08T21:13:59.714482+00:00">
<stix:STIX_Header>
<stix:Title>Export from MISP</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Related_Packages>
<stix:Related_Package>
<stix:Package id=":STIXPackage-581c0e7b-7ec8-40ad-b52a-49798e96ca05" version="1.1.1" timestamp="2016-11-08T16:13:14+00:00">
<stix:STIX_Header>
<stix:Title>Group5: Syria and the Iranian Connection (MISP Event #9)</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:TTPs>
<stix:TTP id=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'>
<ttp:Title>Payload delivery: CVE-2014-4114 (MISP Attribute #1345)</ttp:Title>
<ttp:Exploit_Targets>
<ttp:Exploit_Target>
<stixCommon:Exploit_Target id=":et-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='et:ExploitTargetType'>
<et:Title>Vulnerability CVE-2014-4114</et:Title>
<et:Vulnerability>
<et:CVE_ID>CVE-2014-4114</et:CVE_ID>
</et:Vulnerability>
</stixCommon:Exploit_Target>
</ttp:Exploit_Target>
</ttp:Exploit_Targets>
</stix:TTP>
<stix:TTP id=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'>
<ttp:Title>Payload type: njRat (MISP Attribute #1346)</ttp:Title>
<ttp:Behavior>
<ttp:Malware>
<ttp:Malware_Instance>
<ttp:Name>njRat</ttp:Name>
</ttp:Malware_Instance>
</ttp:Malware>
</ttp:Behavior>
</stix:TTP>
<stix:TTP id=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'>
<ttp:Title>Payload type: NanoCore RAT (MISP Attribute #1347)</ttp:Title>
<ttp:Behavior>
<ttp:Malware>
<ttp:Malware_Instance>
<ttp:Name>NanoCore RAT</ttp:Name>
</ttp:Malware_Instance>
</ttp:Malware>
</ttp:Behavior>
</stix:TTP>
<stix:TTP id=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'>
<ttp:Title>Payload type: DroidJack (MISP Attribute #1348)</ttp:Title>
<ttp:Behavior>
<ttp:Malware>
<ttp:Malware_Instance>
<ttp:Name>DroidJack</ttp:Name>
</ttp:Malware_Instance>
</ttp:Malware>
</ttp:Behavior>
</stix:TTP>
</stix:TTPs>
<stix:Incidents>
<stix:Incident id=":incident-581c0e7b-7ec8-40ad-b52a-49798e96ca05" timestamp="2016-11-08T16:13:31+00:00" xsi:type='incident:IncidentType'>
<incident:Title>Group5: Syria and the Iranian Connection</incident:Title>
<incident:External_ID source="MISP Event">9</incident:External_ID>
<incident:Time>
<incident:Incident_Discovery precision="second">2016-08-02T00:00:00+00:00</incident:Incident_Discovery>
<incident:Incident_Reported precision="second">2016-11-08T16:13:31+00:00</incident:Incident_Reported>
</incident:Time>
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
<incident:Related_Indicators>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-58223cbc-ec7c-43f6-a95a-69fe8e96ca05" timestamp="2016-11-08T15:59:40+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: assadcrimes.info (MISP Attribute #1344)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: assadcrimes.info (MISP Attribute #1344)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-58223cbc-ec7c-43f6-a95a-69fe8e96ca05">
<cybox:Object id=":DomainName-58223cbc-ec7c-43f6-a95a-69fe8e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">assadcrimes.info</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T15:59:40+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-58223f8a-1820-476b-823c-497a8e96ca05" timestamp="2016-11-08T16:11:38+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 212.7.195.171 (MISP Attribute #1349)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 212.7.195.171 (MISP Attribute #1349)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-58223f8a-1820-476b-823c-497a8e96ca05">
<cybox:Object id=":Address-58223f8a-1820-476b-823c-497a8e96ca05">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">212.7.195.171</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:11:38+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-3f6407bd-cfd7-4bb6-9338-34132bdc3c62" timestamp="2016-11-08T16:06:52+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 88.198.222.163 (MISP Attribute #449)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 88.198.222.163 (MISP Attribute #449)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-3f6407bd-cfd7-4bb6-9338-34132bdc3c62">
<cybox:Object id=":Address-3f6407bd-cfd7-4bb6-9338-34132bdc3c62">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">88.198.222.163</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:06:52+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-58223ba8-5da0-4111-8b1b-69fe8e96ca05" timestamp="2016-11-08T15:55:04+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: office@assadcrimes.info (MISP Attribute #1343)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
<indicator:Description>Payload delivery: office@assadcrimes.info (MISP Attribute #1343)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-58223ba8-5da0-4111-8b1b-69fe8e96ca05">
<cybox:Object id=":EmailMessage-58223ba8-5da0-4111-8b1b-69fe8e96ca05">
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
<EmailMessageObj:Header>
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
<AddressObj:Address_Value condition="Equals">office@assadcrimes.info</AddressObj:Address_Value>
</EmailMessageObj:From>
</EmailMessageObj:Header>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T15:55:04+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-b98003bc-640e-442e-99ec-8ab90190bd4c" timestamp="2016-11-08T16:12:52+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 366908f6c5c4f4329478d60586eca5bc (MISP Attribute #450)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 366908f6c5c4f4329478d60586eca5bc (MISP Attribute #450)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-b98003bc-640e-442e-99ec-8ab90190bd4c">
<cybox:Object id=":File-b98003bc-640e-442e-99ec-8ab90190bd4c">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">366908f6c5c4f4329478d60586eca5bc</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:12:52+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-7aa1122f-33ee-422b-acae-8820e0664fdb" timestamp="2016-11-08T16:08:53+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 7d898530d2e77f15f5badce8d7df215e (MISP Attribute #451)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 7d898530d2e77f15f5badce8d7df215e (MISP Attribute #451)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-7aa1122f-33ee-422b-acae-8820e0664fdb">
<cybox:Object id=":File-7aa1122f-33ee-422b-acae-8820e0664fdb">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">7d898530d2e77f15f5badce8d7df215e</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:08:53+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-588e5189-3408-4430-b4de-7f3a04c1107b" timestamp="2016-11-08T16:07:21+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: a4f1f4921bb11ff9d22fad89b19b155d (MISP Attribute #452)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: a4f1f4921bb11ff9d22fad89b19b155d (MISP Attribute #452)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-588e5189-3408-4430-b4de-7f3a04c1107b">
<cybox:Object id=":File-588e5189-3408-4430-b4de-7f3a04c1107b">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">a4f1f4921bb11ff9d22fad89b19b155d</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:07:21+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-e900b943-c875-4125-b4a7-f53de2620468" timestamp="2016-11-08T16:09:49+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: dd5bedd915967c5efe00733cf7478cb4 (MISP Attribute #453)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: dd5bedd915967c5efe00733cf7478cb4 (MISP Attribute #453)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-e900b943-c875-4125-b4a7-f53de2620468">
<cybox:Object id=":File-e900b943-c875-4125-b4a7-f53de2620468">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">dd5bedd915967c5efe00733cf7478cb4</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:09:49+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-dc028130-bdaf-462a-acd8-81f8ea0eec51" timestamp="2016-11-08T15:56:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: f1f84ea3229dca0ccacb7381a2f49f99 (MISP Attribute #454)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: f1f84ea3229dca0ccacb7381a2f49f99 (MISP Attribute #454)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-dc028130-bdaf-462a-acd8-81f8ea0eec51">
<cybox:Object id=":File-dc028130-bdaf-462a-acd8-81f8ea0eec51">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">f1f84ea3229dca0ccacb7381a2f49f99</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T15:56:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-e03c93a5-5b27-4242-8725-e82079d84a02" timestamp="2016-11-08T16:01:01+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 30bb678db3ad0140fc33acd9803385c3 (MISP Attribute #455)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 30bb678db3ad0140fc33acd9803385c3 (MISP Attribute #455)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-e03c93a5-5b27-4242-8725-e82079d84a02">
<cybox:Object id=":File-e03c93a5-5b27-4242-8725-e82079d84a02">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">30bb678db3ad0140fc33acd9803385c3</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:01:01+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-7af948f4-01b5-43f9-b9be-3746a9ce0fcf" timestamp="2016-11-08T16:07:32+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 6161083021b695814434450c1882f9f3 (MISP Attribute #457)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 6161083021b695814434450c1882f9f3 (MISP Attribute #457)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-7af948f4-01b5-43f9-b9be-3746a9ce0fcf">
<cybox:Object id=":File-7af948f4-01b5-43f9-b9be-3746a9ce0fcf">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">6161083021b695814434450c1882f9f3</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:07:32+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-b02858c1-6bfb-4097-a00e-98182b0ec121" timestamp="2016-11-08T16:10:47+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: b4121c3a1892332402000ef0d587c0ee (MISP Attribute #458)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: b4121c3a1892332402000ef0d587c0ee (MISP Attribute #458)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-b02858c1-6bfb-4097-a00e-98182b0ec121">
<cybox:Object id=":File-b02858c1-6bfb-4097-a00e-98182b0ec121">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">b4121c3a1892332402000ef0d587c0ee</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:10:47+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-dd6a607c-1ffb-4f02-bf84-3cc3292f66b7" timestamp="2016-11-08T16:01:21+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 2fc276e1c06c3c78c6d7b66a141213be (MISP Attribute #459)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 2fc276e1c06c3c78c6d7b66a141213be (MISP Attribute #459)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-dd6a607c-1ffb-4f02-bf84-3cc3292f66b7">
<cybox:Object id=":File-dd6a607c-1ffb-4f02-bf84-3cc3292f66b7">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">2fc276e1c06c3c78c6d7b66a141213be</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:01:21+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-87004645-e8b6-4b7e-a79b-ca643e1446ec" timestamp="2016-11-08T16:13:14+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 494bab7fd0b42b0b14051ed9abbd651f (MISP Attribute #460)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 494bab7fd0b42b0b14051ed9abbd651f (MISP Attribute #460)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-87004645-e8b6-4b7e-a79b-ca643e1446ec">
<cybox:Object id=":File-87004645-e8b6-4b7e-a79b-ca643e1446ec">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">494bab7fd0b42b0b14051ed9abbd651f</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:13:14+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-47690aa0-910d-478d-b0ea-fff1f40631ee" timestamp="2016-11-08T16:12:00+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 8ebeb3f91cda8e985a9c61beb8cdde9d (MISP Attribute #461)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 8ebeb3f91cda8e985a9c61beb8cdde9d (MISP Attribute #461)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-47690aa0-910d-478d-b0ea-fff1f40631ee">
<cybox:Object id=":File-47690aa0-910d-478d-b0ea-fff1f40631ee">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">8ebeb3f91cda8e985a9c61beb8cdde9d</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T16:12:00+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-4bf52b9f-f004-4793-a0ba-bf1e211c089d" timestamp="2016-11-08T15:55:56+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: 76f8142b4e52c671871b3df87f10c30c (MISP Attribute #462)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
<indicator:Description>Payload delivery: 76f8142b4e52c671871b3df87f10c30c (MISP Attribute #462)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-4bf52b9f-f004-4793-a0ba-bf1e211c089d">
<cybox:Object id=":File-4bf52b9f-f004-4793-a0ba-bf1e211c089d">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">76f8142b4e52c671871b3df87f10c30c</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Indicated_TTP>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</indicator:Indicated_TTP>
<indicator:Confidence timestamp="2016-11-08T15:55:56+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
</incident:Related_Indicators>
<incident:Leveraged_TTPs>
<incident:Leveraged_TTP>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:TTP idref=":ttp-58223d3d-5864-453a-8c70-69fe8e96ca05" timestamp="2016-11-08T16:01:49+00:00" xsi:type='ttp:TTPType'/>
</incident:Leveraged_TTP>
<incident:Leveraged_TTP>
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
<stixCommon:TTP idref=":ttp-58223dcd-63c0-45f1-9516-69fe8e96ca05" timestamp="2016-11-08T16:04:13+00:00" xsi:type='ttp:TTPType'/>
</incident:Leveraged_TTP>
<incident:Leveraged_TTP>
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
<stixCommon:TTP idref=":ttp-58223dd5-ca58-4ad4-98d6-69fe8e96ca05" timestamp="2016-11-08T16:04:21+00:00" xsi:type='ttp:TTPType'/>
</incident:Leveraged_TTP>
<incident:Leveraged_TTP>
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
<stixCommon:TTP idref=":ttp-58223e40-64f4-47ca-b56b-69fe8e96ca05" timestamp="2016-11-08T16:06:08+00:00" xsi:type='ttp:TTPType'/>
</incident:Leveraged_TTP>
</incident:Leveraged_TTPs>
<incident:History>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">Event Threat Level: Medium</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: TLP:GREEN</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: PUBLISHED</incident:Journal_Entry>
</incident:History_Item>
</incident:History>
<incident:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>citizenlab</stixCommon:Name>
</stixCommon:Identity>
<stixCommon:References>
<stixCommon:Reference>https://citizenlab.org/2016/08/group5-syria/</stixCommon:Reference>
</stixCommon:References>
</incident:Information_Source>
<incident:Handling>
<marking:Marking>
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
</marking:Marking>
</incident:Handling>
</stix:Incident>
</stix:Incidents>
</stix:Package>
</stix:Related_Package>
</stix:Related_Packages>
</stix:STIX_Package>

8
data/ioc/spyware/citizen_lab/201608_NSO_Group/README.md Normal file
View File

@@ -0,0 +1,8 @@
## NSO Group IOCs
This directory contains IOC from the Citizen Lab report ["The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender"](https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/) published the 24th of August 2016. More information about the Pegasus malware can be found ini [Lookout report](https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf).
Files included in this directory:
* openioc.ioc : IOCs in OpenIOC format
* stix.xml : IOCs in STIX XML format
* iocs.csv : IOCs in csv format

63
data/ioc/spyware/citizen_lab/201608_NSO_Group/iocs.csv Normal file
View File

@@ -0,0 +1,63 @@
uuid,event_id,category,type,value,comment,to_ids,date
029c89df-139e-463a-b1f1-c259b913d05f,10,Network activity,ip-dst,"52.8.153.44","IP linked to sms.webadv.co",1,20160824
0d1164d5-7670-41da-8857-1247d0b67561,10,Network activity,domain,"redcrossworld.com","",1,20160824
0f203872-71ec-4b51-ba56-c50918f71f39,10,Network activity,domain,"topcontactco.com","",1,20160824
126c3480-6ad3-417f-9855-4e915b9ae528,10,Network activity,domain,"kenyasms.org","",1,20160824
14df3986-e958-4612-ba2f-daa9fd95b868,10,Network activity,domain,"bahrainsms.co","",1,20160824
17a374eb-20d6-4790-bee4-45b7073115f1,10,Network activity,domain,"icrcworld.com","",1,20160824
208dbaaf-39c3-4930-8304-1c76e9b1e7b8,10,Network activity,ip-dst,"54.251.49.214","",1,20160824
252cc33c-8786-4dee-b77a-af52acb1661b,10,Network activity,domain,"alawaeltech.com","",1,20160824
27a5b383-3c23-4f93-9341-8dd8d90575f6,10,Network activity,ip-dst,"82.80.202.204","",1,20160824
2ad610a4-2177-4e7f-b525-8621a80e2ebe,10,Network activity,domain,"icloudcacher.com","",1,20160824
2f6d312b-8db7-4fa0-9522-cc68090b4a3b,10,Network activity,ip-dst,"52.8.52.166","IP behind aalaan.tv",1,20160824
325e4a00-7b2f-4c27-bff2-89f390e3c13c,10,Network activity,domain,"asrararabiya.co","",1,20160824
340ccd5a-2520-4ccb-abeb-b264fb2bf645,10,Network activity,domain,"mail1.nsogroup.com","",1,20160824
58222e62-1020-4d67-b83f-49798e96ca05,10,Payload delivery,url,"https://sms.webadv.co/3589003s/","link delivered by sms",1,20160824
58222e78-135c-434e-966e-49798e96ca05,10,Payload delivery,url,"https://sms.webadv.co/9573305s/","link delivered by sms",1,20160824
58223036-8d6c-4c3e-a427-497a8e96ca05,10,Network activity,domain,"alljazeera.co","",1,20160824
582230b8-049c-47ec-90e2-497a8e96ca05,10,Network activity,domain,"googleplay-store.com","",1,20160824
582230b8-0880-4c1c-a507-497a8e96ca05,10,Network activity,domain,"bulbazaur.com","",1,20160824
582230b8-0cf8-4c54-8e57-497a8e96ca05,10,Network activity,domain,"checkinonlinehere.com","",1,20160824
582230b8-2670-47d2-8389-497a8e96ca05,10,Network activity,domain,"univision.click","",1,20160824
582230b8-36e4-4843-93db-497a8e96ca05,10,Network activity,domain,"turkishairines.info","",1,20160824
582230b8-3754-42c7-af73-497a8e96ca05,10,Network activity,domain,"newtarrifs.net","",1,20160824
582230b8-6748-496e-a951-497a8e96ca05,10,Network activity,domain,"bbc-africa.com","",1,20160824
582230b8-7c38-47df-b3b1-497a8e96ca05,10,Network activity,domain,"fb-accounts.com","",1,20160824
582230b8-839c-4f04-949e-497a8e96ca05,10,Network activity,domain,"cnn-africa.co","",1,20160824
582230b8-8440-4d71-97b4-497a8e96ca05,10,Network activity,domain,"emiratesfoundation.net","",1,20160824
582230b8-8640-4db9-8cdf-497a8e96ca05,10,Network activity,domain,"mz-vodacom.info","",1,20160824
582230b8-93cc-4f2b-8ae4-497a8e96ca05,10,Network activity,domain,"iusacell-movil.com.mx","",1,20160824
582230b8-a9f4-4590-bb10-497a8e96ca05,10,Network activity,domain,"pickuchu.com","",1,20160824
582230b8-aa70-4ee9-8fad-497a8e96ca05,10,Network activity,domain,"y0utube.com.mx","",1,20160824
582230b8-c5ac-4743-862b-497a8e96ca05,10,Network activity,domain,"sabafon.info","",1,20160824
582230b8-ceec-4dcb-8c51-497a8e96ca05,10,Network activity,domain,"track-your-fedex-package.org","",1,20160824
582230b8-e524-449e-8e0c-497a8e96ca05,10,Network activity,domain,"accounts.mx","",1,20160824
582230b8-e9e0-4a50-b94c-497a8e96ca05,10,Network activity,domain,"unonoticias.net","",1,20160824
582230b8-ecc8-4bce-966d-497a8e96ca05,10,Network activity,domain,"adjust-local-settings.com","",1,20160824
582230b8-fbc0-42e5-b56c-497a8e96ca05,10,Network activity,domain,"whatsapp-app.com","",1,20160824
58223264-6050-4883-8676-497a8e96ca05,10,Network activity,domain,"damanhealth.online","",1,20160824
5822327c-2050-46cb-b310-497a8e96ca05,10,Network activity,domain,"uaenews.online","",1,20160824
58223346-c23c-4751-9d82-69fe8e96ca05,10,Payload delivery,url,"http://fb-accounts.com/2408931s/","",1,20160824
58223375-b860-4462-9d5a-49798e96ca05,10,Payload delivery,url,"http://unonoticias.net/1867745s/","",1,20160824
582233be-b3c8-4238-82b5-49798e96ca05,10,Payload delivery,url,"https://ideas-telcel.com.mx/3975827s/","",1,20160824
582233c5-8108-41eb-ba12-49798e96ca05,10,Network activity,domain,"ideas-telcel.com.mx","",1,20160824
58223592-ad84-44d5-9e29-49798e96ca05,10,Payload delivery,url,"nation-news.com/4077017s/","",1,20160824
582235a0-ea0c-4301-b87b-49798e96ca05,10,Network activity,domain,"nation-news.com","",1,20160824
6540311c-8872-47a3-ada2-24757eaa35ee,10,Network activity,domain,"turkeynewsupdates.com","",1,20160824
73293a7a-acd5-47a0-81b6-a73f6dde67e1,10,Payload delivery,domain,"manoraonline.net","NSO anonymizer relay",1,20160824
7d63d6cb-90dc-454c-a505-a313150c1426,10,Network activity,domain,"qaintqa.com","",1,20160824
7db51886-46b4-496f-86fd-6b75a7b5f8c8,10,Network activity,ip-dst,"82.80.202.200","",1,20160824
7dd57279-a151-44d4-a21d-bb62ee3435aa,10,Payload delivery,url,"http://fb-accounts.com/1074139s/","",1,20160824
812c4cbf-60a7-431d-ae7a-a9fd1d6044aa,10,Network activity,domain,"nsoqa.com","",1,20160824
96bd845b-b8a7-4c91-92e1-c9060cc01239,10,Network activity,url,"https://smser.net/9918216t/","",1,20160824
9a804548-73c4-4258-9b88-51f952f75d17,10,Network activity,domain,"asrararablya.com","",1,20160824
9be3a48f-e540-43f8-a2c0-8dc915a3dd48,10,Network activity,domain,"ooredoodeals.com","",1,20160824
9c494d42-797d-4c62-978a-8a888fb179c8,10,Network activity,domain,"asrarrarabiya.com","",1,20160824
a2f8ef48-d6f7-46b1-9ee0-71fcb1c65cb9,10,Network activity,domain,"thainews.asia","",1,20160824
c9181cb8-1400-47e1-b45b-fc4d17cebe52,10,Network activity,url,"https://smser.net/redirect.aspx","",1,20160824
ca1121b7-d273-4aac-83e8-e69b4bce5604,10,Payload delivery,domain,"sms.webadv.co","",1,20160824
cb442bf4-0d18-4d60-b1a7-e0fe5c7614fa,10,Network activity,ip-dst,"162.209.103.68","IP behind manoraonline.net",1,20160824
cd9ef05f-b3ea-41c2-a750-a431f9dfb508,10,Network activity,domain,"smser.net","",1,20160824
cdde7699-d231-458d-80a5-338b9e985702,10,Payload delivery,domain,"aalaan.tv","NSO anonymizer relay",1,20160824
eed4deb8-c8a8-4722-8e29-8ba5772e3059,10,Payload delivery,url,"http://unonoticias.net/3423768s/","",1,20160824
f13b8f95-e6ca-47a8-8c25-fe1f4817a439,10,Network activity,domain,"webadv.co","",1,20160824
1 uuid event_id category type value comment to_ids date
2 029c89df-139e-463a-b1f1-c259b913d05f 10 Network activity ip-dst 52.8.153.44 IP linked to sms.webadv.co 1 20160824
3 0d1164d5-7670-41da-8857-1247d0b67561 10 Network activity domain redcrossworld.com 1 20160824
4 0f203872-71ec-4b51-ba56-c50918f71f39 10 Network activity domain topcontactco.com 1 20160824
5 126c3480-6ad3-417f-9855-4e915b9ae528 10 Network activity domain kenyasms.org 1 20160824
6 14df3986-e958-4612-ba2f-daa9fd95b868 10 Network activity domain bahrainsms.co 1 20160824
7 17a374eb-20d6-4790-bee4-45b7073115f1 10 Network activity domain icrcworld.com 1 20160824
8 208dbaaf-39c3-4930-8304-1c76e9b1e7b8 10 Network activity ip-dst 54.251.49.214 1 20160824
9 252cc33c-8786-4dee-b77a-af52acb1661b 10 Network activity domain alawaeltech.com 1 20160824
10 27a5b383-3c23-4f93-9341-8dd8d90575f6 10 Network activity ip-dst 82.80.202.204 1 20160824
11 2ad610a4-2177-4e7f-b525-8621a80e2ebe 10 Network activity domain icloudcacher.com 1 20160824
12 2f6d312b-8db7-4fa0-9522-cc68090b4a3b 10 Network activity ip-dst 52.8.52.166 IP behind aalaan.tv 1 20160824
13 325e4a00-7b2f-4c27-bff2-89f390e3c13c 10 Network activity domain asrararabiya.co 1 20160824
14 340ccd5a-2520-4ccb-abeb-b264fb2bf645 10 Network activity domain mail1.nsogroup.com 1 20160824
15 58222e62-1020-4d67-b83f-49798e96ca05 10 Payload delivery url https://sms.webadv.co/3589003s/ link delivered by sms 1 20160824
16 58222e78-135c-434e-966e-49798e96ca05 10 Payload delivery url https://sms.webadv.co/9573305s/ link delivered by sms 1 20160824
17 58223036-8d6c-4c3e-a427-497a8e96ca05 10 Network activity domain alljazeera.co 1 20160824
18 582230b8-049c-47ec-90e2-497a8e96ca05 10 Network activity domain googleplay-store.com 1 20160824
19 582230b8-0880-4c1c-a507-497a8e96ca05 10 Network activity domain bulbazaur.com 1 20160824
20 582230b8-0cf8-4c54-8e57-497a8e96ca05 10 Network activity domain checkinonlinehere.com 1 20160824
21 582230b8-2670-47d2-8389-497a8e96ca05 10 Network activity domain univision.click 1 20160824
22 582230b8-36e4-4843-93db-497a8e96ca05 10 Network activity domain turkishairines.info 1 20160824
23 582230b8-3754-42c7-af73-497a8e96ca05 10 Network activity domain newtarrifs.net 1 20160824
24 582230b8-6748-496e-a951-497a8e96ca05 10 Network activity domain bbc-africa.com 1 20160824
25 582230b8-7c38-47df-b3b1-497a8e96ca05 10 Network activity domain fb-accounts.com 1 20160824
26 582230b8-839c-4f04-949e-497a8e96ca05 10 Network activity domain cnn-africa.co 1 20160824
27 582230b8-8440-4d71-97b4-497a8e96ca05 10 Network activity domain emiratesfoundation.net 1 20160824
28 582230b8-8640-4db9-8cdf-497a8e96ca05 10 Network activity domain mz-vodacom.info 1 20160824
29 582230b8-93cc-4f2b-8ae4-497a8e96ca05 10 Network activity domain iusacell-movil.com.mx 1 20160824
30 582230b8-a9f4-4590-bb10-497a8e96ca05 10 Network activity domain pickuchu.com 1 20160824
31 582230b8-aa70-4ee9-8fad-497a8e96ca05 10 Network activity domain y0utube.com.mx 1 20160824
32 582230b8-c5ac-4743-862b-497a8e96ca05 10 Network activity domain sabafon.info 1 20160824
33 582230b8-ceec-4dcb-8c51-497a8e96ca05 10 Network activity domain track-your-fedex-package.org 1 20160824
34 582230b8-e524-449e-8e0c-497a8e96ca05 10 Network activity domain accounts.mx 1 20160824
35 582230b8-e9e0-4a50-b94c-497a8e96ca05 10 Network activity domain unonoticias.net 1 20160824
36 582230b8-ecc8-4bce-966d-497a8e96ca05 10 Network activity domain adjust-local-settings.com 1 20160824
37 582230b8-fbc0-42e5-b56c-497a8e96ca05 10 Network activity domain whatsapp-app.com 1 20160824
38 58223264-6050-4883-8676-497a8e96ca05 10 Network activity domain damanhealth.online 1 20160824
39 5822327c-2050-46cb-b310-497a8e96ca05 10 Network activity domain uaenews.online 1 20160824
40 58223346-c23c-4751-9d82-69fe8e96ca05 10 Payload delivery url http://fb-accounts.com/2408931s/ 1 20160824
41 58223375-b860-4462-9d5a-49798e96ca05 10 Payload delivery url http://unonoticias.net/1867745s/ 1 20160824
42 582233be-b3c8-4238-82b5-49798e96ca05 10 Payload delivery url https://ideas-telcel.com.mx/3975827s/ 1 20160824
43 582233c5-8108-41eb-ba12-49798e96ca05 10 Network activity domain ideas-telcel.com.mx 1 20160824
44 58223592-ad84-44d5-9e29-49798e96ca05 10 Payload delivery url nation-news.com/4077017s/ 1 20160824
45 582235a0-ea0c-4301-b87b-49798e96ca05 10 Network activity domain nation-news.com 1 20160824
46 6540311c-8872-47a3-ada2-24757eaa35ee 10 Network activity domain turkeynewsupdates.com 1 20160824
47 73293a7a-acd5-47a0-81b6-a73f6dde67e1 10 Payload delivery domain manoraonline.net NSO anonymizer relay 1 20160824
48 7d63d6cb-90dc-454c-a505-a313150c1426 10 Network activity domain qaintqa.com 1 20160824
49 7db51886-46b4-496f-86fd-6b75a7b5f8c8 10 Network activity ip-dst 82.80.202.200 1 20160824
50 7dd57279-a151-44d4-a21d-bb62ee3435aa 10 Payload delivery url http://fb-accounts.com/1074139s/ 1 20160824
51 812c4cbf-60a7-431d-ae7a-a9fd1d6044aa 10 Network activity domain nsoqa.com 1 20160824
52 96bd845b-b8a7-4c91-92e1-c9060cc01239 10 Network activity url https://smser.net/9918216t/ 1 20160824
53 9a804548-73c4-4258-9b88-51f952f75d17 10 Network activity domain asrararablya.com 1 20160824
54 9be3a48f-e540-43f8-a2c0-8dc915a3dd48 10 Network activity domain ooredoodeals.com 1 20160824
55 9c494d42-797d-4c62-978a-8a888fb179c8 10 Network activity domain asrarrarabiya.com 1 20160824
56 a2f8ef48-d6f7-46b1-9ee0-71fcb1c65cb9 10 Network activity domain thainews.asia 1 20160824
57 c9181cb8-1400-47e1-b45b-fc4d17cebe52 10 Network activity url https://smser.net/redirect.aspx 1 20160824
58 ca1121b7-d273-4aac-83e8-e69b4bce5604 10 Payload delivery domain sms.webadv.co 1 20160824
59 cb442bf4-0d18-4d60-b1a7-e0fe5c7614fa 10 Network activity ip-dst 162.209.103.68 IP behind manoraonline.net 1 20160824
60 cd9ef05f-b3ea-41c2-a750-a431f9dfb508 10 Network activity domain smser.net 1 20160824
61 cdde7699-d231-458d-80a5-338b9e985702 10 Payload delivery domain aalaan.tv NSO anonymizer relay 1 20160824
62 eed4deb8-c8a8-4722-8e29-8ba5772e3059 10 Payload delivery url http://unonoticias.net/3423768s/ 1 20160824
63 f13b8f95-e6ca-47a8-8c25-fe1f4817a439 10 Network activity domain webadv.co 1 20160824

261
data/ioc/spyware/citizen_lab/201608_NSO_Group/openioc.ioc Normal file
View File

@@ -0,0 +1,261 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581c1022-5c68-4617-9ea4-497a8e96ca05" last-modified="2016-08-24T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #10</short_description>
<description>The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2016-08-24T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="581c1022-5c68-4617-9ea4-497a8e96ca05">
<IndicatorItem id="alljazeera.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="bbc-africa.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="cnn-africa.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="unonoticias.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="univision.click" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="track-your-fedex-package.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mz-vodacom.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="iusacell-movil.com.mx" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="sabafon.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="newtarrifs.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="y0utube.com.mx" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fb-accounts.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googleplay-store.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="whatsapp-app.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="accounts.mx" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="adjust-local-settings.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="emiratesfoundation.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="checkinonlinehere.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="turkishairines.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="bulbazaur.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="pickuchu.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="damanhealth.online" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="uaenews.online" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ideas-telcel.com.mx" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="nation-news.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="webadv.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="icloudcacher.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="asrarrarabiya.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="asrararabiya.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="asrararablya.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="smser.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="icrcworld.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="redcrossworld.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="topcontactco.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="thainews.asia" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="kenyasms.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="qaintqa.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="nsoqa.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ooredoodeals.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="alawaeltech.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="bahrainsms.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="turkeynewsupdates.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mail1.nsogroup.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="52.8.153.44" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="52.8.52.166" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="162.209.103.68" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="82.80.202.200" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="82.80.202.204" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="54.251.49.214" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="https://smser.net/9918216t/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smser.net/redirect.aspx" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="aalaan.tv" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="manoraonline.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="sms.webadv.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://sms.webadv.co/3589003s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://sms.webadv.co/9573305s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://fb-accounts.com/2408931s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://unonoticias.net/1867745s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://ideas-telcel.com.mx/3975827s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="nation-news.com/4077017s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://fb-accounts.com/1074139s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://unonoticias.net/3423768s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

2302
data/ioc/spyware/citizen_lab/201608_NSO_Group/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff

94
data/ioc/spyware/citizen_lab/201611_KeyBoy/README.md Normal file
View File

@@ -0,0 +1,94 @@
## KeyBoy IOCs
This directory contains IOCs from the Citizen Lab report [It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community](https://citizenlab.org/2016/11/parliament-keyboy/) published the 17th of November 2016.
Files included in this directory:
* openioc.ioc : IOCs in OpenIOC format
* stix.xml : IOCs in STIX XML format
* iocs.csv : IOCs in csv format
* keyboy.yar : Yara rules related to the KeyBoy samples identified
* kb_c2Decode.py : script to decode KeyBoy C2 communications (see help hereafter)
* kb_configDecode.py : script to decode KeyBoy configuration (see help hereafter)
### kb_c2Decode.py
Help:
```bash
$ python kb_c2Decode.py -h
usage: kb_c2Decode.py [-h] (-k KEY | -b BINARY) [--verbose] PCAPF
Decode KeyBoy C2 traffic from pcap file
positional arguments:
PCAPF PCAP File containing c2 traffic
optional arguments:
-h, --help show this help message and exit
-k KEY, --key KEY Manually provide C2 decode key
-b BINARY, --binary BINARY
KeyBoy binary
--verbose, -v Enable verbose output
```
Example:
```
$ python kb_c2Decode.py -b wab32res.dll dump.pcap
============================
{KeyBoy C2 Traffic decoder}
============================
Found constant: 0x71
Computing decode value...
Found decoding multiplier (inverse): 0x91
Searching PCAP for RAW TCP packets and decoding...
*a*
HOME-PC
192.168.100.103
MyUser
2016/06/03 00:24:20
20151108
```
### kb_configDecode.py
Help:
```
$ python kb_configDecode.py -h
usage: kb_configDecode.py [-h] [--verbose] [--skip SKIP] FILE
Decode KeyBoy backdoor configuration files
positional arguments:
FILE KeyBoy encoded config file
optional arguments:
-h, --help show this help message and exit
--verbose, -v Enable verbose output
--skip SKIP, -s SKIP Skip over <SKIP> bytes at beginning of file
```
Example:
```
$ python kb_configDecode.py cfs.dat
============================
{KeyBoy Config file Decoder}
============================
Configuration Data:
==============================
Identity Code: 9876543210
C2 Host/IP #1: 103.242.134.243
C2 Host/IP #2: 103.242.134.243
C2 Host/IP #3: 103.242.134.243
C2 Port #1: 443
C2 Port #2: 1234
C2 Port #3: 1234
Password: password8888
Campaign ID: MyUser
```

270
data/ioc/spyware/citizen_lab/201611_KeyBoy/iocs.csv Normal file
View File

@@ -0,0 +1,270 @@
uuid,event_id,category,type,value,comment,to_ids,date
5820ab7b-5a8c-4164-8113-49798e96ca05,17,Artifacts dropped,md5,"495adb1b9777002ecfe22aaf52fcee93","Wab32res.dll payload, KeyBoy 20160509",1,20161107
5820ab93-8b90-4f61-8591-497a8e96ca05,17,Network activity,ip-dst,"103.40.102.233","C2 IP",1,20161116
5820ab93-ca00-4627-a8e9-497a8e96ca05,17,Network activity,ip-dst,"45.125.12.147","C2 IP",1,20161110
5820aba7-e398-41cb-939b-49798e96ca05,17,Network activity,domain,"tibetvoices.com","domain linked to one of the C2 IPs",1,20161107
5820abec-8b88-4398-ba31-497a8e96ca05,17,Network activity,ip-dst,"116.193.154.69","C2 IP",1,20161107
5820ac1b-05c0-4d60-8fc5-497a8e96ca05,17,Artifacts dropped,md5,"0c7e55509e0b6d4277b3facf864af018","Payload KeyBoy P_20150313",1,20161107
5820ac33-586c-4674-b96d-49798e96ca05,17,Network activity,domain,"www.eleven.mypop3.org","C2 domains",1,20161116
5820ac33-aa80-4d97-99a2-49798e96ca05,17,Network activity,domain,"www.about.jkub.com","C2 domains",1,20161107
5820ac34-dfc4-4772-8fb6-49798e96ca05,17,Network activity,domain,"www.backus.myftp.name","C2 domains",1,20161116
5820ac71-ff98-486d-b2e6-49798e96ca05,17,Artifacts dropped,md5,"98977426d544bd145979f65f0322ae30","Payload KeyBoy 20151108",1,20161107
5820ac98-f508-4869-9701-497a8e96ca05,17,Network activity,ip-dst,"103.242.134.243","C2 IP",1,20161116
5820ad1d-5d34-489f-97b8-497a8e96ca05,17,Network activity,ip-dst,"157.7.84.81","IPs for C2 Host: www.about.jkub[.]com",1,20161107
5820ad1d-a7c0-4f84-9d29-497a8e96ca05,17,Network activity,ip-dst,"45.32.47.148","IPs for C2 Host: www.about.jkub[.]com",1,20161107
5820ad50-de2c-4f26-bd5c-497a8e96ca05,17,Network activity,ip-dst,"192.241.149.43","IP behind C2 Host: www.backus.myftp[.]name",1,20161107
5820ad9c-c3c4-455e-a5f2-497a8e96ca05,17,Artifacts dropped,md5,"c5b5f01ba24d6c02636388809f44472e","Payload KeyBoy 20151108",1,20161107
5820adb2-5520-499c-95d3-49798e96ca05,17,Artifacts dropped,md5,"371bc132499f455f06fa80696db0df27","64b KeyBoy payload 20151108",1,20161107
5820ae20-ebec-43d6-9f95-497a8e96ca05,17,Artifacts dropped,yara,"import ""pe""
rule new_keyboy_export
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the new 2016 sample's export""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
//The malware family seems to share many exports
//but this is the new kid on the block.
pe.exports(""cfsUpdate"")
}","",1,20161107
5820ae49-9114-4d4d-b043-49798e96ca05,17,Artifacts dropped,yara,"rule new_keyboy_header_codes
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the 2016 sample's header codes""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
strings:
$s1 = ""*l*"" wide fullword
$s2 = ""*a*"" wide fullword
$s3 = ""*s*"" wide fullword
$s4 = ""*d*"" wide fullword
$s5 = ""*f*"" wide fullword
$s6 = ""*g*"" wide fullword
$s7 = ""*h*"" wide fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
all of them
}","",1,20161107
5820ae5c-cac4-4c1a-a969-497a8e96ca05,17,Artifacts dropped,yara,"rule keyboy_commands
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the 2016 sample's sent and received commands""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
strings:
$s1 = ""Update"" wide fullword
$s2 = ""UpdateAndRun"" wide fullword
$s3 = ""Refresh"" wide fullword
$s4 = ""OnLine"" wide fullword
$s5 = ""Disconnect"" wide fullword
$s6 = ""Pw_Error"" wide fullword
$s7 = ""Pw_OK"" wide fullword
$s8 = ""Sysinfo"" wide fullword
$s9 = ""Download"" wide fullword
$s10 = ""UploadFileOk"" wide fullword
$s11 = ""RemoteRun"" wide fullword
$s12 = ""FileManager"" wide fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
6 of them
}","",1,20161107
5820ae72-a878-4992-b659-49798e96ca05,17,Artifacts dropped,yara,"rule keyboy_errors
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the sample's shell error2 log statements""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
strings:
//These strings are in ASCII pre-2015 and UNICODE in 2016
$error = ""Error2"" ascii wide
//2016 specific:
$s1 = ""Can't find [%s]!Check the file name and try again!"" ascii wide
$s2 = ""Open [%s] error! %d"" ascii wide
$s3 = ""The Size of [%s] is zero!"" ascii wide
$s4 = ""CreateThread DownloadFile[%s] Error!"" ascii wide
$s5 = ""UploadFile [%s] Error:Connect Server Failed!"" ascii wide
$s6 = ""Receive [%s] Error(Recved[%d] != Send[%d])!"" ascii wide
$s7 = ""Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s"" ascii wide
$s8 = ""CreateThread UploadFile[%s] Error!"" ascii wide
//Pre-2016:
$s9 = ""Ready Download [%s] ok!"" ascii wide
$s10 = ""Get ControlInfo from FileClient error!"" ascii wide
$s11 = ""FileClient has a error!"" ascii wide
$s12 = ""VirtualAlloc SendBuff Error(%d)"" ascii wide
$s13 = ""ReadFile [%s] Error(%d)..."" ascii wide
$s14 = ""ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..."" ascii wide
$s15 = ""CreateThread DownloadFile[%s] Error!"" ascii wide
$s16 = ""RecvData MyRecv_Info Size Error!"" ascii wide
$s17 = ""RecvData MyRecv_Info Tag Error!"" ascii wide
$s18 = ""SendData szControlInfo_1 Error!"" ascii wide
$s19 = ""SendData szControlInfo_3 Error!"" ascii wide
$s20 = ""VirtualAlloc RecvBuff Error(%d)"" ascii wide
$s21 = ""RecvData Error!"" ascii wide
$s22 = ""WriteFile [%s} Error(%d)..."" ascii wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
$error and 3 of ($s*)
}","",1,20161107
5820ae84-8770-42eb-a2f4-497a8e96ca05,17,Artifacts dropped,yara,"rule keyboy_systeminfo
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the system information format before sending to C2""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
strings:
//These strings are ASCII pre-2015 and UNICODE in 2016
$s1 = ""SystemVersion: %s"" ascii wide
$s2 = ""Product ID: %s"" ascii wide
$s3 = ""InstallPath: %s"" ascii wide
$s4 = ""InstallTime: %d-%d-%d, %02d:%02d:%02d"" ascii wide
$s5 = ""ResgisterGroup: %s"" ascii wide
$s6 = ""RegisterUser: %s"" ascii wide
$s7 = ""ComputerName: %s"" ascii wide
$s8 = ""WindowsDirectory: %s"" ascii wide
$s9 = ""System Directory: %s"" ascii wide
$s10 = ""Number of Processors: %d"" ascii wide
$s11 = ""CPU[%d]: %s: %sMHz"" ascii wide
$s12 = ""RAM: %dMB Total, %dMB Free."" ascii wide
$s13 = ""DisplayMode: %d x %d, %dHz, %dbit"" ascii wide
$s14 = ""Uptime: %d Days %02u:%02u:%02u"" ascii wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
7 of them
}","",1,20161107
5820ae9b-0028-4ea1-bc1f-49798e96ca05,17,Artifacts dropped,yara,"import ""pe""
rule keyboy_related_exports
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the new 2016 sample's export""
date = ""2016-08-28""
md5 = ""495adb1b9777002ecfe22aaf52fcee93""
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
//The malware family seems to share many exports
//but this is the new kid on the block.
pe.exports(""Embedding"") or
pe.exports(""SSSS"") or
pe.exports(""GetUP"")
}","",1,20161107
5820aeb4-7f4c-4e5b-af06-497a8e96ca05,17,Artifacts dropped,yara,"import ""pe""
rule keyboy_init_config_section
{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the Init section where the config is stored""
date = ""2016-08-28""
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
//Payloads are normally smaller but the new dropper we spotted
//is a bit larger.
filesize < 300KB and
//Observed virtual sizes of the .Init section vary but they've
//always been 1024, 2048, or 4096 bytes.
for any i in (0..pe.number_of_sections - 1):
(
pe.sections[i].name == "".Init"" and
pe.sections[i].virtual_size % 1024 == 0
)
}","",1,20161107
5820aed7-4eac-4c87-ac4e-49798e96ca05,17,Payload delivery,yara,"rule CVE_2012_0158_KeyBoy {
meta:
author = ""Etienne Maynier <etienne@citizenlab.ca>""
description = ""CVE-2012-0158 variant""
file = ""8307e444cad98b1b59568ad2eba5f201""
strings:
$a = ""d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001"" nocase // OLE header
$b = ""ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"" nocase // junk data
$c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase
$d = ""MSComctlLib.ListViewCtrl.2""
$e = ""ac38c874503c307405347aaaebf2ac2c31ebf6e8e3"" nocase //decoding shellcode
condition:
all of them
}","",1,20161107
5820aeee-3fdc-47cc-b940-497a8e96ca05,17,Payload delivery,yara,"rule keyboy_exploit_doc_meta{
meta:
author = ""Matt Brooks, @cmatthewbrooks""
desc = ""Matches the meta associated with these exploit docs""
date = ""2016-09-30""
strings:
$role = ""{\\author Master}{\\operator Master}""
$creatim = ""{\\creatim\\yr2015\\mo10\\dy16\\hr11\\min37}""
$revtim = ""{\\revtim\\yr2015\\mo10\\dy16\\hr13\\min54}""
condition:
uint32be(0) == 0x7B5C7274 and
filesize < 1MB and
all of them
}","",1,20161107
58235402-9d54-437c-b845-69fe8e96ca05,17,Artifacts dropped,regkey,"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver","Contains the Keyboy version",1,20161116
5823989b-68f0-4831-b1d8-49798e96ca05,17,Payload delivery,sha256,"5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49","dw20.exe dropper",1,20161109
582398da-78c0-47ed-8bb9-49798e96ca05,17,Artifacts dropped,sha256,"9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04","Wab32res.dll payload, KeyBoy 20160509",1,20161109
5823990b-db7c-45c9-9afb-69fe8e96ca05,17,Payload delivery,md5,"23d284245e53ae4fe05c517d807ffccf","dropper of 'agewkassif' version",1,20161109
5823995f-701c-4616-84f5-49798e96ca05,17,Payload delivery,sha256,"542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf","dropper of 'agewkassif' sample",1,20161109
58239987-0038-44ba-997f-49798e96ca05,17,Artifacts dropped,md5,"087bffa8a570079948310dc9731c5709","wab32res.dll, agewkassif version",1,20161109
582399a3-04f8-4542-b205-49798e96ca05,17,Artifacts dropped,sha256,"5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88","Wab32res.dll payload, KeyBoy agewkassif version",1,20161109
582c9016-1a1c-471e-890f-69fe8e96ca05,17,Network activity,ip-dst,"112.10.117.47","Other IP hosting tibetvoices.com",1,20161116
1 uuid event_id category type value comment to_ids date
2 5820ab7b-5a8c-4164-8113-49798e96ca05 17 Artifacts dropped md5 495adb1b9777002ecfe22aaf52fcee93 Wab32res.dll payload, KeyBoy 20160509 1 20161107
3 5820ab93-8b90-4f61-8591-497a8e96ca05 17 Network activity ip-dst 103.40.102.233 C2 IP 1 20161116
4 5820ab93-ca00-4627-a8e9-497a8e96ca05 17 Network activity ip-dst 45.125.12.147 C2 IP 1 20161110
5 5820aba7-e398-41cb-939b-49798e96ca05 17 Network activity domain tibetvoices.com domain linked to one of the C2 IPs 1 20161107
6 5820abec-8b88-4398-ba31-497a8e96ca05 17 Network activity ip-dst 116.193.154.69 C2 IP 1 20161107
7 5820ac1b-05c0-4d60-8fc5-497a8e96ca05 17 Artifacts dropped md5 0c7e55509e0b6d4277b3facf864af018 Payload KeyBoy P_20150313 1 20161107
8 5820ac33-586c-4674-b96d-49798e96ca05 17 Network activity domain www.eleven.mypop3.org C2 domains 1 20161116
9 5820ac33-aa80-4d97-99a2-49798e96ca05 17 Network activity domain www.about.jkub.com C2 domains 1 20161107
10 5820ac34-dfc4-4772-8fb6-49798e96ca05 17 Network activity domain www.backus.myftp.name C2 domains 1 20161116
11 5820ac71-ff98-486d-b2e6-49798e96ca05 17 Artifacts dropped md5 98977426d544bd145979f65f0322ae30 Payload KeyBoy 20151108 1 20161107
12 5820ac98-f508-4869-9701-497a8e96ca05 17 Network activity ip-dst 103.242.134.243 C2 IP 1 20161116
13 5820ad1d-5d34-489f-97b8-497a8e96ca05 17 Network activity ip-dst 157.7.84.81 IPs for C2 Host: www.about.jkub[.]com 1 20161107
14 5820ad1d-a7c0-4f84-9d29-497a8e96ca05 17 Network activity ip-dst 45.32.47.148 IPs for C2 Host: www.about.jkub[.]com 1 20161107
15 5820ad50-de2c-4f26-bd5c-497a8e96ca05 17 Network activity ip-dst 192.241.149.43 IP behind C2 Host: www.backus.myftp[.]name 1 20161107
16 5820ad9c-c3c4-455e-a5f2-497a8e96ca05 17 Artifacts dropped md5 c5b5f01ba24d6c02636388809f44472e Payload KeyBoy 20151108 1 20161107
17 5820adb2-5520-499c-95d3-49798e96ca05 17 Artifacts dropped md5 371bc132499f455f06fa80696db0df27 64b KeyBoy payload 20151108 1 20161107
18 5820ae20-ebec-43d6-9f95-497a8e96ca05 17 Artifacts dropped yara import "pe" rule new_keyboy_export { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the new 2016 sample's export" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and //The malware family seems to share many exports //but this is the new kid on the block. pe.exports("cfsUpdate") } 1 20161107
19 5820ae49-9114-4d4d-b043-49798e96ca05 17 Artifacts dropped yara rule new_keyboy_header_codes { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the 2016 sample's header codes" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" strings: $s1 = "*l*" wide fullword $s2 = "*a*" wide fullword $s3 = "*s*" wide fullword $s4 = "*d*" wide fullword $s5 = "*f*" wide fullword $s6 = "*g*" wide fullword $s7 = "*h*" wide fullword condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and all of them } 1 20161107
20 5820ae5c-cac4-4c1a-a969-497a8e96ca05 17 Artifacts dropped yara rule keyboy_commands { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the 2016 sample's sent and received commands" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" strings: $s1 = "Update" wide fullword $s2 = "UpdateAndRun" wide fullword $s3 = "Refresh" wide fullword $s4 = "OnLine" wide fullword $s5 = "Disconnect" wide fullword $s6 = "Pw_Error" wide fullword $s7 = "Pw_OK" wide fullword $s8 = "Sysinfo" wide fullword $s9 = "Download" wide fullword $s10 = "UploadFileOk" wide fullword $s11 = "RemoteRun" wide fullword $s12 = "FileManager" wide fullword condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and 6 of them } 1 20161107
21 5820ae72-a878-4992-b659-49798e96ca05 17 Artifacts dropped yara rule keyboy_errors { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the sample's shell error2 log statements" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" strings: //These strings are in ASCII pre-2015 and UNICODE in 2016 $error = "Error2" ascii wide //2016 specific: $s1 = "Can't find [%s]!Check the file name and try again!" ascii wide $s2 = "Open [%s] error! %d" ascii wide $s3 = "The Size of [%s] is zero!" ascii wide $s4 = "CreateThread DownloadFile[%s] Error!" ascii wide $s5 = "UploadFile [%s] Error:Connect Server Failed!" ascii wide $s6 = "Receive [%s] Error(Recved[%d] != Send[%d])!" ascii wide $s7 = "Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s" ascii wide $s8 = "CreateThread UploadFile[%s] Error!" ascii wide //Pre-2016: $s9 = "Ready Download [%s] ok!" ascii wide $s10 = "Get ControlInfo from FileClient error!" ascii wide $s11 = "FileClient has a error!" ascii wide $s12 = "VirtualAlloc SendBuff Error(%d)" ascii wide $s13 = "ReadFile [%s] Error(%d)..." ascii wide $s14 = "ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..." ascii wide $s15 = "CreateThread DownloadFile[%s] Error!" ascii wide $s16 = "RecvData MyRecv_Info Size Error!" ascii wide $s17 = "RecvData MyRecv_Info Tag Error!" ascii wide $s18 = "SendData szControlInfo_1 Error!" ascii wide $s19 = "SendData szControlInfo_3 Error!" ascii wide $s20 = "VirtualAlloc RecvBuff Error(%d)" ascii wide $s21 = "RecvData Error!" ascii wide $s22 = "WriteFile [%s} Error(%d)..." ascii wide condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and $error and 3 of ($s*) } 1 20161107
22 5820ae84-8770-42eb-a2f4-497a8e96ca05 17 Artifacts dropped yara rule keyboy_systeminfo { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the system information format before sending to C2" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" strings: //These strings are ASCII pre-2015 and UNICODE in 2016 $s1 = "SystemVersion: %s" ascii wide $s2 = "Product ID: %s" ascii wide $s3 = "InstallPath: %s" ascii wide $s4 = "InstallTime: %d-%d-%d, %02d:%02d:%02d" ascii wide $s5 = "ResgisterGroup: %s" ascii wide $s6 = "RegisterUser: %s" ascii wide $s7 = "ComputerName: %s" ascii wide $s8 = "WindowsDirectory: %s" ascii wide $s9 = "System Directory: %s" ascii wide $s10 = "Number of Processors: %d" ascii wide $s11 = "CPU[%d]: %s: %sMHz" ascii wide $s12 = "RAM: %dMB Total, %dMB Free." ascii wide $s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide $s14 = "Uptime: %d Days %02u:%02u:%02u" ascii wide condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and 7 of them } 1 20161107
23 5820ae9b-0028-4ea1-bc1f-49798e96ca05 17 Artifacts dropped yara import "pe" rule keyboy_related_exports { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the new 2016 sample's export" date = "2016-08-28" md5 = "495adb1b9777002ecfe22aaf52fcee93" condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and //The malware family seems to share many exports //but this is the new kid on the block. pe.exports("Embedding") or pe.exports("SSSS") or pe.exports("GetUP") } 1 20161107
24 5820aeb4-7f4c-4e5b-af06-497a8e96ca05 17 Artifacts dropped yara import "pe" rule keyboy_init_config_section { meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the Init section where the config is stored" date = "2016-08-28" condition: //MZ header uint16(0) == 0x5A4D and //PE signature uint32(uint32(0x3C)) == 0x00004550 and //Payloads are normally smaller but the new dropper we spotted //is a bit larger. filesize < 300KB and //Observed virtual sizes of the .Init section vary but they've //always been 1024, 2048, or 4096 bytes. for any i in (0..pe.number_of_sections - 1): ( pe.sections[i].name == ".Init" and pe.sections[i].virtual_size % 1024 == 0 ) } 1 20161107
25 5820aed7-4eac-4c87-ac4e-49798e96ca05 17 Payload delivery yara rule CVE_2012_0158_KeyBoy { meta: author = "Etienne Maynier <etienne@citizenlab.ca>" description = "CVE-2012-0158 variant" file = "8307e444cad98b1b59568ad2eba5f201" strings: $a = "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001" nocase // OLE header $b = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" nocase // junk data $c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase $d = "MSComctlLib.ListViewCtrl.2" $e = "ac38c874503c307405347aaaebf2ac2c31ebf6e8e3" nocase //decoding shellcode condition: all of them } 1 20161107
26 5820aeee-3fdc-47cc-b940-497a8e96ca05 17 Payload delivery yara rule keyboy_exploit_doc_meta{ meta: author = "Matt Brooks, @cmatthewbrooks" desc = "Matches the meta associated with these exploit docs" date = "2016-09-30" strings: $role = "{\\author Master}{\\operator Master}" $creatim = "{\\creatim\\yr2015\\mo10\\dy16\\hr11\\min37}" $revtim = "{\\revtim\\yr2015\\mo10\\dy16\\hr13\\min54}" condition: uint32be(0) == 0x7B5C7274 and filesize < 1MB and all of them } 1 20161107
27 58235402-9d54-437c-b845-69fe8e96ca05 17 Artifacts dropped regkey HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver Contains the Keyboy version 1 20161116
28 5823989b-68f0-4831-b1d8-49798e96ca05 17 Payload delivery sha256 5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49 dw20.exe dropper 1 20161109
29 582398da-78c0-47ed-8bb9-49798e96ca05 17 Artifacts dropped sha256 9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04 Wab32res.dll payload, KeyBoy 20160509 1 20161109
30 5823990b-db7c-45c9-9afb-69fe8e96ca05 17 Payload delivery md5 23d284245e53ae4fe05c517d807ffccf dropper of 'agewkassif' version 1 20161109
31 5823995f-701c-4616-84f5-49798e96ca05 17 Payload delivery sha256 542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf dropper of 'agewkassif' sample 1 20161109
32 58239987-0038-44ba-997f-49798e96ca05 17 Artifacts dropped md5 087bffa8a570079948310dc9731c5709 wab32res.dll, agewkassif version 1 20161109
33 582399a3-04f8-4542-b205-49798e96ca05 17 Artifacts dropped sha256 5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88 Wab32res.dll payload, KeyBoy agewkassif version 1 20161109
34 582c9016-1a1c-471e-890f-69fe8e96ca05 17 Network activity ip-dst 112.10.117.47 Other IP hosting tibetvoices.com 1 20161116

107
data/ioc/spyware/citizen_lab/201611_KeyBoy/kb_c2Decode.py Normal file
View File

@@ -0,0 +1,107 @@
'''
KeyBoy C2 traffic pcap decoder
From: It's Parliamentary: KeyBoy and the targeting of the Tibetan Community
Permalink: https://citizenlab.org/2016/11/parliament-keyboy/
Adam Hulcoop / September 19, 2016
adam.hulcoop[@]citizenlab.ca
32 bit support only [64bit can use manual override]
'''
import scapy
import argparse
import logging
import sys,getopt
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
from scapy.all import TCP,rdpcap,Raw
def egcd(a, b):
if a == 0:
return (b, 0, 1)
else:
g, y, x = egcd(b % a, a)
return (g, x - (b // a) * y, y)
def modinv(a, m):
g, x, y = egcd(a, m)
if g != 1:
raise Exception('modular inverse does not exist')
else:
return x % m
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='Decode KeyBoy C2 traffic from pcap file')
group = parser.add_mutually_exclusive_group(required=True)
group.add_argument('-k','--key',type=int, help="Manually provide C2 decode key")
group.add_argument('-b','--binary',help="KeyBoy binary")
parser.add_argument('PCAPF', help='PCAP File containing c2 traffic')
parser.add_argument('--verbose','-v',action='store_true',help='Enable verbose output')
args = parser.parse_args()
if args.verbose:
logging.basicConfig(format='%(message)s',level=logging.DEBUG)
else:
logging.basicConfig(format='%(message)s',level=logging.WARNING)
print "============================"
print "{KeyBoy C2 Traffic decoder}"
print "============================"
print ""
if args.binary:
with open(args.binary,'rb') as keyboy_file:
keyboy_file.seek(0,2)
num_bytes_kb = keyboy_file.tell()
count =0
for i in range(num_bytes_kb):
keyboy_file.seek(i)
sig_p1 = keyboy_file.read(4)
sig_const = keyboy_file.read(1)
sig_p2 = keyboy_file.read(7)
if ( (sig_p1 == b"\x8a\x04\x73\xb1") or (sig_p1 == b"\x8a\x04\x1e\xb1") ):
if ( (sig_p2 == b"\xf6\xe9\x88\x04\x73\x53\x46") or (sig_p2 == b"\xf6\xe9\x88\x04\x1e\x8b\xc3") ):
#sig_const should be the encoding constant
#print "Found const: 0x%x" % ord(sig_const)
logging.debug("Found constant: 0x%x" % ord(sig_const))
encode_val = ord(sig_const)
count += 1
break
if count < 1 :
logging.warn("Didn't find signature\nQuitting..")
sys.exit(1)
else:
logging.debug( "Computing decode value...")
inv = modinv(encode_val,256)
logging.debug("Found decoding multiplier (inverse): %s" % hex(inv))
else:
logging.debug("Using manually specified decoding multiplier (inverse): %s" % hex(args.key))
inv = args.key
logging.warn ("Searching PCAP for RAW TCP packets and decoding...")
logging.warn("")
data =''
p = rdpcap(args.PCAPF)
for pkt in p:
if( pkt.haslayer(TCP)):
if( pkt.haslayer(Raw)):
ba = bytearray(pkt.getlayer(Raw).load)
for byte in ba:
if byte == 0:
data += ''
else:
data += chr(int((byte*inv) & 255))
logging.warn(data)

196
data/ioc/spyware/citizen_lab/201611_KeyBoy/kb_configDecode.py Normal file
View File

@@ -0,0 +1,196 @@
'''
KeyBoy Config file decoder
From: It's Parliamentary: KeyBoy and the targeting of the Tibetan Community
Permalink: https://citizenlab.org/2016/11/parliament-keyboy/
Adam Hulcoop / September 19, 2016
adam.hulcoop[@]citizenlab.ca
'''
import sys
import argparse
import logging
LookupTable = {}
# Function to compute 9-bit sliding window values and return list of converted indices
def byteDecoder(rawBytes):
#rawBytes should be bytearray of values
k=0
ba = []
bytex=0
while( bytex < len(rawBytes) -1):
index = 0
ix = bytex
t=0
while ( index < 9):
while (k<8):
if( ( ord(rawBytes[ix]) & (1 << (7-k))) > 0 ):
t = 2*t +1
else:
t = 2*t
index+=1
k+=1
if( index > 8):
break
if ( k==8 ):
ix+=1
k=0
if (index<=8):
k=0
elif ( (index == 9) and (k==8)):
k=0
bytex+=1
#t should hold the resultant value
ba.append(t)
bytex+=1
return ba
def CreateLookupTable():
for x in xrange(0,256):
LookupTable[x] = "{:x}".format(x)
# 0x101 is used as the exit value
LookupTable[257] = "reserved"
return
def BuildExtraLookupTable(curIndex, prevIndex):
#curIndex and prevIndex are indices from the decoded input file
startFrom = len(LookupTable)
if( curIndex > startFrom) :
# if we are looking up an index beyond the existing table size
vPrev = LookupTable.get(prevIndex)
vCur = LookupTable.get(prevIndex)
else:
vPrev = LookupTable.get(prevIndex)
vCur = LookupTable.get(curIndex)
newVal = vPrev
if( len(vCur.split(',')) > 1 ):
augItem = vCur.split(',')[0]
else:
augItem = vCur
newVal = ','.join([vPrev,augItem])
LookupTable[startFrom+1] = newVal
logging.debug("0x%x => %s" % ((startFrom+1),newVal ))
return
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='Decode KeyBoy backdoor configuration files')
parser.add_argument('FILE', help='KeyBoy encoded config file')
parser.add_argument('--verbose','-v',action='store_true',help='Enable verbose output')
parser.add_argument('--skip','-s',type=int,help='Skip over <SKIP> bytes at beginning of file')
args = parser.parse_args()
if args.verbose:
logging.basicConfig(format='%(message)s',level=logging.DEBUG)
else:
logging.basicConfig(format='%(message)s',level=logging.WARNING)
print "============================"
print "{KeyBoy Config file Decoder}"
print "============================"
print ""
with open(args.FILE, "rb") as f:
if args.skip is None:
f.seek(0,0)
else:
logging.warn("Skipping %i bytes.." % args.skip)
f.seek(args.skip,0)
szfile = f.read(8)
szf_dat = int(szfile,16)
logging.debug("Size of decoded config file:\t%i bytes" % szf_dat)
szconf = f.read(8)
szc_dat = int(szconf,16)
logging.debug("Size of encoded config data:\t%i bytes" % szc_dat)
logging.debug("")
bytesRaw = f.read(szc_dat)
ba = byteDecoder(bytesRaw)
#create the initial Lookup table
CreateLookupTable()
ResultsList = []
#Build the extra lookup table values
logging.debug("Dynamic lookup table entries:")
for val in range(len(ba)):
#for each entry in the bytes array,
# we need to look up the value in the table.
# As we go, we need to build new entries on the table
# corresponding to the value from this lookup, concatenated with the first character from the
# the value printed in the previous lookup. BuildExtraLookupTable function does that step.
if( val == 0):
continue
elif (val == 1):
ResultsList.append(LookupTable.get(ba[val]))
prevValue = ba[val]
else:
curValue = ba[val]
if (curValue != 257):
BuildExtraLookupTable(curValue, prevValue)
ResultsList.append(LookupTable.get(ba[val]))
prevValue= curValue
logging.debug("")
logging.debug("Decoded index list:")
logging.debug(['0x%x' % j for j in ba])
logging.debug("")
resultData = ",".join(ResultsList)
hChars = resultData.split(',')
Output = ""
for h in hChars:
Output += chr(int(h,16))
logging.debug("Retrieved config character array:")
logging.debug(['0x%x' % int(m,16) for m in hChars])
logging.debug("")
TokenizedOutput = Output.split('\r\n')
ConfigSections = ['Identity Code:','C2 Host/IP #1:','C2 Host/IP #2:','C2 Host/IP #3:','C2 Port #1:','C2 Port #2:','C2 Port #3:','Password:','Campaign ID:','']
logging.warn("Configuration Data:")
headr = "=" * 30
logging.warn(headr)
for x in range(len(TokenizedOutput)-1):
logging.warn("%s\t%s" % (ConfigSections[x],TokenizedOutput[x]))
logging.warn("")

289
data/ioc/spyware/citizen_lab/201611_KeyBoy/keyboy.yar Normal file
View File

@@ -0,0 +1,289 @@
import "pe"
/*
*
* This section of the rules are all specific to the new 2016
* KeyBoy sample targeting the Tibetan community. Other following
* sections capture file characteristics observed across multiple
* years of development. Don't miss the exploit doc signatures
* at the very end.
*
*/
rule new_keyboy_export
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the new 2016 sample's export"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
//The malware family seems to share many exports
//but this is the new kid on the block.
pe.exports("cfsUpdate")
}
rule new_keyboy_header_codes
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the 2016 sample's header codes"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
$s1 = "*l*" wide fullword
$s2 = "*a*" wide fullword
$s3 = "*s*" wide fullword
$s4 = "*d*" wide fullword
$s5 = "*f*" wide fullword
$s6 = "*g*" wide fullword
$s7 = "*h*" wide fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
all of them
}
/*
*
* This section of the rules are all broader and will hit on
* older KeyBoy samples and other samples possibly part of a
* a larger development effort.
*
*/
rule keyboy_commands
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the 2016 sample's sent and received commands"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
$s1 = "Update" wide fullword
$s2 = "UpdateAndRun" wide fullword
$s3 = "Refresh" wide fullword
$s4 = "OnLine" wide fullword
$s5 = "Disconnect" wide fullword
$s6 = "Pw_Error" wide fullword
$s7 = "Pw_OK" wide fullword
$s8 = "Sysinfo" wide fullword
$s9 = "Download" wide fullword
$s10 = "UploadFileOk" wide fullword
$s11 = "RemoteRun" wide fullword
$s12 = "FileManager" wide fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
6 of them
}
rule keyboy_errors
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the sample's shell error2 log statements"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
//These strings are in ASCII pre-2015 and UNICODE in 2016
$error = "Error2" ascii wide
//2016 specific:
$s1 = "Can't find [%s]!Check the file name and try again!" ascii wide
$s2 = "Open [%s] error! %d" ascii wide
$s3 = "The Size of [%s] is zero!" ascii wide
$s4 = "CreateThread DownloadFile[%s] Error!" ascii wide
$s5 = "UploadFile [%s] Error:Connect Server Failed!" ascii wide
$s6 = "Receive [%s] Error(Recved[%d] != Send[%d])!" ascii wide
$s7 = "Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s" ascii wide
$s8 = "CreateThread UploadFile[%s] Error!" ascii wide
//Pre-2016:
$s9 = "Ready Download [%s] ok!" ascii wide
$s10 = "Get ControlInfo from FileClient error!" ascii wide
$s11 = "FileClient has a error!" ascii wide
$s12 = "VirtualAlloc SendBuff Error(%d)" ascii wide
$s13 = "ReadFile [%s] Error(%d)..." ascii wide
$s14 = "ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..." ascii wide
$s15 = "CreateThread DownloadFile[%s] Error!" ascii wide
$s16 = "RecvData MyRecv_Info Size Error!" ascii wide
$s17 = "RecvData MyRecv_Info Tag Error!" ascii wide
$s18 = "SendData szControlInfo_1 Error!" ascii wide
$s19 = "SendData szControlInfo_3 Error!" ascii wide
$s20 = "VirtualAlloc RecvBuff Error(%d)" ascii wide
$s21 = "RecvData Error!" ascii wide
$s22 = "WriteFile [%s} Error(%d)..." ascii wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
$error and 3 of ($s*)
}
rule keyboy_systeminfo
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the system information format before sending to C2"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
strings:
//These strings are ASCII pre-2015 and UNICODE in 2016
$s1 = "SystemVersion: %s" ascii wide
$s2 = "Product ID: %s" ascii wide
$s3 = "InstallPath: %s" ascii wide
$s4 = "InstallTime: %d-%d-%d, %02d:%02d:%02d" ascii wide
$s5 = "ResgisterGroup: %s" ascii wide
$s6 = "RegisterUser: %s" ascii wide
$s7 = "ComputerName: %s" ascii wide
$s8 = "WindowsDirectory: %s" ascii wide
$s9 = "System Directory: %s" ascii wide
$s10 = "Number of Processors: %d" ascii wide
$s11 = "CPU[%d]: %s: %sMHz" ascii wide
$s12 = "RAM: %dMB Total, %dMB Free." ascii wide
$s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide
$s14 = "Uptime: %d Days %02u:%02u:%02u" ascii wide
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
7 of them
}
rule keyboy_related_exports
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the new 2016 sample's export"
date = "2016-08-28"
md5 = "495adb1b9777002ecfe22aaf52fcee93"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
filesize < 200KB and
//The malware family seems to share many exports
//but this is the new kid on the block.
pe.exports("Embedding") or
pe.exports("SSSS") or
pe.exports("GetUP")
}
// Note: The use of the .Init section has been observed in nearly
// all samples with the exception of the 2013 VN dropper from the
// Rapid7 blog. The config data was stored in that sample's .data
// section.
rule keyboy_init_config_section
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
desc = "Matches the Init section where the config is stored"
date = "2016-08-28"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
//Payloads are normally smaller but the new dropper we spotted
//is a bit larger.
filesize < 300KB and
//Observed virtual sizes of the .Init section vary but they've
//always been 1024, 2048, or 4096 bytes.
for any i in (0..pe.number_of_sections - 1):
(
pe.sections[i].name == ".Init" and
pe.sections[i].virtual_size % 1024 == 0
)
}
/*
*
* These signatures fire on the exploit documents used in this
* operation.
*
*/
rule CVE_2012_0158_KeyBoy {
meta:
author = "Etienne Maynier <etienne@citizenlab.ca>"
description = "CVE-2012-0158 variant"
file = "8307e444cad98b1b59568ad2eba5f201"
strings:
$a = "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001" nocase // OLE header
$b = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" nocase // junk data
$c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase
$d = "MSComctlLib.ListViewCtrl.2"
$e = "ac38c874503c307405347aaaebf2ac2c31ebf6e8e3" nocase //decoding shellcode
condition:
all of them
}

1519
data/ioc/spyware/citizen_lab/201611_KeyBoy/misp.json Normal file
View File

File diff suppressed because it is too large Load Diff

109
data/ioc/spyware/citizen_lab/201611_KeyBoy/openioc.ioc Normal file
View File

@@ -0,0 +1,109 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5820aa49-6a40-4e51-86f9-497a8e96ca05" last-modified="2016-11-07T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #17</short_description>
<description>It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2016-11-07T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="5820aa49-6a40-4e51-86f9-497a8e96ca05">
<IndicatorItem id="495adb1b9777002ecfe22aaf52fcee93" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="0c7e55509e0b6d4277b3facf864af018" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="98977426d544bd145979f65f0322ae30" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="c5b5f01ba24d6c02636388809f44472e" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="371bc132499f455f06fa80696db0df27" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="087bffa8a570079948310dc9731c5709" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver" condition="is">
<Context document="Network" search="RegistryItem/KeyPath" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04" condition="is">
<Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
<Content type="sha256"></Content>
</IndicatorItem>
<IndicatorItem id="5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88" condition="is">
<Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
<Content type="sha256"></Content>
</IndicatorItem>
<IndicatorItem id="tibetvoices.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.about.jkub.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.eleven.mypop3.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.backus.myftp.name" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="45.125.12.147" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="103.40.102.233" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="116.193.154.69" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="103.242.134.243" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="45.32.47.148" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="157.7.84.81" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="192.241.149.43" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="112.10.117.47" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="23d284245e53ae4fe05c517d807ffccf" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5"></Content>
</IndicatorItem>
<IndicatorItem id="5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49" condition="is">
<Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
<Content type="sha256"></Content>
</IndicatorItem>
<IndicatorItem id="542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf" condition="is">
<Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
<Content type="sha256"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

1681
data/ioc/spyware/citizen_lab/201611_KeyBoy/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff

9
data/ioc/spyware/citizen_lab/201702_NilePhish/README.md Normal file
View File

@@ -0,0 +1,9 @@
## NilePhish IOCs
This directory contains IOCs from the Citizen Lab report [Nile Phish: Large-Scale Phishing Campaign Targeting Egyptian Civil Society](https://citizenlab.org/2017/02/nilephish-report/) published the 2nd of February 2017.
Files included in this directory:
* openioc.ioc : IOCs in OpenIOC format
* stix.xml : IOCs in STIX XML format
* iocs.csv : IOCs in csv format
* misp.json : IOC in MISP JSON format

39
data/ioc/spyware/citizen_lab/201702_NilePhish/iocs.csv Normal file
View File

@@ -0,0 +1,39 @@
uuid,event_id,category,type,value,comment,to_ids,date
587cf53e-ee64-4e85-a4f5-0bbb8e96ca05,89,Network activity,ip-dst,"176.123.26.42","",1,20170116
587cfa0f-0b54-44f1-9f4c-0bbb8e96ca05,89,Network activity,ip-dst,"108.61.176.96","IPs hosting phishing websites",1,20170116
587cfa22-d240-4c6a-ba53-0bbb8e96ca05,89,Network activity,ip-dst,"104.238.191.204","IP hosting phishing websites",1,20170116
588778af-1470-4b9e-a921-07288e96ca05,89,Network activity,domain,"google-maps.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-1708-4caa-bef5-07288e96ca05,89,Network activity,domain,"googledriver-sign.ddns.net","Domains used in the phishing attack",1,20170124
588778af-2d08-493e-962a-07288e96ca05,89,Network activity,domain,"googlesecure-serv.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-3604-4351-9e9e-07288e96ca05,89,Network activity,domain,"googledrive-sign.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-3f6c-4a59-9c2f-07288e96ca05,89,Network activity,domain,"fedex-sign.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-4184-41bd-932b-07288e96ca05,89,Network activity,domain,"dropbox-sign.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-421c-4ab6-8fc9-07288e96ca05,89,Network activity,domain,"verification-acc.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-4754-4997-9fdc-07288e96ca05,89,Network activity,domain,"secure-team.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-4e10-41de-9d5b-07288e96ca05,89,Network activity,domain,"dropbox-service.serveftp.com","Domains used in the phishing attack",1,20170124
588778af-5614-4198-bfc8-07288e96ca05,89,Network activity,domain,"fedex-mail.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-5724-4ccd-b5f0-07288e96ca05,89,Network activity,domain,"aramex-shipping.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-7d08-4995-ae9d-07288e96ca05,89,Network activity,domain,"myaccount.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-7ff4-4200-a7ee-07288e96ca05,89,Network activity,domain,"security-myaccount.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-aaf4-49c7-9028-07288e96ca05,89,Network activity,domain,"googleverify-signin.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-cf24-4254-ad98-07288e96ca05,89,Network activity,domain,"account-google.serveftp.com","Domains used in the phishing attack",1,20170124
588778af-d37c-406e-8703-07288e96ca05,89,Network activity,domain,"fedex-shipping.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-d7e4-4b55-8b85-07288e96ca05,89,Network activity,domain,"dropboxsupport.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-ea9c-4be6-a936-07288e96ca05,89,Network activity,domain,"mailgooglesign.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-ee60-4f45-8efb-07288e96ca05,89,Network activity,domain,"device-activation.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-f554-4b11-b19b-07288e96ca05,89,Network activity,domain,"googlesignin.servehttp.com","Domains used in the phishing attack",1,20170124
58877af7-3218-42ee-ab63-07288e96ca05,89,Network activity,domain,"fedex-s.servehttp.com","Related phishing domain",1,20170124
58877af7-c9f8-4198-acf2-07288e96ca05,89,Network activity,domain,"watchyoutube.servehttp.com","Related phishing domain",1,20170124
58877af7-e064-4ea8-8048-07288e96ca05,89,Network activity,domain,"dropbox-verfy.servehttp.com","Related phishing domain",1,20170124
58877ce3-2fa4-43b0-9be6-07298e96ca05,89,Network activity,domain,"securityteam-notify.servehttp.com","Related phishing domain",1,20170124
58877ce3-5b10-49d8-b03d-07298e96ca05,89,Network activity,domain,"restricted-videos.servehttp.com","Related phishing domain",1,20170124
58877ce3-5d28-4361-983f-07298e96ca05,89,Network activity,domain,"fedex-notification.servehttp.com","Related phishing domain",1,20170124
58877ce3-9b20-4e75-a2f1-07298e96ca05,89,Network activity,domain,"quota-notification.servehttp.com","Related phishing domain",1,20170124
58877ce3-acd4-4365-ac46-07298e96ca05,89,Network activity,domain,"docs-mails.servehttp.com","Related phishing domain",1,20170124
58877ce3-c1c4-40d8-baa5-07298e96ca05,89,Network activity,domain,"verification-team.servehttp.com","Related phishing domain",1,20170124
58877ce3-e2bc-4fc7-b7a0-07298e96ca05,89,Network activity,domain,"notification-team.servehttp.com","Related phishing domain",1,20170124
58877ce3-f668-4eb1-828a-07298e96ca05,89,Network activity,domain,"dropboxnotification.servehttp.com","Related phishing domain",1,20170124
58877ce3-fb60-4972-a691-07298e96ca05,89,Network activity,domain,"secure-alert.servehttp.com","Related phishing domain",1,20170124
5887a880-559c-4680-a403-0bbb8e96ca05,89,Network activity,domain,"moi-gov.serveftp.com","Related phishing domain",1,20170124
5890c466-51f8-425d-850f-07298e96ca05,89,Network activity,domain,"activate-google.servehttp.com","Domain used in the phishing attack",1,20170131
5890c521-f8f4-4df3-ab2c-07298e96ca05,89,Network activity,domain,"googlemaps.servehttp.com","Domain used in the phishing attack",1,20170131
1 uuid event_id category type value comment to_ids date
2 587cf53e-ee64-4e85-a4f5-0bbb8e96ca05 89 Network activity ip-dst 176.123.26.42 1 20170116
3 587cfa0f-0b54-44f1-9f4c-0bbb8e96ca05 89 Network activity ip-dst 108.61.176.96 IPs hosting phishing websites 1 20170116
4 587cfa22-d240-4c6a-ba53-0bbb8e96ca05 89 Network activity ip-dst 104.238.191.204 IP hosting phishing websites 1 20170116
5 588778af-1470-4b9e-a921-07288e96ca05 89 Network activity domain google-maps.servehttp.com Domains used in the phishing attack 1 20170124
6 588778af-1708-4caa-bef5-07288e96ca05 89 Network activity domain googledriver-sign.ddns.net Domains used in the phishing attack 1 20170124
7 588778af-2d08-493e-962a-07288e96ca05 89 Network activity domain googlesecure-serv.servehttp.com Domains used in the phishing attack 1 20170124
8 588778af-3604-4351-9e9e-07288e96ca05 89 Network activity domain googledrive-sign.servehttp.com Domains used in the phishing attack 1 20170124
9 588778af-3f6c-4a59-9c2f-07288e96ca05 89 Network activity domain fedex-sign.servehttp.com Domains used in the phishing attack 1 20170124
10 588778af-4184-41bd-932b-07288e96ca05 89 Network activity domain dropbox-sign.servehttp.com Domains used in the phishing attack 1 20170124
11 588778af-421c-4ab6-8fc9-07288e96ca05 89 Network activity domain verification-acc.servehttp.com Domains used in the phishing attack 1 20170124
12 588778af-4754-4997-9fdc-07288e96ca05 89 Network activity domain secure-team.servehttp.com Domains used in the phishing attack 1 20170124
13 588778af-4e10-41de-9d5b-07288e96ca05 89 Network activity domain dropbox-service.serveftp.com Domains used in the phishing attack 1 20170124
14 588778af-5614-4198-bfc8-07288e96ca05 89 Network activity domain fedex-mail.servehttp.com Domains used in the phishing attack 1 20170124
15 588778af-5724-4ccd-b5f0-07288e96ca05 89 Network activity domain aramex-shipping.servehttp.com Domains used in the phishing attack 1 20170124
16 588778af-7d08-4995-ae9d-07288e96ca05 89 Network activity domain myaccount.servehttp.com Domains used in the phishing attack 1 20170124
17 588778af-7ff4-4200-a7ee-07288e96ca05 89 Network activity domain security-myaccount.servehttp.com Domains used in the phishing attack 1 20170124
18 588778af-aaf4-49c7-9028-07288e96ca05 89 Network activity domain googleverify-signin.servehttp.com Domains used in the phishing attack 1 20170124
19 588778af-cf24-4254-ad98-07288e96ca05 89 Network activity domain account-google.serveftp.com Domains used in the phishing attack 1 20170124
20 588778af-d37c-406e-8703-07288e96ca05 89 Network activity domain fedex-shipping.servehttp.com Domains used in the phishing attack 1 20170124
21 588778af-d7e4-4b55-8b85-07288e96ca05 89 Network activity domain dropboxsupport.servehttp.com Domains used in the phishing attack 1 20170124
22 588778af-ea9c-4be6-a936-07288e96ca05 89 Network activity domain mailgooglesign.servehttp.com Domains used in the phishing attack 1 20170124
23 588778af-ee60-4f45-8efb-07288e96ca05 89 Network activity domain device-activation.servehttp.com Domains used in the phishing attack 1 20170124
24 588778af-f554-4b11-b19b-07288e96ca05 89 Network activity domain googlesignin.servehttp.com Domains used in the phishing attack 1 20170124
25 58877af7-3218-42ee-ab63-07288e96ca05 89 Network activity domain fedex-s.servehttp.com Related phishing domain 1 20170124
26 58877af7-c9f8-4198-acf2-07288e96ca05 89 Network activity domain watchyoutube.servehttp.com Related phishing domain 1 20170124
27 58877af7-e064-4ea8-8048-07288e96ca05 89 Network activity domain dropbox-verfy.servehttp.com Related phishing domain 1 20170124
28 58877ce3-2fa4-43b0-9be6-07298e96ca05 89 Network activity domain securityteam-notify.servehttp.com Related phishing domain 1 20170124
29 58877ce3-5b10-49d8-b03d-07298e96ca05 89 Network activity domain restricted-videos.servehttp.com Related phishing domain 1 20170124
30 58877ce3-5d28-4361-983f-07298e96ca05 89 Network activity domain fedex-notification.servehttp.com Related phishing domain 1 20170124
31 58877ce3-9b20-4e75-a2f1-07298e96ca05 89 Network activity domain quota-notification.servehttp.com Related phishing domain 1 20170124
32 58877ce3-acd4-4365-ac46-07298e96ca05 89 Network activity domain docs-mails.servehttp.com Related phishing domain 1 20170124
33 58877ce3-c1c4-40d8-baa5-07298e96ca05 89 Network activity domain verification-team.servehttp.com Related phishing domain 1 20170124
34 58877ce3-e2bc-4fc7-b7a0-07298e96ca05 89 Network activity domain notification-team.servehttp.com Related phishing domain 1 20170124
35 58877ce3-f668-4eb1-828a-07298e96ca05 89 Network activity domain dropboxnotification.servehttp.com Related phishing domain 1 20170124
36 58877ce3-fb60-4972-a691-07298e96ca05 89 Network activity domain secure-alert.servehttp.com Related phishing domain 1 20170124
37 5887a880-559c-4680-a403-0bbb8e96ca05 89 Network activity domain moi-gov.serveftp.com Related phishing domain 1 20170124
38 5890c466-51f8-425d-850f-07298e96ca05 89 Network activity domain activate-google.servehttp.com Domain used in the phishing attack 1 20170131
39 5890c521-f8f4-4df3-ab2c-07298e96ca05 89 Network activity domain googlemaps.servehttp.com Domain used in the phishing attack 1 20170131

1080
data/ioc/spyware/citizen_lab/201702_NilePhish/misp.json Normal file
View File

File diff suppressed because it is too large Load Diff

165
data/ioc/spyware/citizen_lab/201702_NilePhish/openioc.ioc Normal file
View File

@@ -0,0 +1,165 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="587cf513-b324-485c-b65e-07298e96ca05" last-modified="2017-01-16T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #89</short_description>
<description>Nile Phish - attacks again Egyptian civil society</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2017-01-16T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="587cf513-b324-485c-b65e-07298e96ca05">
<IndicatorItem id="account-google.serveftp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="aramex-shipping.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="device-activation.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dropbox-service.serveftp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dropbox-sign.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dropboxsupport.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fedex-mail.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fedex-shipping.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fedex-sign.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googledriver-sign.ddns.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googledrive-sign.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="google-maps.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googlesecure-serv.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googlesignin.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googleverify-signin.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mailgooglesign.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="myaccount.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="secure-team.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="security-myaccount.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="verification-acc.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dropbox-verfy.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fedex-s.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="watchyoutube.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="verification-team.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="securityteam-notify.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="secure-alert.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="quota-notification.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="notification-team.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fedex-notification.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="docs-mails.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="restricted-videos.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dropboxnotification.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="moi-gov.serveftp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="activate-google.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googlemaps.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="108.61.176.96" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="104.238.191.204" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="176.123.26.42" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

1249
data/ioc/spyware/citizen_lab/201702_NilePhish/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff

13
data/ioc/spyware/citizen_lab/201705_TaintedLeaks/iocs.csv Normal file
View File

@@ -0,0 +1,13 @@
uuid,event_id,category,type,value,comment,to_ids,date
5926f463-45f0-45c6-bf0a-53928e96ca05,100,Network activity,domain,mail-google-login.blogspot.com,,1,20170525
5926f463-8944-4fcc-b570-53928e96ca05,100,Network activity,domain,id9954.gq,,1,20170525
5926f463-9b30-4133-9f8a-53928e96ca05,100,Network activity,domain,id834.ga,,1,20170525
5926f463-a1dc-4042-a982-53928e96ca05,100,Network activity,domain,id4242.ga,,1,20170525
5926f463-dc78-4a45-ba38-53928e96ca05,100,Network activity,domain,id833.ga,,1,20170525
5926f463-f7d4-432d-b56a-53928e96ca05,100,Network activity,domain,com-securitysettingpage.tk,,1,20170525
5926f4a8-cb10-4528-89f8-5d828e96ca05,100,Network activity,ip-dst,80.255.12.237,,1,20170525
5926f4a8-cf18-4416-b85d-5d828e96ca05,100,Network activity,ip-dst,89.40.181.119,,1,20170525
5926f4a8-e18c-4b39-b0ac-5d828e96ca05,100,Network activity,ip-dst,89.32.40.238,,1,20170525
5926f504-4e00-4343-9488-5d828e96ca05,100,Payload delivery,email-src,g.mail2017@yandex.com,,1,20170525
5926f504-53f4-4700-8a2b-5d828e96ca05,100,Payload delivery,email-src,annaablony@mail.com,,1,20170525
5926f504-a840-4d0e-8d26-5d828e96ca05,100,Payload delivery,email-src,myprimaryreger@gmail.com,,1,20170525
1 uuid event_id category type value comment to_ids date
2 5926f463-45f0-45c6-bf0a-53928e96ca05 100 Network activity domain mail-google-login.blogspot.com 1 20170525
3 5926f463-8944-4fcc-b570-53928e96ca05 100 Network activity domain id9954.gq 1 20170525
4 5926f463-9b30-4133-9f8a-53928e96ca05 100 Network activity domain id834.ga 1 20170525
5 5926f463-a1dc-4042-a982-53928e96ca05 100 Network activity domain id4242.ga 1 20170525
6 5926f463-dc78-4a45-ba38-53928e96ca05 100 Network activity domain id833.ga 1 20170525
7 5926f463-f7d4-432d-b56a-53928e96ca05 100 Network activity domain com-securitysettingpage.tk 1 20170525
8 5926f4a8-cb10-4528-89f8-5d828e96ca05 100 Network activity ip-dst 80.255.12.237 1 20170525
9 5926f4a8-cf18-4416-b85d-5d828e96ca05 100 Network activity ip-dst 89.40.181.119 1 20170525
10 5926f4a8-e18c-4b39-b0ac-5d828e96ca05 100 Network activity ip-dst 89.32.40.238 1 20170525
11 5926f504-4e00-4343-9488-5d828e96ca05 100 Payload delivery email-src g.mail2017@yandex.com 1 20170525
12 5926f504-53f4-4700-8a2b-5d828e96ca05 100 Payload delivery email-src annaablony@mail.com 1 20170525
13 5926f504-a840-4d0e-8d26-5d828e96ca05 100 Payload delivery email-src myprimaryreger@gmail.com 1 20170525

294
data/ioc/spyware/citizen_lab/201705_TaintedLeaks/misp.json Normal file
View File

@@ -0,0 +1,294 @@
{"response":[{
"Event": {
"id": "100",
"orgc_id": "2",
"org_id": "2",
"date": "2017-05-25",
"threat_level_id": "2",
"info": "TAINTED LEAKS: Disinformation and Phishing With a Russian Nexus",
"published": true,
"uuid": "5926f385-8a58-4fc0-a075-5d828e96ca05",
"attribute_count": "12",
"analysis": "2",
"timestamp": "1495725316",
"distribution": "1",
"proposal_email_lock": false,
"locked": false,
"publish_timestamp": "1495725350",
"sharing_group_id": "0",
"Org": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
},
"Orgc": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
},
"Attribute": [
{
"id": "16046",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5926f463-dc78-4a45-ba38-53928e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725155",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "id833.ga",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16047",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5926f463-9b30-4133-9f8a-53928e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725155",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "id834.ga",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16048",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5926f463-8944-4fcc-b570-53928e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725155",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "id9954.gq",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16049",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5926f463-a1dc-4042-a982-53928e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725155",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "id4242.ga",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16050",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5926f463-45f0-45c6-bf0a-53928e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725155",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "mail-google-login.blogspot.com",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16051",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5926f463-f7d4-432d-b56a-53928e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725155",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "com-securitysettingpage.tk",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16055",
"type": "ip-dst",
"category": "Network activity",
"to_ids": true,
"uuid": "5926f4a8-cf18-4416-b85d-5d828e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725224",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "89.40.181.119",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16056",
"type": "ip-dst",
"category": "Network activity",
"to_ids": true,
"uuid": "5926f4a8-e18c-4b39-b0ac-5d828e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725224",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "89.32.40.238",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16057",
"type": "ip-dst",
"category": "Network activity",
"to_ids": true,
"uuid": "5926f4a8-cb10-4528-89f8-5d828e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725224",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "80.255.12.237",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16058",
"type": "email-src",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5926f504-4e00-4343-9488-5d828e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725316",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "g.mail2017@yandex.com",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16059",
"type": "email-src",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5926f504-53f4-4700-8a2b-5d828e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725316",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "annaablony@mail.com",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16060",
"type": "email-src",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5926f504-a840-4d0e-8d26-5d828e96ca05",
"event_id": "100",
"distribution": "5",
"timestamp": "1495725316",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "myprimaryreger@gmail.com",
"SharingGroup": [
],
"ShadowAttribute": [
]
}
],
"ShadowAttribute": [
],
"RelatedEvent": [
],
"Tag": [
{
"id": "5",
"name": "SOURCE:CITIZENLAB",
"colour": "#ffad0d",
"exportable": true,
"org_id": false
},
{
"id": "8",
"name": "PUBLISHED",
"colour": "#91caff",
"exportable": true,
"org_id": false
}
]
}
}]}

61
data/ioc/spyware/citizen_lab/201705_TaintedLeaks/openioc.ioc Normal file
View File

@@ -0,0 +1,61 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5926f385-8a58-4fc0-a075-5d828e96ca05" last-modified="2017-05-25T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #100</short_description>
<description>TAINTED LEAKS: Disinformation and Phishing With a Russian Nexus</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2017-05-25T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="5926f385-8a58-4fc0-a075-5d828e96ca05">
<IndicatorItem id="id833.ga" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="id834.ga" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="id9954.gq" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="id4242.ga" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mail-google-login.blogspot.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="com-securitysettingpage.tk" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="89.40.181.119" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="89.32.40.238" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="80.255.12.237" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="g.mail2017@yandex.com" condition="is">
<Context document="Email" search="Email/From" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="annaablony@mail.com" condition="is">
<Context document="Email" search="Email/From" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="myprimaryreger@gmail.com" condition="is">
<Context document="Email" search="Email/From" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

366
data/ioc/spyware/citizen_lab/201705_TaintedLeaks/stix.xml Normal file
View File

@@ -0,0 +1,366 @@
<stix:STIX_Package
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
xmlns:marking="http://data-marking.mitre.org/Marking-1"
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:indicator="http://stix.mitre.org/Indicator-2"
xmlns:ttp="http://stix.mitre.org/TTP-1"
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
xsi:schemaLocation="
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-b84be256-86f6-4616-905c-063f6f7bc5b7" version="1.1.1" timestamp="2017-05-25T15:20:50.437054+00:00">
<stix:STIX_Header>
<stix:Title>Export from MISP</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Related_Packages>
<stix:Related_Package>
<stix:Package id=":STIXPackage-5926f385-8a58-4fc0-a075-5d828e96ca05" version="1.1.1" timestamp="2017-05-25T11:15:16+00:00">
<stix:STIX_Header>
<stix:Title>TAINTED LEAKS: Disinformation and Phishing With a Russian Nexus (MISP Event #100)</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Incidents>
<stix:Incident id=":incident-5926f385-8a58-4fc0-a075-5d828e96ca05" timestamp="2017-05-25T11:15:50+00:00" xsi:type='incident:IncidentType'>
<incident:Title>TAINTED LEAKS: Disinformation and Phishing With a Russian Nexus</incident:Title>
<incident:External_ID source="MISP Event">100</incident:External_ID>
<incident:Time>
<incident:Incident_Discovery precision="second">2017-05-25T00:00:00+00:00</incident:Incident_Discovery>
<incident:Incident_Reported precision="second">2017-05-25T11:15:50+00:00</incident:Incident_Reported>
</incident:Time>
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
<incident:Related_Indicators>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f463-dc78-4a45-ba38-53928e96ca05" timestamp="2017-05-25T11:12:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: id833.ga (MISP Attribute #16046)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: id833.ga (MISP Attribute #16046)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f463-dc78-4a45-ba38-53928e96ca05">
<cybox:Object id=":DomainName-5926f463-dc78-4a45-ba38-53928e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">id833.ga</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:12:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f463-9b30-4133-9f8a-53928e96ca05" timestamp="2017-05-25T11:12:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: id834.ga (MISP Attribute #16047)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: id834.ga (MISP Attribute #16047)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f463-9b30-4133-9f8a-53928e96ca05">
<cybox:Object id=":DomainName-5926f463-9b30-4133-9f8a-53928e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">id834.ga</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:12:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f463-8944-4fcc-b570-53928e96ca05" timestamp="2017-05-25T11:12:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: id9954.gq (MISP Attribute #16048)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: id9954.gq (MISP Attribute #16048)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f463-8944-4fcc-b570-53928e96ca05">
<cybox:Object id=":DomainName-5926f463-8944-4fcc-b570-53928e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">id9954.gq</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:12:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f463-a1dc-4042-a982-53928e96ca05" timestamp="2017-05-25T11:12:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: id4242.ga (MISP Attribute #16049)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: id4242.ga (MISP Attribute #16049)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f463-a1dc-4042-a982-53928e96ca05">
<cybox:Object id=":DomainName-5926f463-a1dc-4042-a982-53928e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">id4242.ga</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:12:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f463-45f0-45c6-bf0a-53928e96ca05" timestamp="2017-05-25T11:12:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: mail-google-login.blogspot.com (MISP Attribute #16050)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: mail-google-login.blogspot.com (MISP Attribute #16050)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f463-45f0-45c6-bf0a-53928e96ca05">
<cybox:Object id=":DomainName-5926f463-45f0-45c6-bf0a-53928e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">mail-google-login.blogspot.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:12:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f463-f7d4-432d-b56a-53928e96ca05" timestamp="2017-05-25T11:12:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: com-securitysettingpage.tk (MISP Attribute #16051)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: com-securitysettingpage.tk (MISP Attribute #16051)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f463-f7d4-432d-b56a-53928e96ca05">
<cybox:Object id=":DomainName-5926f463-f7d4-432d-b56a-53928e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">com-securitysettingpage.tk</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:12:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f4a8-cf18-4416-b85d-5d828e96ca05" timestamp="2017-05-25T11:13:44+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 89.40.181.119 (MISP Attribute #16055)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 89.40.181.119 (MISP Attribute #16055)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f4a8-cf18-4416-b85d-5d828e96ca05">
<cybox:Object id=":Address-5926f4a8-cf18-4416-b85d-5d828e96ca05">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">89.40.181.119</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:13:44+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f4a8-e18c-4b39-b0ac-5d828e96ca05" timestamp="2017-05-25T11:13:44+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 89.32.40.238 (MISP Attribute #16056)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 89.32.40.238 (MISP Attribute #16056)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f4a8-e18c-4b39-b0ac-5d828e96ca05">
<cybox:Object id=":Address-5926f4a8-e18c-4b39-b0ac-5d828e96ca05">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">89.32.40.238</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:13:44+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f4a8-cb10-4528-89f8-5d828e96ca05" timestamp="2017-05-25T11:13:44+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: 80.255.12.237 (MISP Attribute #16057)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
<indicator:Description>Network activity: 80.255.12.237 (MISP Attribute #16057)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f4a8-cb10-4528-89f8-5d828e96ca05">
<cybox:Object id=":Address-5926f4a8-cb10-4528-89f8-5d828e96ca05">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
<AddressObj:Address_Value condition="Equals">80.255.12.237</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:13:44+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f504-4e00-4343-9488-5d828e96ca05" timestamp="2017-05-25T11:15:16+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: g.mail2017@yandex.com (MISP Attribute #16058)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
<indicator:Description>Payload delivery: g.mail2017@yandex.com (MISP Attribute #16058)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f504-4e00-4343-9488-5d828e96ca05">
<cybox:Object id=":EmailMessage-5926f504-4e00-4343-9488-5d828e96ca05">
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
<EmailMessageObj:Header>
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
<AddressObj:Address_Value condition="Equals">g.mail2017@yandex.com</AddressObj:Address_Value>
</EmailMessageObj:From>
</EmailMessageObj:Header>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:15:16+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f504-53f4-4700-8a2b-5d828e96ca05" timestamp="2017-05-25T11:15:16+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: annaablony@mail.com (MISP Attribute #16059)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
<indicator:Description>Payload delivery: annaablony@mail.com (MISP Attribute #16059)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f504-53f4-4700-8a2b-5d828e96ca05">
<cybox:Object id=":EmailMessage-5926f504-53f4-4700-8a2b-5d828e96ca05">
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
<EmailMessageObj:Header>
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
<AddressObj:Address_Value condition="Equals">annaablony@mail.com</AddressObj:Address_Value>
</EmailMessageObj:From>
</EmailMessageObj:Header>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:15:16+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5926f504-a840-4d0e-8d26-5d828e96ca05" timestamp="2017-05-25T11:15:16+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: myprimaryreger@gmail.com (MISP Attribute #16060)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
<indicator:Description>Payload delivery: myprimaryreger@gmail.com (MISP Attribute #16060)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5926f504-a840-4d0e-8d26-5d828e96ca05">
<cybox:Object id=":EmailMessage-5926f504-a840-4d0e-8d26-5d828e96ca05">
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
<EmailMessageObj:Header>
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
<AddressObj:Address_Value condition="Equals">myprimaryreger@gmail.com</AddressObj:Address_Value>
</EmailMessageObj:From>
</EmailMessageObj:Header>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-05-25T11:15:16+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
</incident:Related_Indicators>
<incident:History>
</incident:History>
<incident:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>citizenlab</stixCommon:Name>
</stixCommon:Identity>
</incident:Information_Source>
<incident:Handling>
<marking:Marking>
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
</marking:Marking>
</incident:Handling>
</stix:Incident>
</stix:Incidents>
</stix:Package>
</stix:Related_Package>
</stix:Related_Packages>
</stix:STIX_Package>

126
data/ioc/spyware/citizen_lab/201706_RecklessExploit/iocs.csv Normal file
View File

@@ -0,0 +1,126 @@
uuid,event_id,category,type,value,comment,to_ids,date
595140b9-6d24-4529-b5cb-06b28e96ca05,104,Network activity,domain,"iusacell-movil.com.mx","",1,20170626
595140b9-7ac8-4ae1-84ac-06b28e96ca05,104,Network activity,domain,"smscentro.com","",1,20170626
595140b9-7ed4-48c2-ad5b-06b28e96ca05,104,Network activity,domain,"twiitter.com.mx","",1,20170626
595140b9-8bf0-466f-a633-06b28e96ca05,104,Network activity,domain,"secure-access10.mx","",1,20170626
595140b9-a2cc-4642-be72-06b28e96ca05,104,Network activity,domain,"ideas-telcel.com.mx","",1,20170626
595140b9-bf04-4011-a222-06b28e96ca05,104,Network activity,domain,"smsmensaje.mx","",1,20170626
595140b9-d344-4943-8ee8-06b28e96ca05,104,Network activity,domain,"unonoticias.net","",1,20170626
595140b9-ea38-4167-af75-06b28e96ca05,104,Network activity,domain,"mymensaje-sms.com","",1,20170626
595140b9-fdf8-4877-ae89-06b28e96ca05,104,Network activity,domain,"fb-accounts.com","",1,20170626
595140b9-fee0-42c2-abc9-06b28e96ca05,104,Network activity,domain,"network190.com","",1,20170626
595141ad-0754-4b53-a851-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1MAAWrO","",1,20170626
595141ad-10ec-4896-8197-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1JW0JFQ","",1,20170626
595141ad-1198-4ef7-89ab-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Nz2RZe","",1,20170626
595141ad-136c-40a3-bf90-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1U0yzVG","",1,20170626
595141ad-17e0-4953-ae3e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1twXSDl","",1,20170626
595141ad-1a9c-4657-9043-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1EQYOkG","",1,20170626
595141ad-1ce8-4723-a8a7-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1KufGUy","",1,20170626
595141ad-2514-421a-86f7-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Nr0Vpb","",1,20170626
595141ad-2608-4458-8a3a-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1hMG15k","",1,20170626
595141ad-3fc4-49a7-a84a-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1TTjm6D","",1,20170626
595141ad-48bc-4d2b-a43d-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1QbgONr","",1,20170626
595141ad-4c4c-484b-b316-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1QYVJU9","",1,20170626
595141ad-4d6c-4191-96dd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1WzrZ8T","",1,20170626
595141ad-5060-4c84-b0e5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1X9kJRJ","",1,20170626
595141ad-5dac-47dc-81f3-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1LLY8oK","",1,20170626
595141ad-752c-4355-a7ca-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1MAzTZ7","",1,20170626
595141ad-77b0-4fc8-9cb0-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1JDkjuX","",1,20170626
595141ad-7858-4579-a385-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1NlM0ME","",1,20170626
595141ad-93c0-4169-828c-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1NzkyeZ","",1,20170626
595141ad-9750-4b3f-822b-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1O77vPb","",1,20170626
595141ad-d470-4103-b354-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1JzfmW1","",1,20170626
595141ad-e0e8-4d3d-a2f5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Wzryvp","",1,20170626
595141ad-e484-4c67-bb23-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1LLYT15","",1,20170626
595141ad-e780-479f-af9e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1SU5N7q","",1,20170626
595141ad-fca8-4841-b6e5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1KDekJ9","",1,20170626
595141ad-fe1c-4872-a3fd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1s2eguc","",1,20170626
595141ae-0cb8-4da3-9788-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1656017s/","",1,20170626
595141ae-0dbc-485c-9516-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/5957475s/","",1,20170626
595141ae-191c-4dad-a8df-06b38e96ca05,104,Payload delivery,url,"https://network190.com/8361397s/","",1,20170626
595141ae-1af0-4d3a-be93-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9371877s/","",1,20170626
595141ae-215c-4101-bdc5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/235giae","",1,20170626
595141ae-21ac-41b9-956c-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/2683786s/","",1,20170626
595141ae-24ec-488e-b0e8-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1239663s/","",1,20170626
595141ae-2bf8-4f1d-8ed0-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/4667624s/","",1,20170626
595141ae-2e38-4e91-a008-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/292heXd","",1,20170626
595141ae-3e2c-443b-ad7b-06b38e96ca05,104,Payload delivery,url,"http://mymensaje-sms.com/6649365s/","",1,20170626
595141ae-4054-47ba-b479-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/4878494s/","",1,20170626
595141ae-420c-4615-b723-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/1419678s/","",1,20170626
595141ae-4944-4ad9-a7af-06b38e96ca05,104,Payload delivery,url,"http://ideas-telcel.com.mx/7757294s","",1,20170626
595141ae-4aa8-4962-986c-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/[unavailable]","",1,20170626
595141ae-4be8-45c9-b2dc-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29eWzzv","",1,20170626
595141ae-4dc4-4d20-9726-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/3376811s/","",1,20170626
595141ae-5650-454d-b04a-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/7831163s/","",1,20170626
595141ae-593c-49e2-b5e2-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1331744s/","",1,20170626
595141ae-6aa4-4e7f-a9b3-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9439115s/","",1,20170626
595141ae-6b6c-4675-b743-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/4494681s/","",1,20170626
595141ae-6cec-4bb8-b0ec-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/5840625s/","",1,20170626
595141ae-7040-450e-97c7-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9093723s/","",1,20170626
595141ae-738c-4135-aa6c-06b38e96ca05,104,Payload delivery,url,"https://ideas-telcel.com.mx/5706662s","",1,20170626
595141ae-74b0-4be5-be10-06b38e96ca05,104,Payload delivery,url,"https://network190.com/2066781s/","",1,20170626
595141ae-7660-4301-91cd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/246doke","",1,20170626
595141ae-7874-44b6-8638-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/246dkRy","",1,20170626
595141ae-82a0-4fed-acdc-06b38e96ca05,104,Payload delivery,url,"https://network190.com/6214010s/","",1,20170626
595141ae-8354-4c49-b7a1-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1z2NQdh","",1,20170626
595141ae-83d4-45e0-960e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29eWFqz","",1,20170626
595141ae-8ca4-46f9-8c33-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/2a0hZ2l","",1,20170626
595141ae-8e00-41c6-825e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Xxf32k","",1,20170626
595141ae-909c-4d8d-948a-06b38e96ca05,104,Payload delivery,url,"https://fb-accounts.com/2408931s","",1,20170626
595141ae-929c-4c73-b5ae-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9936510s/","",1,20170626
595141ae-9418-41e9-aecc-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/8643330s/","",1,20170626
595141ae-a298-4139-a48b-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/1214510s/","",1,20170626
595141ae-a384-43c4-ae80-06b38e96ca05,104,Payload delivery,url,"http://fb-accounts.com/2069487s/","",1,20170626
595141ae-b058-4eb5-bb7b-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29lQvyh","",1,20170626
595141ae-b0cc-46ad-8fda-06b38e96ca05,104,Payload delivery,url,"https://secure-access10.mx/7161504s/","",1,20170626
595141ae-b384-4fc8-9951-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/3990495s/","",1,20170626
595141ae-b48c-4a93-9163-06b38e96ca05,104,Payload delivery,url,"http://ideas-telcel.com.mx/1930327s","",1,20170626
595141ae-b69c-4aaf-a217-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/6881768s/","",1,20170626
595141ae-b9e0-4327-aa26-06b38e96ca05,104,Payload delivery,url,"http://smscentro.com/9480260s/","",1,20170626
595141ae-c494-4b9b-9676-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/20Y9r10","",1,20170626
595141ae-c9ec-4d6b-aeb1-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1XFaS4F","",1,20170626
595141ae-cbe0-4757-a1a6-06b38e96ca05,104,Payload delivery,url,"https://secure-access10.mx/4257391s/","",1,20170626
595141ae-d08c-48ca-bd09-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/5478753s/","",1,20170626
595141ae-d118-4cfe-a0a4-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29LfZfD","",1,20170626
595141ae-d21c-4e4e-94b8-06b38e96ca05,104,Payload delivery,url,"http://ideas-telcel.com.mx/2110126s/","",1,20170626
595141ae-da5c-42a8-aea5-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/5732641s/","",1,20170626
595141ae-e008-472d-9d03-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/6445761s/","",1,20170626
595141ae-e034-48d6-83cf-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1493024s/","",1,20170626
595141ae-e150-4ab5-93d5-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1911343s/","",1,20170626
595141ae-e8f4-4c6b-9571-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/295RmfH","",1,20170626
595141ae-ea14-4684-adb1-06b38e96ca05,104,Payload delivery,url,"http://iusacell-movil.com.mx/7918310s/","",1,20170626
595141ae-eba4-4d12-bc80-06b38e96ca05,104,Payload delivery,url,"https://secure-access10.mx/2618844s/","",1,20170626
595141ae-efbc-487e-ae1a-06b38e96ca05,104,Payload delivery,url,"http://fb-accounts.com/1074139s/","",1,20170626
595141ae-f220-4bee-9df4-06b38e96ca05,104,Payload delivery,url,"http://iusacell-movil.com.mx/8595070s/","",1,20170626
595141ae-f250-4615-b9cd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/295RNq7","",1,20170626
595141ae-f278-41ad-9e79-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/25nmH1O","",1,20170626
595141ae-f498-4f27-bb20-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/7893029s/","",1,20170626
595141ae-f4f4-4f6d-9dbe-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/6056487s/","",1,20170626
595141ae-fa1c-4757-8946-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/8435662s/","",1,20170626
595141ae-fba4-4030-9c61-06b38e96ca05,104,Payload delivery,url,"https://ideas-telcel.com.mx/3975827s","",1,20170626
595141af-109c-49c0-a621-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/3651023s/","",1,20170626
595141af-1650-4b7a-a3f3-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/9250302s/","",1,20170626
595141af-1c0c-40a8-9059-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/5723329s/","",1,20170626
595141af-2dac-4f74-9717-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/9804185s/","",1,20170626
595141af-2e50-4760-826b-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/8592764s/","",1,20170626
595141af-3c6c-4adf-b195-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/5027740s/","",1,20170626
595141af-4e28-43e0-abb7-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/6843502s/","",1,20170626
595141af-4ed0-493c-abb8-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/5819525s/","",1,20170626
595141af-545c-45eb-8055-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/6809853s/","",1,20170626
595141af-64c8-4783-8cfc-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/8439927s/","",1,20170626
595141af-6b7c-430b-ac54-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/3423768s/","",1,20170626
595141af-73d4-45d1-aecd-06b38e96ca05,104,Payload delivery,url,"http://twiitter.com.mx/2857663s/","",1,20170626
595141af-75cc-4c7e-8e0a-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/1867745s/","",1,20170626
595141af-8adc-48ba-b585-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/1214510s/","",1,20170626
595141af-8d70-4703-8aab-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/6218095s/","",1,20170626
595141af-8e20-4a46-bf32-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/4709973s/","",1,20170626
595141af-a2c8-4f54-af98-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/4392216s/","",1,20170626
595141af-ae9c-46b6-bd19-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/5851721s/","",1,20170626
595141af-af04-42cd-8891-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/7564969s/","",1,20170626
595141af-b5e0-4b6e-a4ea-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/7972736s/","",1,20170626
595141af-d7c4-4ec4-b292-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/9436744s/","",1,20170626
595141af-dbd4-4aff-9733-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/2046803s/","",1,20170626
595141af-e238-48f1-8fdf-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/6532946s/","",1,20170626
595141af-e3dc-4232-b605-06b38e96ca05,104,Payload delivery,url,"http://tinyurl.com/j7luz86","",1,20170626
595141af-f744-4f14-825e-06b38e96ca05,104,Payload delivery,url,"http://tinyurl.com/o2tq8rl","",1,20170626
595141af-fc1c-407c-a526-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/8167459s/","",1,20170626
1 uuid event_id category type value comment to_ids date
2 595140b9-6d24-4529-b5cb-06b28e96ca05 104 Network activity domain iusacell-movil.com.mx 1 20170626
3 595140b9-7ac8-4ae1-84ac-06b28e96ca05 104 Network activity domain smscentro.com 1 20170626
4 595140b9-7ed4-48c2-ad5b-06b28e96ca05 104 Network activity domain twiitter.com.mx 1 20170626
5 595140b9-8bf0-466f-a633-06b28e96ca05 104 Network activity domain secure-access10.mx 1 20170626
6 595140b9-a2cc-4642-be72-06b28e96ca05 104 Network activity domain ideas-telcel.com.mx 1 20170626
7 595140b9-bf04-4011-a222-06b28e96ca05 104 Network activity domain smsmensaje.mx 1 20170626
8 595140b9-d344-4943-8ee8-06b28e96ca05 104 Network activity domain unonoticias.net 1 20170626
9 595140b9-ea38-4167-af75-06b28e96ca05 104 Network activity domain mymensaje-sms.com 1 20170626
10 595140b9-fdf8-4877-ae89-06b28e96ca05 104 Network activity domain fb-accounts.com 1 20170626
11 595140b9-fee0-42c2-abc9-06b28e96ca05 104 Network activity domain network190.com 1 20170626
12 595141ad-0754-4b53-a851-06b38e96ca05 104 Payload delivery url http://bit.ly/1MAAWrO 1 20170626
13 595141ad-10ec-4896-8197-06b38e96ca05 104 Payload delivery url http://bit.ly/1JW0JFQ 1 20170626
14 595141ad-1198-4ef7-89ab-06b38e96ca05 104 Payload delivery url http://bit.ly/1Nz2RZe 1 20170626
15 595141ad-136c-40a3-bf90-06b38e96ca05 104 Payload delivery url http://bit.ly/1U0yzVG 1 20170626
16 595141ad-17e0-4953-ae3e-06b38e96ca05 104 Payload delivery url http://bit.ly/1twXSDl 1 20170626
17 595141ad-1a9c-4657-9043-06b38e96ca05 104 Payload delivery url http://bit.ly/1EQYOkG 1 20170626
18 595141ad-1ce8-4723-a8a7-06b38e96ca05 104 Payload delivery url http://bit.ly/1KufGUy 1 20170626
19 595141ad-2514-421a-86f7-06b38e96ca05 104 Payload delivery url http://bit.ly/1Nr0Vpb 1 20170626
20 595141ad-2608-4458-8a3a-06b38e96ca05 104 Payload delivery url http://bit.ly/1hMG15k 1 20170626
21 595141ad-3fc4-49a7-a84a-06b38e96ca05 104 Payload delivery url http://bit.ly/1TTjm6D 1 20170626
22 595141ad-48bc-4d2b-a43d-06b38e96ca05 104 Payload delivery url http://bit.ly/1QbgONr 1 20170626
23 595141ad-4c4c-484b-b316-06b38e96ca05 104 Payload delivery url http://bit.ly/1QYVJU9 1 20170626
24 595141ad-4d6c-4191-96dd-06b38e96ca05 104 Payload delivery url http://bit.ly/1WzrZ8T 1 20170626
25 595141ad-5060-4c84-b0e5-06b38e96ca05 104 Payload delivery url http://bit.ly/1X9kJRJ 1 20170626
26 595141ad-5dac-47dc-81f3-06b38e96ca05 104 Payload delivery url http://bit.ly/1LLY8oK 1 20170626
27 595141ad-752c-4355-a7ca-06b38e96ca05 104 Payload delivery url http://bit.ly/1MAzTZ7 1 20170626
28 595141ad-77b0-4fc8-9cb0-06b38e96ca05 104 Payload delivery url http://bit.ly/1JDkjuX 1 20170626
29 595141ad-7858-4579-a385-06b38e96ca05 104 Payload delivery url http://bit.ly/1NlM0ME 1 20170626
30 595141ad-93c0-4169-828c-06b38e96ca05 104 Payload delivery url http://bit.ly/1NzkyeZ 1 20170626
31 595141ad-9750-4b3f-822b-06b38e96ca05 104 Payload delivery url http://bit.ly/1O77vPb 1 20170626
32 595141ad-d470-4103-b354-06b38e96ca05 104 Payload delivery url http://bit.ly/1JzfmW1 1 20170626
33 595141ad-e0e8-4d3d-a2f5-06b38e96ca05 104 Payload delivery url http://bit.ly/1Wzryvp 1 20170626
34 595141ad-e484-4c67-bb23-06b38e96ca05 104 Payload delivery url http://bit.ly/1LLYT15 1 20170626
35 595141ad-e780-479f-af9e-06b38e96ca05 104 Payload delivery url http://bit.ly/1SU5N7q 1 20170626
36 595141ad-fca8-4841-b6e5-06b38e96ca05 104 Payload delivery url http://bit.ly/1KDekJ9 1 20170626
37 595141ad-fe1c-4872-a3fd-06b38e96ca05 104 Payload delivery url http://bit.ly/1s2eguc 1 20170626
38 595141ae-0cb8-4da3-9788-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/1656017s/ 1 20170626
39 595141ae-0dbc-485c-9516-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/5957475s/ 1 20170626
40 595141ae-191c-4dad-a8df-06b38e96ca05 104 Payload delivery url https://network190.com/8361397s/ 1 20170626
41 595141ae-1af0-4d3a-be93-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/9371877s/ 1 20170626
42 595141ae-215c-4101-bdc5-06b38e96ca05 104 Payload delivery url http://bit.ly/235giae 1 20170626
43 595141ae-21ac-41b9-956c-06b38e96ca05 104 Payload delivery url https://smsmensaje.mx/2683786s/ 1 20170626
44 595141ae-24ec-488e-b0e8-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/1239663s/ 1 20170626
45 595141ae-2bf8-4f1d-8ed0-06b38e96ca05 104 Payload delivery url https://smsmensaje.mx/4667624s/ 1 20170626
46 595141ae-2e38-4e91-a008-06b38e96ca05 104 Payload delivery url http://bit.ly/292heXd 1 20170626
47 595141ae-3e2c-443b-ad7b-06b38e96ca05 104 Payload delivery url http://mymensaje-sms.com/6649365s/ 1 20170626
48 595141ae-4054-47ba-b479-06b38e96ca05 104 Payload delivery url https://smsmensaje.mx/4878494s/ 1 20170626
49 595141ae-420c-4615-b723-06b38e96ca05 104 Payload delivery url https://unonoticias.net/1419678s/ 1 20170626
50 595141ae-4944-4ad9-a7af-06b38e96ca05 104 Payload delivery url http://ideas-telcel.com.mx/7757294s 1 20170626
51 595141ae-4aa8-4962-986c-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/[unavailable] 1 20170626
52 595141ae-4be8-45c9-b2dc-06b38e96ca05 104 Payload delivery url http://bit.ly/29eWzzv 1 20170626
53 595141ae-4dc4-4d20-9726-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/3376811s/ 1 20170626
54 595141ae-5650-454d-b04a-06b38e96ca05 104 Payload delivery url https://smsmensaje.mx/7831163s/ 1 20170626
55 595141ae-593c-49e2-b5e2-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/1331744s/ 1 20170626
56 595141ae-6aa4-4e7f-a9b3-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/9439115s/ 1 20170626
57 595141ae-6b6c-4675-b743-06b38e96ca05 104 Payload delivery url https://smsmensaje.mx/4494681s/ 1 20170626
58 595141ae-6cec-4bb8-b0ec-06b38e96ca05 104 Payload delivery url https://smsmensaje.mx/5840625s/ 1 20170626
59 595141ae-7040-450e-97c7-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/9093723s/ 1 20170626
60 595141ae-738c-4135-aa6c-06b38e96ca05 104 Payload delivery url https://ideas-telcel.com.mx/5706662s 1 20170626
61 595141ae-74b0-4be5-be10-06b38e96ca05 104 Payload delivery url https://network190.com/2066781s/ 1 20170626
62 595141ae-7660-4301-91cd-06b38e96ca05 104 Payload delivery url http://bit.ly/246doke 1 20170626
63 595141ae-7874-44b6-8638-06b38e96ca05 104 Payload delivery url http://bit.ly/246dkRy 1 20170626
64 595141ae-82a0-4fed-acdc-06b38e96ca05 104 Payload delivery url https://network190.com/6214010s/ 1 20170626
65 595141ae-8354-4c49-b7a1-06b38e96ca05 104 Payload delivery url http://bit.ly/1z2NQdh 1 20170626
66 595141ae-83d4-45e0-960e-06b38e96ca05 104 Payload delivery url http://bit.ly/29eWFqz 1 20170626
67 595141ae-8ca4-46f9-8c33-06b38e96ca05 104 Payload delivery url http://bit.ly/2a0hZ2l 1 20170626
68 595141ae-8e00-41c6-825e-06b38e96ca05 104 Payload delivery url http://bit.ly/1Xxf32k 1 20170626
69 595141ae-909c-4d8d-948a-06b38e96ca05 104 Payload delivery url https://fb-accounts.com/2408931s 1 20170626
70 595141ae-929c-4c73-b5ae-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/9936510s/ 1 20170626
71 595141ae-9418-41e9-aecc-06b38e96ca05 104 Payload delivery url https://smsmensaje.mx/8643330s/ 1 20170626
72 595141ae-a298-4139-a48b-06b38e96ca05 104 Payload delivery url https://unonoticias.net/1214510s/ 1 20170626
73 595141ae-a384-43c4-ae80-06b38e96ca05 104 Payload delivery url http://fb-accounts.com/2069487s/ 1 20170626
74 595141ae-b058-4eb5-bb7b-06b38e96ca05 104 Payload delivery url http://bit.ly/29lQvyh 1 20170626
75 595141ae-b0cc-46ad-8fda-06b38e96ca05 104 Payload delivery url https://secure-access10.mx/7161504s/ 1 20170626
76 595141ae-b384-4fc8-9951-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/3990495s/ 1 20170626
77 595141ae-b48c-4a93-9163-06b38e96ca05 104 Payload delivery url http://ideas-telcel.com.mx/1930327s 1 20170626
78 595141ae-b69c-4aaf-a217-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/6881768s/ 1 20170626
79 595141ae-b9e0-4327-aa26-06b38e96ca05 104 Payload delivery url http://smscentro.com/9480260s/ 1 20170626
80 595141ae-c494-4b9b-9676-06b38e96ca05 104 Payload delivery url http://bit.ly/20Y9r10 1 20170626
81 595141ae-c9ec-4d6b-aeb1-06b38e96ca05 104 Payload delivery url http://bit.ly/1XFaS4F 1 20170626
82 595141ae-cbe0-4757-a1a6-06b38e96ca05 104 Payload delivery url https://secure-access10.mx/4257391s/ 1 20170626
83 595141ae-d08c-48ca-bd09-06b38e96ca05 104 Payload delivery url https://smsmensaje.mx/5478753s/ 1 20170626
84 595141ae-d118-4cfe-a0a4-06b38e96ca05 104 Payload delivery url http://bit.ly/29LfZfD 1 20170626
85 595141ae-d21c-4e4e-94b8-06b38e96ca05 104 Payload delivery url http://ideas-telcel.com.mx/2110126s/ 1 20170626
86 595141ae-da5c-42a8-aea5-06b38e96ca05 104 Payload delivery url https://smsmensaje.mx/5732641s/ 1 20170626
87 595141ae-e008-472d-9d03-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/6445761s/ 1 20170626
88 595141ae-e034-48d6-83cf-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/1493024s/ 1 20170626
89 595141ae-e150-4ab5-93d5-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/1911343s/ 1 20170626
90 595141ae-e8f4-4c6b-9571-06b38e96ca05 104 Payload delivery url http://bit.ly/295RmfH 1 20170626
91 595141ae-ea14-4684-adb1-06b38e96ca05 104 Payload delivery url http://iusacell-movil.com.mx/7918310s/ 1 20170626
92 595141ae-eba4-4d12-bc80-06b38e96ca05 104 Payload delivery url https://secure-access10.mx/2618844s/ 1 20170626
93 595141ae-efbc-487e-ae1a-06b38e96ca05 104 Payload delivery url http://fb-accounts.com/1074139s/ 1 20170626
94 595141ae-f220-4bee-9df4-06b38e96ca05 104 Payload delivery url http://iusacell-movil.com.mx/8595070s/ 1 20170626
95 595141ae-f250-4615-b9cd-06b38e96ca05 104 Payload delivery url http://bit.ly/295RNq7 1 20170626
96 595141ae-f278-41ad-9e79-06b38e96ca05 104 Payload delivery url http://bit.ly/25nmH1O 1 20170626
97 595141ae-f498-4f27-bb20-06b38e96ca05 104 Payload delivery url https://smsmensaje.mx/7893029s/ 1 20170626
98 595141ae-f4f4-4f6d-9dbe-06b38e96ca05 104 Payload delivery url http://smsmensaje.mx/6056487s/ 1 20170626
99 595141ae-fa1c-4757-8946-06b38e96ca05 104 Payload delivery url https://smsmensaje.mx/8435662s/ 1 20170626
100 595141ae-fba4-4030-9c61-06b38e96ca05 104 Payload delivery url https://ideas-telcel.com.mx/3975827s 1 20170626
101 595141af-109c-49c0-a621-06b38e96ca05 104 Payload delivery url https://unonoticias.net/3651023s/ 1 20170626
102 595141af-1650-4b7a-a3f3-06b38e96ca05 104 Payload delivery url http://unonoticias.net/9250302s/ 1 20170626
103 595141af-1c0c-40a8-9059-06b38e96ca05 104 Payload delivery url https://unonoticias.net/5723329s/ 1 20170626
104 595141af-2dac-4f74-9717-06b38e96ca05 104 Payload delivery url http://unonoticias.net/9804185s/ 1 20170626
105 595141af-2e50-4760-826b-06b38e96ca05 104 Payload delivery url https://unonoticias.net/8592764s/ 1 20170626
106 595141af-3c6c-4adf-b195-06b38e96ca05 104 Payload delivery url https://unonoticias.net/5027740s/ 1 20170626
107 595141af-4e28-43e0-abb7-06b38e96ca05 104 Payload delivery url https://unonoticias.net/6843502s/ 1 20170626
108 595141af-4ed0-493c-abb8-06b38e96ca05 104 Payload delivery url http://unonoticias.net/5819525s/ 1 20170626
109 595141af-545c-45eb-8055-06b38e96ca05 104 Payload delivery url https://unonoticias.net/6809853s/ 1 20170626
110 595141af-64c8-4783-8cfc-06b38e96ca05 104 Payload delivery url https://unonoticias.net/8439927s/ 1 20170626
111 595141af-6b7c-430b-ac54-06b38e96ca05 104 Payload delivery url http://unonoticias.net/3423768s/ 1 20170626
112 595141af-73d4-45d1-aecd-06b38e96ca05 104 Payload delivery url http://twiitter.com.mx/2857663s/ 1 20170626
113 595141af-75cc-4c7e-8e0a-06b38e96ca05 104 Payload delivery url https://unonoticias.net/1867745s/ 1 20170626
114 595141af-8adc-48ba-b585-06b38e96ca05 104 Payload delivery url http://unonoticias.net/1214510s/ 1 20170626
115 595141af-8d70-4703-8aab-06b38e96ca05 104 Payload delivery url http://unonoticias.net/6218095s/ 1 20170626
116 595141af-8e20-4a46-bf32-06b38e96ca05 104 Payload delivery url https://unonoticias.net/4709973s/ 1 20170626
117 595141af-a2c8-4f54-af98-06b38e96ca05 104 Payload delivery url https://unonoticias.net/4392216s/ 1 20170626
118 595141af-ae9c-46b6-bd19-06b38e96ca05 104 Payload delivery url https://unonoticias.net/5851721s/ 1 20170626
119 595141af-af04-42cd-8891-06b38e96ca05 104 Payload delivery url https://unonoticias.net/7564969s/ 1 20170626
120 595141af-b5e0-4b6e-a4ea-06b38e96ca05 104 Payload delivery url https://unonoticias.net/7972736s/ 1 20170626
121 595141af-d7c4-4ec4-b292-06b38e96ca05 104 Payload delivery url https://unonoticias.net/9436744s/ 1 20170626
122 595141af-dbd4-4aff-9733-06b38e96ca05 104 Payload delivery url https://unonoticias.net/2046803s/ 1 20170626
123 595141af-e238-48f1-8fdf-06b38e96ca05 104 Payload delivery url https://unonoticias.net/6532946s/ 1 20170626
124 595141af-e3dc-4232-b605-06b38e96ca05 104 Payload delivery url http://tinyurl.com/j7luz86 1 20170626
125 595141af-f744-4f14-825e-06b38e96ca05 104 Payload delivery url http://tinyurl.com/o2tq8rl 1 20170626
126 595141af-fc1c-407c-a526-06b38e96ca05 104 Payload delivery url https://unonoticias.net/8167459s/ 1 20170626

2679
data/ioc/spyware/citizen_lab/201706_RecklessExploit/misp.json Normal file
View File

File diff suppressed because it is too large Load Diff

513
data/ioc/spyware/citizen_lab/201706_RecklessExploit/openioc.ioc Normal file
View File

@@ -0,0 +1,513 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="59513ebe-4144-4e2d-8670-06b38e96ca05" last-modified="2017-06-26T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #104</short_description>
<description>Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2017-06-26T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="59513ebe-4144-4e2d-8670-06b38e96ca05">
<IndicatorItem id="ideas-telcel.com.mx" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="iusacell-movil.com.mx" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mymensaje-sms.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="network190.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="secure-access10.mx" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="smscentro.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="smsmensaje.mx" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="twiitter.com.mx" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="unonoticias.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fb-accounts.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1EQYOkG" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1hMG15k" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1JDkjuX" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1JW0JFQ" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1JzfmW1" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1KDekJ9" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1KufGUy" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1LLY8oK" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1LLYT15" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1MAAWrO" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1MAzTZ7" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1NlM0ME" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1Nr0Vpb" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1Nz2RZe" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1NzkyeZ" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1O77vPb" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1QbgONr" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1QYVJU9" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1s2eguc" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1SU5N7q" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1TTjm6D" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1twXSDl" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1U0yzVG" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1Wzryvp" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1WzrZ8T" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1X9kJRJ" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1XFaS4F" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1Xxf32k" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1z2NQdh" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/20Y9r10" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/235giae" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/246dkRy" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/246doke" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/25nmH1O" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/292heXd" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/295RmfH" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/295RNq7" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/29eWFqz" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/29eWzzv" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/29LfZfD" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/29lQvyh" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/2a0hZ2l" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://fb-accounts.com/1074139s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://fb-accounts.com/2069487s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://ideas-telcel.com.mx/1930327s" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://ideas-telcel.com.mx/2110126s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://ideas-telcel.com.mx/7757294s" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://iusacell-movil.com.mx/7918310s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://iusacell-movil.com.mx/8595070s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://mymensaje-sms.com/6649365s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://fb-accounts.com/2408931s" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://ideas-telcel.com.mx/3975827s" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://ideas-telcel.com.mx/5706662s" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smscentro.com/9480260s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/1239663s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/1331744s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/1493024s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/1656017s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/1911343s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/3376811s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/3990495s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/5957475s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/6056487s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/6445761s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/6881768s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/9093723s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/9371877s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/9439115s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/9936510s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://smsmensaje.mx/[unavailable]" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://network190.com/2066781s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://network190.com/6214010s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://network190.com/8361397s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://secure-access10.mx/2618844s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://secure-access10.mx/4257391s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://secure-access10.mx/7161504s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/2683786s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/4494681s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/4667624s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/4878494s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/5478753s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/5732641s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/5840625s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/7831163s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/7893029s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/8435662s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/8643330s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/1214510s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/1419678s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/1867745s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/2046803s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/3651023s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/4392216s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/4709973s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/5027740s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/5723329s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/5851721s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/6532946s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/6809853s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/6843502s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/7564969s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/7972736s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/8167459s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/8439927s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/8592764s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://unonoticias.net/9436744s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://tinyurl.com/j7luz86" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://tinyurl.com/o2tq8rl" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://twiitter.com.mx/2857663s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://unonoticias.net/1214510s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://unonoticias.net/3423768s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://unonoticias.net/5819525s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://unonoticias.net/6218095s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://unonoticias.net/9250302s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://unonoticias.net/9804185s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

2766
data/ioc/spyware/citizen_lab/201706_RecklessExploit/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff

10
data/ioc/spyware/citizen_lab/201706_RecklessRedux/iocs.csv Normal file
View File

@@ -0,0 +1,10 @@
uuid,event_id,category,type,value,comment,to_ids,date
59550c2c-0184-45e7-935a-06b28e96ca05,107,Network activity,url,"https://smsmensaje.mx/1351276s/","",1,20170629
59550c2c-3820-4007-8f14-06b28e96ca05,107,Network activity,url,"https://smsmensaje.mx/8306090s/","",1,20170629
59550c2c-7530-43d1-96c0-06b28e96ca05,107,Network activity,url,"http://bit.ly/1WONumj","",1,20170629
59550c2c-9e44-4b22-b65a-06b28e96ca05,107,Network activity,url,"https://smsmensaje.mx/9993247s/","",1,20170629
59550c2c-a2f8-4861-af47-06b28e96ca05,107,Network activity,url,"http://bit.ly/1WRYHm8","",1,20170629
59550c2c-aa30-4e89-831d-06b28e96ca05,107,Network activity,url,"https://smsmensaje.mx/4995075s/","",1,20170629
59550c2c-d8dc-4c5c-a8e7-06b28e96ca05,107,Network activity,url,"http://bit.ly/29F2psM","",1,20170629
59550c2c-ef48-4348-902f-06b28e96ca05,107,Network activity,url,"http://bit.ly/1UUsVi6","",1,20170629
59550c3b-22ac-4348-add4-06b38e96ca05,107,Network activity,domain,"smsmensaje.mx","",1,20170629
1 uuid event_id category type value comment to_ids date
2 59550c2c-0184-45e7-935a-06b28e96ca05 107 Network activity url https://smsmensaje.mx/1351276s/ 1 20170629
3 59550c2c-3820-4007-8f14-06b28e96ca05 107 Network activity url https://smsmensaje.mx/8306090s/ 1 20170629
4 59550c2c-7530-43d1-96c0-06b28e96ca05 107 Network activity url http://bit.ly/1WONumj 1 20170629
5 59550c2c-9e44-4b22-b65a-06b28e96ca05 107 Network activity url https://smsmensaje.mx/9993247s/ 1 20170629
6 59550c2c-a2f8-4861-af47-06b28e96ca05 107 Network activity url http://bit.ly/1WRYHm8 1 20170629
7 59550c2c-aa30-4e89-831d-06b28e96ca05 107 Network activity url https://smsmensaje.mx/4995075s/ 1 20170629
8 59550c2c-d8dc-4c5c-a8e7-06b28e96ca05 107 Network activity url http://bit.ly/29F2psM 1 20170629
9 59550c2c-ef48-4348-902f-06b28e96ca05 107 Network activity url http://bit.ly/1UUsVi6 1 20170629
10 59550c3b-22ac-4348-add4-06b38e96ca05 107 Network activity domain smsmensaje.mx 1 20170629

282
data/ioc/spyware/citizen_lab/201706_RecklessRedux/misp.json Normal file
View File

@@ -0,0 +1,282 @@
{"response":[{
"Event": {
"id": "107",
"orgc_id": "2",
"org_id": "2",
"date": "2017-06-29",
"threat_level_id": "2",
"info": "Reckless Redux: Senior Mexican Legislators and Politicians Targeted with NSO Spyware",
"published": true,
"uuid": "59550bab-3ce0-48c3-ba55-06b28e96ca05",
"attribute_count": "9",
"analysis": "2",
"timestamp": "1498745915",
"distribution": "1",
"proposal_email_lock": false,
"locked": false,
"publish_timestamp": "1498745924",
"sharing_group_id": "0",
"Org": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
},
"Orgc": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
},
"Attribute": [
{
"id": "16345",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "59550c3b-22ac-4348-add4-06b38e96ca05",
"event_id": "107",
"distribution": "5",
"timestamp": "1498745915",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "smsmensaje.mx",
"SharingGroup": [
],
"ShadowAttribute": [
],
"RelatedAttribute": [
{
"Attribute": {
"id": "104",
"org_id": "2",
"info": "Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware",
"value": "smsmensaje.mx"
}
}
]
},
{
"id": "16337",
"type": "url",
"category": "Network activity",
"to_ids": true,
"uuid": "59550c2c-d8dc-4c5c-a8e7-06b28e96ca05",
"event_id": "107",
"distribution": "5",
"timestamp": "1498745900",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "http:\/\/bit.ly\/29F2psM",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16338",
"type": "url",
"category": "Network activity",
"to_ids": true,
"uuid": "59550c2c-3820-4007-8f14-06b28e96ca05",
"event_id": "107",
"distribution": "5",
"timestamp": "1498745900",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "https:\/\/smsmensaje.mx\/8306090s\/",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16339",
"type": "url",
"category": "Network activity",
"to_ids": true,
"uuid": "59550c2c-7530-43d1-96c0-06b28e96ca05",
"event_id": "107",
"distribution": "5",
"timestamp": "1498745900",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "http:\/\/bit.ly\/1WONumj",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16340",
"type": "url",
"category": "Network activity",
"to_ids": true,
"uuid": "59550c2c-aa30-4e89-831d-06b28e96ca05",
"event_id": "107",
"distribution": "5",
"timestamp": "1498745900",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "https:\/\/smsmensaje.mx\/4995075s\/",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16341",
"type": "url",
"category": "Network activity",
"to_ids": true,
"uuid": "59550c2c-a2f8-4861-af47-06b28e96ca05",
"event_id": "107",
"distribution": "5",
"timestamp": "1498745900",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "http:\/\/bit.ly\/1WRYHm8",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16342",
"type": "url",
"category": "Network activity",
"to_ids": true,
"uuid": "59550c2c-0184-45e7-935a-06b28e96ca05",
"event_id": "107",
"distribution": "5",
"timestamp": "1498745900",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "https:\/\/smsmensaje.mx\/1351276s\/",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16343",
"type": "url",
"category": "Network activity",
"to_ids": true,
"uuid": "59550c2c-ef48-4348-902f-06b28e96ca05",
"event_id": "107",
"distribution": "5",
"timestamp": "1498745900",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "http:\/\/bit.ly\/1UUsVi6",
"SharingGroup": [
],
"ShadowAttribute": [
]
},
{
"id": "16344",
"type": "url",
"category": "Network activity",
"to_ids": true,
"uuid": "59550c2c-9e44-4b22-b65a-06b28e96ca05",
"event_id": "107",
"distribution": "5",
"timestamp": "1498745900",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "https:\/\/smsmensaje.mx\/9993247s\/",
"SharingGroup": [
],
"ShadowAttribute": [
]
}
],
"ShadowAttribute": [
],
"RelatedEvent": [
{
"Event": {
"id": "104",
"date": "2017-06-26",
"threat_level_id": "1",
"info": "Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware",
"published": true,
"uuid": "59513ebe-4144-4e2d-8670-06b38e96ca05",
"analysis": "2",
"timestamp": "1498497838",
"distribution": "1",
"org_id": "2",
"orgc_id": "2"
},
"Org": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
},
"Orgc": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
}
}
],
"Tag": [
{
"id": "5",
"name": "SOURCE:CITIZENLAB",
"colour": "#ffad0d",
"exportable": true,
"org_id": false
},
{
"id": "8",
"name": "PUBLISHED",
"colour": "#91caff",
"exportable": true,
"org_id": false
},
{
"id": "16",
"name": "TLP:WHITE",
"colour": "#e8e8e8",
"exportable": true,
"org_id": false
},
{
"id": "39",
"name": "TARGET:MEXICO",
"colour": "#056685",
"exportable": true,
"org_id": false
}
]
}
}]}

49
data/ioc/spyware/citizen_lab/201706_RecklessRedux/openioc.ioc Normal file
View File

@@ -0,0 +1,49 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="59550bab-3ce0-48c3-ba55-06b28e96ca05" last-modified="2017-06-29T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #107</short_description>
<description>Reckless Redux: Senior Mexican Legislators and Politicians Targeted with NSO Spyware</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2017-06-29T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="59550bab-3ce0-48c3-ba55-06b28e96ca05">
<IndicatorItem id="smsmensaje.mx" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/29F2psM" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/8306090s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1WONumj" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/4995075s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1WRYHm8" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/1351276s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://bit.ly/1UUsVi6" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="https://smsmensaje.mx/9993247s/" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

306
data/ioc/spyware/citizen_lab/201706_RecklessRedux/stix.xml Normal file
View File

@@ -0,0 +1,306 @@
<stix:STIX_Package
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
xmlns:marking="http://data-marking.mitre.org/Marking-1"
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:indicator="http://stix.mitre.org/Indicator-2"
xmlns:ttp="http://stix.mitre.org/TTP-1"
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
xsi:schemaLocation="
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-ef74f3fb-1f61-4d13-852d-918cfdea5669" version="1.1.1" timestamp="2017-06-29T14:41:32.031817+00:00">
<stix:STIX_Header>
<stix:Title>Export from MISP</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Related_Packages>
<stix:Related_Package>
<stix:Package id=":STIXPackage-59550bab-3ce0-48c3-ba55-06b28e96ca05" version="1.1.1" timestamp="2017-06-29T10:18:35+00:00">
<stix:STIX_Header>
<stix:Title>Reckless Redux: Senior Mexican Legislators and Politicians Targeted with NSO Spyware (MISP Event #107)</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Incidents>
<stix:Incident id=":incident-59550bab-3ce0-48c3-ba55-06b28e96ca05" timestamp="2017-06-29T10:18:44+00:00" xsi:type='incident:IncidentType'>
<incident:Title>Reckless Redux: Senior Mexican Legislators and Politicians Targeted with NSO Spyware</incident:Title>
<incident:External_ID source="MISP Event">107</incident:External_ID>
<incident:Time>
<incident:Incident_Discovery precision="second">2017-06-29T00:00:00+00:00</incident:Incident_Discovery>
<incident:Incident_Reported precision="second">2017-06-29T10:18:44+00:00</incident:Incident_Reported>
</incident:Time>
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
<incident:Related_Indicators>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-59550c3b-22ac-4348-add4-06b38e96ca05" timestamp="2017-06-29T10:18:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: smsmensaje.mx (MISP Attribute #16345)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: smsmensaje.mx (MISP Attribute #16345)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-59550c3b-22ac-4348-add4-06b38e96ca05">
<cybox:Object id=":DomainName-59550c3b-22ac-4348-add4-06b38e96ca05">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">smsmensaje.mx</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-06-29T10:18:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-59550c2c-d8dc-4c5c-a8e7-06b28e96ca05" timestamp="2017-06-29T10:18:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://bit.ly/29F2psM (MISP Attribute #16337)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://bit.ly/29F2psM (MISP Attribute #16337)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-59550c2c-d8dc-4c5c-a8e7-06b28e96ca05">
<cybox:Object id=":URI-59550c2c-d8dc-4c5c-a8e7-06b28e96ca05">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://bit.ly/29F2psM</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-06-29T10:18:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-59550c2c-3820-4007-8f14-06b28e96ca05" timestamp="2017-06-29T10:18:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: https://smsmensaje.mx/8306090s/ (MISP Attribute #16338)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: https://smsmensaje.mx/8306090s/ (MISP Attribute #16338)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-59550c2c-3820-4007-8f14-06b28e96ca05">
<cybox:Object id=":URI-59550c2c-3820-4007-8f14-06b28e96ca05">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">https://smsmensaje.mx/8306090s/</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-06-29T10:18:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-59550c2c-7530-43d1-96c0-06b28e96ca05" timestamp="2017-06-29T10:18:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://bit.ly/1WONumj (MISP Attribute #16339)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://bit.ly/1WONumj (MISP Attribute #16339)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-59550c2c-7530-43d1-96c0-06b28e96ca05">
<cybox:Object id=":URI-59550c2c-7530-43d1-96c0-06b28e96ca05">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://bit.ly/1WONumj</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-06-29T10:18:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-59550c2c-aa30-4e89-831d-06b28e96ca05" timestamp="2017-06-29T10:18:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: https://smsmensaje.mx/4995075s/ (MISP Attribute #16340)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: https://smsmensaje.mx/4995075s/ (MISP Attribute #16340)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-59550c2c-aa30-4e89-831d-06b28e96ca05">
<cybox:Object id=":URI-59550c2c-aa30-4e89-831d-06b28e96ca05">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">https://smsmensaje.mx/4995075s/</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-06-29T10:18:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-59550c2c-a2f8-4861-af47-06b28e96ca05" timestamp="2017-06-29T10:18:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://bit.ly/1WRYHm8 (MISP Attribute #16341)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://bit.ly/1WRYHm8 (MISP Attribute #16341)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-59550c2c-a2f8-4861-af47-06b28e96ca05">
<cybox:Object id=":URI-59550c2c-a2f8-4861-af47-06b28e96ca05">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://bit.ly/1WRYHm8</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-06-29T10:18:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-59550c2c-0184-45e7-935a-06b28e96ca05" timestamp="2017-06-29T10:18:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: https://smsmensaje.mx/1351276s/ (MISP Attribute #16342)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: https://smsmensaje.mx/1351276s/ (MISP Attribute #16342)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-59550c2c-0184-45e7-935a-06b28e96ca05">
<cybox:Object id=":URI-59550c2c-0184-45e7-935a-06b28e96ca05">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">https://smsmensaje.mx/1351276s/</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-06-29T10:18:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-59550c2c-ef48-4348-902f-06b28e96ca05" timestamp="2017-06-29T10:18:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: http://bit.ly/1UUsVi6 (MISP Attribute #16343)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: http://bit.ly/1UUsVi6 (MISP Attribute #16343)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-59550c2c-ef48-4348-902f-06b28e96ca05">
<cybox:Object id=":URI-59550c2c-ef48-4348-902f-06b28e96ca05">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">http://bit.ly/1UUsVi6</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-06-29T10:18:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-59550c2c-9e44-4b22-b65a-06b28e96ca05" timestamp="2017-06-29T10:18:20+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: https://smsmensaje.mx/9993247s/ (MISP Attribute #16344)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
<indicator:Description>Network activity: https://smsmensaje.mx/9993247s/ (MISP Attribute #16344)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-59550c2c-9e44-4b22-b65a-06b28e96ca05">
<cybox:Object id=":URI-59550c2c-9e44-4b22-b65a-06b28e96ca05">
<cybox:Properties xsi:type="URIObj:URIObjectType">
<URIObj:Value condition="Equals">https://smsmensaje.mx/9993247s/</URIObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2017-06-29T10:18:20+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
</incident:Related_Indicators>
<incident:History>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">Event Threat Level: Medium</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: PUBLISHED</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: TLP:WHITE</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: TARGET:MEXICO</incident:Journal_Entry>
</incident:History_Item>
</incident:History>
<incident:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>citizenlab</stixCommon:Name>
</stixCommon:Identity>
</incident:Information_Source>
<incident:Handling>
<marking:Marking>
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
</marking:Marking>
</incident:Handling>
</stix:Incident>
</stix:Incidents>
</stix:Package>
</stix:Related_Package>
</stix:Related_Packages>
</stix:STIX_Package>

48
data/ioc/spyware/citizen_lab/201707_InsiderInfo/indicators.csv Normal file
View File

@@ -0,0 +1,48 @@
uuid,event_id,category,type,value,comment,to_ids,date
595baf52-2a08-4576-9f76-06e38e96ca05,108,Payload delivery,email-src,"aisia.anminda8@mail.com","",0,20170704
595baf52-7340-4840-bda0-06e38e96ca05,108,Payload delivery,email-src,"hellomice@mail.com","",0,20170704
595baf7a-6598-4ecc-ba74-06e28e96ca05,108,Payload delivery,url,"http://43.240.14.37/asdasdasadqddd12222111.php/article.asp","",1,20170704
595bafa7-2d34-43d7-87a1-06e38e96ca05,108,Payload delivery,url,"http://chinadagitaltimes.net/2016/07/chinese-hackers-blamed-multiple-breaches-fdic","",1,20170704
595bafe1-e518-4bfb-9701-06e28e96ca05,108,Payload delivery,ip-src,"43.240.14.37","hosted phishing page",1,20170704
595bb024-550c-4f0e-89b0-06e38e96ca05,108,Attribution,whois-registrant-email,"aobama_5@yahoo.com","",0,20170704
595bb071-226c-4930-9b42-06e28e96ca05,108,Payload delivery,domain,"secuerserver.com","",1,20170704
595bb071-3318-40b2-945f-06e28e96ca05,108,Payload delivery,domain,"bowenpress.net","",1,20170704
595bb071-3d20-4589-9055-06e28e96ca05,108,Payload delivery,domain,"bowenpress.org","",1,20170704
595bb071-b9e0-4f44-a56e-06e28e96ca05,108,Payload delivery,domain,"datalink.one","",1,20170704
595bb071-c44c-45ce-b8b4-06e28e96ca05,108,Payload delivery,domain,"bowenpross.com","",1,20170704
595bb071-d1e8-4cde-9c68-06e28e96ca05,108,Payload delivery,domain,"bowenpres.com","",1,20170704
595bb071-dcec-4872-ad35-06e28e96ca05,108,Payload delivery,domain,"epochatimes.com","",1,20170704
595bb0af-3930-4285-9fdd-06e38e96ca05,108,Payload delivery,domain,"smtpout.secuerserver.com","",1,20170704
595bb0af-4794-4d7f-ba4c-06e38e96ca05,108,Payload delivery,domain,"www.vnews.hk","",1,20170704
595bb0af-5a40-459c-a05d-06e38e96ca05,108,Payload delivery,domain,"get.adobe.com.bowenpress.org","",1,20170704
595bb0af-9bd4-4f6e-b2fa-06e38e96ca05,108,Payload delivery,domain,"hk.secuerserver.com","",1,20170704
595bb0af-9c98-4021-9af7-06e38e96ca05,108,Payload delivery,domain,"www.mail.secuerserver.com","",1,20170704
595bb0af-a424-469a-9a7f-06e38e96ca05,108,Payload delivery,domain,"www.secuerserver.com","",1,20170704
595bb0af-c4b8-4124-a2b5-06e38e96ca05,108,Payload delivery,domain,"pop.secuerserver.com","",1,20170704
595bb0af-e108-4480-aa27-06e38e96ca05,108,Payload delivery,domain,"www.bowenpress.org","",1,20170704
595bb0cc-f258-491f-afcd-06e28e96ca05,108,Payload delivery,url,"http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate.html","",1,20170704
595bb15f-4a08-4a4a-9ff5-06e38e96ca05,108,Payload delivery,url,"http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate20161201.exe","",1,20170704
595bb15f-8488-4a3b-abea-06e38e96ca05,108,Payload delivery,url,"http://get.adobe.com.bowenpress.org/Adobe/update/20170312/AdobeUpdate20170312.exe","",1,20170704
595bb15f-d000-400a-b7a9-06e38e96ca05,108,Payload delivery,url,"http://get.adobe.com.bowenpress.org/Adobe/update/20160812/AdobeUpdate20160812.exe","",1,20170704
595bb15f-dc68-4468-9572-06e38e96ca05,108,Payload delivery,url,"http://get.adobe.com.bowenpress.org/Adobe/update/20160703/AdobeUpdate20160703.exe","",1,20170704
595bb19a-2bec-4af4-bd28-06e28e96ca05,108,Network activity,domain,"email23.secuerserver.com","",1,20170704
595bb19a-3be4-4267-9c73-06e28e96ca05,108,Network activity,domain,"hk.secuerserver.com","",1,20170704
595bb19a-53fc-4c93-87b1-06e28e96ca05,108,Network activity,domain,"dns.bowenpress.org","",1,20170704
595bb286-ee4c-4c91-91b9-06e38e96ca05,108,Payload delivery,ip-src,"45.124.24.39","Cloudie IP used for scanning",1,20170704
595bb2d6-70e0-4d6d-bdc7-06e28e96ca05,108,Payload delivery,ip-src,"23.239.106.119","Gorilla servers malware and phishing server",1,20170704
595bb322-0618-43dc-bd26-06e38e96ca05,108,Artifacts dropped,md5,"e0338b1f010fdc4751de5f58e4acf2ad","",0,20170704
595bb322-0b70-4d94-873f-06e38e96ca05,108,Artifacts dropped,md5,"c1dabd54a672cbc2747c53a8041d5602","",0,20170704
595bb322-0d44-4380-9208-06e38e96ca05,108,Artifacts dropped,md5,"d80fc6a4f175e3ab417b9f96c3b37c73","",0,20170704
595bb322-12c0-4c0c-8d64-06e38e96ca05,108,Artifacts dropped,md5,"ac5763000ae435875f3b709a5f23ecc0","",0,20170704
595bb322-2550-44cc-8747-06e38e96ca05,108,Artifacts dropped,md5,"19c5f8829444956ba30e023aaaec6408","",0,20170704
595bb322-34b4-4c04-a93c-06e38e96ca05,108,Artifacts dropped,md5,"bb080489dbc98a59cac130475e019fb2","",0,20170704
595bb322-4794-4b32-8ad7-06e38e96ca05,108,Artifacts dropped,md5,"88e027b1ef7b2da1766e6b6819bba0f0","",0,20170704
595bb322-59ac-4310-aa50-06e38e96ca05,108,Artifacts dropped,md5,"e841ecaa44b3589120b72e60b53f39c6","",0,20170704
595bb322-7e84-47a6-a022-06e38e96ca05,108,Artifacts dropped,md5,"95efa51b52f121cec239980127b7f96b","",0,20170704
595bb322-88f8-4934-93ca-06e38e96ca05,108,Artifacts dropped,md5,"4ddf012d8a42ad2666e06ad2f0a8410e","",0,20170704
595bb322-897c-4d64-99b1-06e38e96ca05,108,Artifacts dropped,md5,"2332aa40d15399179c068ab205a5303d","",0,20170704
595bb322-90a4-47f8-9056-06e38e96ca05,108,Artifacts dropped,md5,"f282fd20d7eaebe848b5111ecdae82a6","",0,20170704
595bb322-a12c-4e3f-b0ee-06e38e96ca05,108,Artifacts dropped,md5,"88f43fe753e64d9c536fca16979984ef","",0,20170704
595bb322-dfec-480b-9ec1-06e38e96ca05,108,Artifacts dropped,md5,"029ba5f0f6997bc36a094e86848a5b82","",0,20170704
595bb322-f1a0-4a70-a9ad-06e38e96ca05,108,Artifacts dropped,md5,"13b148aead5e844f7262da768873cec0","",0,20170704
595bb322-fa5c-4ee1-b354-06e38e96ca05,108,Artifacts dropped,md5,"945de4d3a046a698aec222fc90a148ba","",0,20170704
1 uuid event_id category type value comment to_ids date
2 595baf52-2a08-4576-9f76-06e38e96ca05 108 Payload delivery email-src aisia.anminda8@mail.com 0 20170704
3 595baf52-7340-4840-bda0-06e38e96ca05 108 Payload delivery email-src hellomice@mail.com 0 20170704
4 595baf7a-6598-4ecc-ba74-06e28e96ca05 108 Payload delivery url http://43.240.14.37/asdasdasadqddd12222111.php/article.asp 1 20170704
5 595bafa7-2d34-43d7-87a1-06e38e96ca05 108 Payload delivery url http://chinadagitaltimes.net/2016/07/chinese-hackers-blamed-multiple-breaches-fdic 1 20170704
6 595bafe1-e518-4bfb-9701-06e28e96ca05 108 Payload delivery ip-src 43.240.14.37 hosted phishing page 1 20170704
7 595bb024-550c-4f0e-89b0-06e38e96ca05 108 Attribution whois-registrant-email aobama_5@yahoo.com 0 20170704
8 595bb071-226c-4930-9b42-06e28e96ca05 108 Payload delivery domain secuerserver.com 1 20170704
9 595bb071-3318-40b2-945f-06e28e96ca05 108 Payload delivery domain bowenpress.net 1 20170704
10 595bb071-3d20-4589-9055-06e28e96ca05 108 Payload delivery domain bowenpress.org 1 20170704
11 595bb071-b9e0-4f44-a56e-06e28e96ca05 108 Payload delivery domain datalink.one 1 20170704
12 595bb071-c44c-45ce-b8b4-06e28e96ca05 108 Payload delivery domain bowenpross.com 1 20170704
13 595bb071-d1e8-4cde-9c68-06e28e96ca05 108 Payload delivery domain bowenpres.com 1 20170704
14 595bb071-dcec-4872-ad35-06e28e96ca05 108 Payload delivery domain epochatimes.com 1 20170704
15 595bb0af-3930-4285-9fdd-06e38e96ca05 108 Payload delivery domain smtpout.secuerserver.com 1 20170704
16 595bb0af-4794-4d7f-ba4c-06e38e96ca05 108 Payload delivery domain www.vnews.hk 1 20170704
17 595bb0af-5a40-459c-a05d-06e38e96ca05 108 Payload delivery domain get.adobe.com.bowenpress.org 1 20170704
18 595bb0af-9bd4-4f6e-b2fa-06e38e96ca05 108 Payload delivery domain hk.secuerserver.com 1 20170704
19 595bb0af-9c98-4021-9af7-06e38e96ca05 108 Payload delivery domain www.mail.secuerserver.com 1 20170704
20 595bb0af-a424-469a-9a7f-06e38e96ca05 108 Payload delivery domain www.secuerserver.com 1 20170704
21 595bb0af-c4b8-4124-a2b5-06e38e96ca05 108 Payload delivery domain pop.secuerserver.com 1 20170704
22 595bb0af-e108-4480-aa27-06e38e96ca05 108 Payload delivery domain www.bowenpress.org 1 20170704
23 595bb0cc-f258-491f-afcd-06e28e96ca05 108 Payload delivery url http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate.html 1 20170704
24 595bb15f-4a08-4a4a-9ff5-06e38e96ca05 108 Payload delivery url http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate20161201.exe 1 20170704
25 595bb15f-8488-4a3b-abea-06e38e96ca05 108 Payload delivery url http://get.adobe.com.bowenpress.org/Adobe/update/20170312/AdobeUpdate20170312.exe 1 20170704
26 595bb15f-d000-400a-b7a9-06e38e96ca05 108 Payload delivery url http://get.adobe.com.bowenpress.org/Adobe/update/20160812/AdobeUpdate20160812.exe 1 20170704
27 595bb15f-dc68-4468-9572-06e38e96ca05 108 Payload delivery url http://get.adobe.com.bowenpress.org/Adobe/update/20160703/AdobeUpdate20160703.exe 1 20170704
28 595bb19a-2bec-4af4-bd28-06e28e96ca05 108 Network activity domain email23.secuerserver.com 1 20170704
29 595bb19a-3be4-4267-9c73-06e28e96ca05 108 Network activity domain hk.secuerserver.com 1 20170704
30 595bb19a-53fc-4c93-87b1-06e28e96ca05 108 Network activity domain dns.bowenpress.org 1 20170704
31 595bb286-ee4c-4c91-91b9-06e38e96ca05 108 Payload delivery ip-src 45.124.24.39 Cloudie IP used for scanning 1 20170704
32 595bb2d6-70e0-4d6d-bdc7-06e28e96ca05 108 Payload delivery ip-src 23.239.106.119 Gorilla servers malware and phishing server 1 20170704
33 595bb322-0618-43dc-bd26-06e38e96ca05 108 Artifacts dropped md5 e0338b1f010fdc4751de5f58e4acf2ad 0 20170704
34 595bb322-0b70-4d94-873f-06e38e96ca05 108 Artifacts dropped md5 c1dabd54a672cbc2747c53a8041d5602 0 20170704
35 595bb322-0d44-4380-9208-06e38e96ca05 108 Artifacts dropped md5 d80fc6a4f175e3ab417b9f96c3b37c73 0 20170704
36 595bb322-12c0-4c0c-8d64-06e38e96ca05 108 Artifacts dropped md5 ac5763000ae435875f3b709a5f23ecc0 0 20170704
37 595bb322-2550-44cc-8747-06e38e96ca05 108 Artifacts dropped md5 19c5f8829444956ba30e023aaaec6408 0 20170704
38 595bb322-34b4-4c04-a93c-06e38e96ca05 108 Artifacts dropped md5 bb080489dbc98a59cac130475e019fb2 0 20170704
39 595bb322-4794-4b32-8ad7-06e38e96ca05 108 Artifacts dropped md5 88e027b1ef7b2da1766e6b6819bba0f0 0 20170704
40 595bb322-59ac-4310-aa50-06e38e96ca05 108 Artifacts dropped md5 e841ecaa44b3589120b72e60b53f39c6 0 20170704
41 595bb322-7e84-47a6-a022-06e38e96ca05 108 Artifacts dropped md5 95efa51b52f121cec239980127b7f96b 0 20170704
42 595bb322-88f8-4934-93ca-06e38e96ca05 108 Artifacts dropped md5 4ddf012d8a42ad2666e06ad2f0a8410e 0 20170704
43 595bb322-897c-4d64-99b1-06e38e96ca05 108 Artifacts dropped md5 2332aa40d15399179c068ab205a5303d 0 20170704
44 595bb322-90a4-47f8-9056-06e38e96ca05 108 Artifacts dropped md5 f282fd20d7eaebe848b5111ecdae82a6 0 20170704
45 595bb322-a12c-4e3f-b0ee-06e38e96ca05 108 Artifacts dropped md5 88f43fe753e64d9c536fca16979984ef 0 20170704
46 595bb322-dfec-480b-9ec1-06e38e96ca05 108 Artifacts dropped md5 029ba5f0f6997bc36a094e86848a5b82 0 20170704
47 595bb322-f1a0-4a70-a9ad-06e38e96ca05 108 Artifacts dropped md5 13b148aead5e844f7262da768873cec0 0 20170704
48 595bb322-fa5c-4ee1-b354-06e38e96ca05 108 Artifacts dropped md5 945de4d3a046a698aec222fc90a148ba 0 20170704

1412
data/ioc/spyware/citizen_lab/201707_InsiderInfo/misp.json Normal file
View File

File diff suppressed because it is too large Load Diff

125
data/ioc/spyware/citizen_lab/201707_InsiderInfo/openioc.ioc Normal file
View File

@@ -0,0 +1,125 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="595baf14-d8e8-4e33-be25-06e38e96ca05" last-modified="2017-07-04T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #108</short_description>
<description>Insider Information: An intrusion campaign targeting Chinese language news sites</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2017-07-04T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="595baf14-d8e8-4e33-be25-06e38e96ca05">
<IndicatorItem id="email23.secuerserver.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="hk.secuerserver.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dns.bowenpress.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="secuerserver.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="bowenpres.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="bowenpress.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="bowenpress.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="bowenpross.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="datalink.one" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="epochatimes.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="get.adobe.com.bowenpress.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="hk.secuerserver.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="pop.secuerserver.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="smtpout.secuerserver.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.bowenpress.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.mail.secuerserver.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.secuerserver.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.vnews.hk" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="45.124.24.39" condition="is">
<Context document="PortItem" search="PortItem/remoteIP" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="23.239.106.119" condition="is">
<Context document="PortItem" search="PortItem/remoteIP" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="43.240.14.37" condition="is">
<Context document="PortItem" search="PortItem/remoteIP" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="http://43.240.14.37/asdasdasadqddd12222111.php/article.asp" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://chinadagitaltimes.net/2016/07/chinese-hackers-blamed-multiple-breaches-fdic" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate.html" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://get.adobe.com.bowenpress.org/Adobe/update/20160703/AdobeUpdate20160703.exe" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://get.adobe.com.bowenpress.org/Adobe/update/20160812/AdobeUpdate20160812.exe" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate20161201.exe" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="http://get.adobe.com.bowenpress.org/Adobe/update/20170312/AdobeUpdate20170312.exe" condition="is">
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

1184
data/ioc/spyware/citizen_lab/201707_InsiderInfo/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff

3
data/ioc/spyware/citizen_lab/201712_Cyberbit/README.md Normal file
View File

@@ -0,0 +1,3 @@
# Indicators: Champing at the Cyberbit
This folder contains the indicators of the report [Champing at the Cyberbit Ethiopian Dissidents Targeted with New Commercial Spyware ](https://citizenlab.ca/2017/12/champing-cyberbit-ethiopian-dissidents-targeted-commercial-spyware/) published in December 2017 by [Citizen Lab](https://citizenlab.ca/).

14
data/ioc/spyware/citizen_lab/201712_Cyberbit/iocs.csv Normal file
View File

@@ -0,0 +1,14 @@
uuid,event_id,category,type,value,comment,to_ids,date
5a27f9f0-0654-4388-adcc-11098e96ca05,125,Network activity,url,"https://time-local.net/ts.php","",1,20171206
5a27f9f0-8b98-4c33-bfce-11098e96ca05,125,Network activity,url,"https://time-local.com/","",1,20171206
5a27f9f0-b9fc-4809-bbdb-11098e96ca05,125,Network activity,url,"https://pssts1.nozonenet.com/ts8/ts8.php","",1,20171206
5a27f9f0-de2c-4a55-91a9-11098e96ca05,125,Network activity,url,"https://time-local.net/","",1,20171206
5a27f9f0-ff88-4631-90ae-11098e96ca05,125,Network activity,url,"https://time-local.com/ts.php","",1,20171206
5a27fa29-2f2c-428e-971b-11098e96ca05,125,Network activity,domain,"pssts1.nozonenet.com","",1,20171206
5a27fa29-36d8-4b5e-bef3-11098e96ca05,125,Network activity,domain,"time-local.net","",1,20171206
5a27fa29-c180-4131-8e5d-11098e96ca05,125,Network activity,domain,"time-local.com","",1,20171206
5a27fac9-1f90-405a-8145-11098e96ca05,125,Network activity,domain,"pupki.co","",1,20171206
5a281504-1720-4c8f-90c1-11098e96ca05,125,Network activity,domain,"eastafro.net","",1,20171206
5a281504-6d78-458c-834f-11098e96ca05,125,Network activity,domain,"meskereme.net","",1,20171206
5a281504-7ee0-446f-bd09-11098e96ca05,125,Network activity,domain,"getadobeplayer.com","",1,20171206
5a281504-f94c-4e52-8866-11098e96ca05,125,Network activity,domain,"diretube.co.uk","",1,20171206
1 uuid event_id category type value comment to_ids date
2 5a27f9f0-0654-4388-adcc-11098e96ca05 125 Network activity url https://time-local.net/ts.php 1 20171206
3 5a27f9f0-8b98-4c33-bfce-11098e96ca05 125 Network activity url https://time-local.com/ 1 20171206
4 5a27f9f0-b9fc-4809-bbdb-11098e96ca05 125 Network activity url https://pssts1.nozonenet.com/ts8/ts8.php 1 20171206
5 5a27f9f0-de2c-4a55-91a9-11098e96ca05 125 Network activity url https://time-local.net/ 1 20171206
6 5a27f9f0-ff88-4631-90ae-11098e96ca05 125 Network activity url https://time-local.com/ts.php 1 20171206
7 5a27fa29-2f2c-428e-971b-11098e96ca05 125 Network activity domain pssts1.nozonenet.com 1 20171206
8 5a27fa29-36d8-4b5e-bef3-11098e96ca05 125 Network activity domain time-local.net 1 20171206
9 5a27fa29-c180-4131-8e5d-11098e96ca05 125 Network activity domain time-local.com 1 20171206
10 5a27fac9-1f90-405a-8145-11098e96ca05 125 Network activity domain pupki.co 1 20171206
11 5a281504-1720-4c8f-90c1-11098e96ca05 125 Network activity domain eastafro.net 1 20171206
12 5a281504-6d78-458c-834f-11098e96ca05 125 Network activity domain meskereme.net 1 20171206
13 5a281504-7ee0-446f-bd09-11098e96ca05 125 Network activity domain getadobeplayer.com 1 20171206
14 5a281504-f94c-4e52-8866-11098e96ca05 125 Network activity domain diretube.co.uk 1 20171206

1167
data/ioc/spyware/citizen_lab/201712_Cyberbit/misp.json Normal file
View File

File diff suppressed because it is too large Load Diff

162
data/ioc/spyware/citizen_lab/201712_Cyberbit/rules.yar Normal file
View File

@@ -0,0 +1,162 @@
rule PSS_Agent {
meta:
description = "PSS Agent versions 4.x and 5.x"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
date = "2017-07-20"
strings:
$cmdproc = "CmdProc_" wide
$u1 = "SS_Agent" ascii
$u2 = "pss-agent" ascii
$u3 = "DC615DA9-94B5-4477-9C33-3A393BC9E63F" ascii
$u4 = { 06 1f 41 49 4d 48 50 4f 31 }
$s1 = "util::Process::" ascii
$s2 = "util::Resource::" ascii
$s3 = "util::System::" ascii
$s4 = "/M:{0FA12518-0120-0910-A43C-0DAA276D2EA4}" wide
$s5 = "Command is not allowed due to potential detection threat: %1%." wide
$s6 = "(%d) %.64s\\%.64s\\%.64s|%.64s|%.64s|%.64s|%.64s|%.64s|%.64s" wide
$s7 = "Name: %s Due: %02d/%02d/%04d %02d:%02d:%02d, Length: %d seconds" wide
$s8 = "Image will be taken on the next Skype call session." wide
$s9 = "\\\\.\\pipe\\BrowseIPC" wide
$s10 = "RES_BINARY" wide
$s11 = "/{433a-bbaf439-12982d4a-9c27}" wide
condition:
uint16(0) == 0x5a4d and $cmdproc and 1 of ($u*) and 4 of ($s*)
}
rule PSS_Pipeserver {
meta:
description = "PSS Pipeserver versions 4.x and 5.x"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
data = "2017-07-20"
strings:
$u1 = "pss-agent" ascii
$u2 = "PSS_Agent" ascii
$u3 = "Agent path too long (>= MAX_PATH)" ascii
$u4 = "Agent is not running, executing it now\\n" ascii
$u5 = "Failed to create PssClock!" ascii
$s1 = "LnkProxy" ascii
$s2 = "CUSTOMER\\Agent" ascii
$s3 = "BrowseIPC" ascii
$s4 = "CustomerConfig is not initialized yet" ascii
$s5 = "RES_BINARY" ascii
$s6 = "ipc::security_access::" ascii
$s7 = "util::Resource::" ascii
$s8 = "util::System::" ascii
$s9 = "AgentAdminGlobalEventName" wide
$s10 = "AgentDummyKillGlobalEventName" wide
$s11 = "AgentGlobalEventName" wide
$s12 = "AgentKillGlobalEventName" wide
$s13 = "AgentPipeServerInitGlobalEventName" wide
$s14 = "AgentUninstallGlobalEventName" wide
$s15 = "/M:{0FA12518-0120-0910-A43C-0DAA276D2EA4}" wide
$s16 = "\\\\.\\pipe\\BrowseIPC" wide
$s17 = "RES_BINARY" wide
$s18 = "/{433a-bbaf439-12982d4a-9c27}" wide
condition:
uint16(0) == 0x5a4d and 1 of ($u*) and 8 of ($s*)
}
rule PSS_lnkproxy {
meta:
description = "PSS lnkproxy versions 4.x and 5.x"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
date = "2017-07-20"
strings:
$s1 = "COMMAND_LINE_BEGIN:" ascii
$s2 = ":COMMAND_LINE_END:" ascii
$s3 = "Could not execute process when no command is specified" ascii
$s4 = "lnkproxy.db" ascii
$s5 = "SPAWN_COMMAND_BEGIN:" ascii
$s6 = ":SPAWN_COMMAND_END" ascii
$s7 = "util::Deserializer::" ascii
$s8 = "util::FileDeserializer::" ascii
$s9 = "util::File::" ascii
$s10 = "util::Process::" ascii
$s11 = "util::System::" ascii
condition:
uint16(0) == 0x5a4d and 4 of ($s*)
}
rule PSS_Agent_v6 {
meta:
description = "PSS Agent version 6.0.0 and 6.1.0"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
date = "2017-07-20"
strings:
$cmdproc = "CmdProc_" wide
$u1 = "C:\\Windows\\temp\\KB2979214.pdb" ascii
$u2 = { 06 1f 41 49 4d 48 50 4f 31 }
$s1 = "Did not complete transaction with pipe server" wide
$s2 = "SkypeControlAPIAttach" wide
$s3 = "SkypeControlAPIDiscover" wide
$s4 = "URL###Execute" wide
$s5 = "Failed to AddClipboardFormatListener, error [" ascii
$s6 = "transactionrequest.<xmlattr>" wide
$s7 = "DC615DA9-94B5-4477-9C33-3A393BC9E63F" ascii
$s8 = "getip.<xmlattr>.agentid" wide
$s9 = "AVAgentInstallException@agent@@" ascii
$s10 = "AVAgentCommandsException@agent@@" ascii
$s11 = "AVAgentCustomerConfigException@agent@@" ascii
$s12 = "AVTransactionParsingException@communication@@agent" ascii
$s13 = "AVStorageException@config@agent@@" ascii
$s14 = "AVDBStorageException@db@agent@@" ascii
$str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 }
condition:
uint16(0) == 0x5a4d and $cmdproc and $str_decrypt_loop and 1 of ($u*) and 8 of ($s*)
}
rule PSS_lnkproxy_v6 {
meta:
description = "PSS lnkproxy version 6.0.0 and 6.1.0"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
date = "2017-07-20"
strings:
$s1 = "C:\\Windows\\temp\\KB2971112.pdb"
$s2 = "AVResourceException@exception@util@@" ascii
$s3 = "AVLnkControllerException@LnkProxy@@" ascii
$s4 = "AVLnkPayloadException@@" ascii
$s5 = "AVShellLinkException@LnkProxy@@" ascii
$s6 = "AVFileUtilitiesException@LnkProxy@@" ascii
$s7 = "AVLnkEntryException@LnkProxy@@" ascii
$s8 = "AVFileRollbackException@LnkProxy@@" ascii
$str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 }
condition:
uint16(0) == 0x5a4d and 3 of ($s*) and $str_decrypt_loop
}
rule PSS_Pipeserver_v6 {
meta:
description = "PSS Pipeserver version 6.0.0 and 6.1.0"
author = "Geoffrey Alexander <geoff@citizenlab.ca>"
date = "2017-07-20"
strings:
$p1 = "PSS_Agent" ascii
$p2 = "pss-agent" ascii
$s1 = "%2s%u.%u.%u.%u\\\\n" wide
$s2 = "CustomerConfigException@agent" ascii
$str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 }
condition:
uint16(0) == 0x5a4d and $str_decrypt_loop and 1 of ($p*) and 1 of ($s*)
}

1447
data/ioc/spyware/citizen_lab/201712_Cyberbit/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff

4
data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/README.md Normal file
View File

@@ -0,0 +1,4 @@
# Indicators : Spying on a Budget
This folder contains the indicators of the report [Spying on a Budget: Inside a Phishing Operation with Targets in the Tibetan Community ](https://citizenlab.ca/2018/01/spying-on-a-budget-inside-a-phishing-operation-with-targets-in-the-tibetan-community) published in January 2018 by [Citizen Lab](https://citizenlab.ca/).

195
data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/indicators.csv Normal file
View File

@@ -0,0 +1,195 @@
uuid,event_id,category,type,value,comment,to_ids,date
587fa321-03c8-4bfd-9152-07298e96ca05,57,Network activity,domain,"google-protected.gq","",1,20180116
587fa321-0aa8-4976-9e0b-07298e96ca05,57,Network activity,domain,"httpsaccounts-google.info","",1,20180116
587fa321-1a34-46ff-9a98-07298e96ca05,57,Network activity,domain,"yahoo-safety.com","",1,20180116
587fa321-2abc-4a62-a220-07298e96ca05,57,Network activity,domain,"mail-doubt.com","",1,20180116
587fa321-2c48-4b14-915e-07298e96ca05,57,Network activity,domain,"httpsdrive-accounts-google.site","",1,20180116
587fa321-3998-4684-961b-07298e96ca05,57,Network activity,domain,"gmail-profile.com","",1,20180116
587fa321-3c10-4fdc-98cb-07298e96ca05,57,Network activity,domain,"google-post.com","",1,20180116
587fa321-3dd8-4b9d-a1a9-07298e96ca05,57,Network activity,domain,"t1bet.net","",1,20180116
587fa321-4520-4b40-87c8-07298e96ca05,57,Network activity,domain,"mydrive-google.com","",1,20180116
587fa321-4ab0-4b27-9e1e-07298e96ca05,57,Network activity,domain,"httpsmail-google.cf","",1,20180116
587fa321-5938-4cb4-9b4b-07298e96ca05,57,Network activity,domain,"httpsaccounts-google.pw","",1,20180116
587fa321-6b28-4688-9f8e-07298e96ca05,57,Network activity,domain,"httpsaccounts-google.site","",1,20180116
587fa321-7160-4d05-b9dd-07298e96ca05,57,Network activity,domain,"google-secure.gq","",1,20180116
587fa321-7f20-46c1-9bd2-07298e96ca05,57,Network activity,domain,"accounts-goog1e.com","",1,20180116
587fa321-8128-4bd5-9dbc-07298e96ca05,57,Network activity,domain,"accounts-google.info","",1,20180116
587fa321-8644-420d-b070-07298e96ca05,57,Network activity,domain,"postmailsecret.com","",1,20180116
587fa321-8ac8-4e39-9241-07298e96ca05,57,Network activity,domain,"https-mail-google.gq","",1,20180116
587fa321-8b3c-4300-a70b-07298e96ca05,57,Network activity,domain,"yahoo-protect.com","",1,20180116
587fa321-9df0-4ca1-948f-07298e96ca05,57,Network activity,domain,"accountsgoog1e.info","",1,20180116
587fa321-a0f0-4f2a-9149-07298e96ca05,57,Network activity,domain,"yahoomaintain.com","",1,20180116
587fa321-a574-41cd-932a-07298e96ca05,57,Network activity,domain,"https-mail-google.ml","",1,20180116
587fa321-b674-4ca5-9f07-07298e96ca05,57,Network activity,domain,"httpsdrive-google.pw","",1,20180116
587fa321-be20-4fe3-92f4-07298e96ca05,57,Network activity,domain,"google-secret.com","",1,20180116
587fa321-be78-4001-bb08-07298e96ca05,57,Network activity,domain,"https-drive-google.com","",1,20180116
587fa321-ca80-495e-8d0c-07298e96ca05,57,Network activity,domain,"gmail-safety.pw","",1,20180116
587fa321-cb00-4c50-9a6f-07298e96ca05,57,Network activity,domain,"httpsmyaccounts-google.space","",1,20180116
587fa321-cd40-40b2-aeea-07298e96ca05,57,Network activity,domain,"hotmail-sign.com","",1,20180116
587fa321-d4ec-4a9f-a9cb-07298e96ca05,57,Network activity,domain,"httpsaccounts-google.com","",1,20180116
587fa321-e068-49d4-852b-07298e96ca05,57,Network activity,domain,"yahoo-images.com","",1,20180116
587fa321-eb20-4b18-9740-07298e96ca05,57,Network activity,domain,"httpsdrive-google.site","",1,20180116
587fa322-0718-42ca-a7e2-07298e96ca05,57,Network activity,domain,"mydrive-google.asia","",1,20180116
587fa322-0724-494e-bae1-07298e96ca05,57,Network activity,domain,"drive-accounts-google.com","",1,20180116
587fa322-0730-4b97-aeba-07298e96ca05,57,Network activity,domain,"httpsdrive-google.space","",1,20180116
587fa322-0d88-4d42-8935-07298e96ca05,57,Network activity,domain,"httpsaccounts-drive-google.gq","",1,20180116
587fa322-1618-4702-9a3e-07298e96ca05,57,Network activity,domain,"goog1e.space","",1,20180116
587fa322-2b9c-4091-89e8-07298e96ca05,57,Network activity,domain,"httpsgoogle-drive.gq","",1,20180116
587fa322-3004-4276-9bde-07298e96ca05,57,Network activity,domain,"https-drive-google.cf","",1,20180116
587fa322-323c-4ba6-8fd6-07298e96ca05,57,Network activity,domain,"mydrive-accounts-google.ml","",1,20180116
587fa322-34fc-4f71-a8ba-07298e96ca05,57,Network activity,domain,"https-drive-google.ml","",1,20180116
587fa322-3504-44a3-9617-07298e96ca05,57,Network activity,domain,"mail-accounts-google.online","",1,20180116
587fa322-3948-484b-8f15-07298e96ca05,57,Network activity,domain,"httpsdrive-mail-google.gq","",1,20180116
587fa322-3fb4-4ae1-9474-07298e96ca05,57,Network activity,domain,"myaccounts-google.info","",1,20180116
587fa322-4e2c-43dc-b683-07298e96ca05,57,Network activity,domain,"drivegoogle.biz","",1,20180116
587fa322-5284-467a-af2a-07298e96ca05,57,Network activity,domain,"myaccounts-google.online","",1,20180116
587fa322-56a4-4e03-ad12-07298e96ca05,57,Network activity,domain,"mail-qq.online","",1,20180116
587fa322-5e3c-415c-96c9-07298e96ca05,57,Network activity,domain,"mail-secret.com","",1,20180116
587fa322-5f50-470e-b879-07298e96ca05,57,Network activity,domain,"drive-mail-google.com","",1,20180116
587fa322-7ae4-4613-b3d5-07298e96ca05,57,Network activity,domain,"httpsaccounts-google.ga","",1,20180116
587fa322-7e2c-4594-aa21-07298e96ca05,57,Network activity,domain,"httpsmyaccount-google.info","",1,20180116
587fa322-8410-4810-ac33-07298e96ca05,57,Network activity,domain,"httpsmail-google.ml","",1,20180116
587fa322-90d4-4f92-a61e-07298e96ca05,57,Network activity,domain,"mydrive-google.online","",1,20180116
587fa322-970c-4966-abc9-07298e96ca05,57,Network activity,domain,"drive-accounts-goog1e.cf","",1,20180116
587fa322-a65c-4bd7-8c7d-07298e96ca05,57,Network activity,domain,"myaccountsgoogle.info","",1,20180116
587fa322-b2a4-4870-8b10-07298e96ca05,57,Network activity,domain,"https-drive-google.gq","",1,20180116
587fa322-b494-40f5-844b-07298e96ca05,57,Network activity,domain,"accounts-goog1e.in","",1,20180116
587fa322-b95c-42f0-ab69-07298e96ca05,57,Network activity,domain,"mg-mail-yahoo.us","",1,20180116
587fa322-ba50-47d9-82ba-07298e96ca05,57,Network activity,domain,"httpsdrive-google.net","",1,20180116
587fa322-c228-40b2-b26f-07298e96ca05,57,Network activity,domain,"drive-accounts-gooogle.com","",1,20180116
587fa322-c2c8-4f33-89b8-07298e96ca05,57,Network activity,domain,"httpsmydrive-accounts-goog1e.gq","",1,20180116
587fa322-d4e0-46cf-b549-07298e96ca05,57,Network activity,domain,"microsoft-inc.us","",1,20180116
587fa322-d7c0-431d-935e-07298e96ca05,57,Network activity,domain,"google-drive.gq","",1,20180116
587fa322-d888-4b55-bb55-07298e96ca05,57,Network activity,domain,"httpsaccount-google.gq","",1,20180116
587fa322-dadc-4b51-963d-07298e96ca05,57,Network activity,domain,"files-mail-qq.online","",1,20180116
587fa322-db48-45a2-b841-07298e96ca05,57,Network activity,domain,"https-myaccounts-google.space","",1,20180116
587fa322-e5d0-40eb-bbc4-07298e96ca05,57,Network activity,domain,"drive-accounts-google.ml","",1,20180116
587fa322-ead0-4eae-891e-07298e96ca05,57,Network activity,domain,"drive-mail-google.cf","",1,20180116
587fa322-f124-4da4-b7dc-07298e96ca05,57,Network activity,domain,"myaccounts-google.tk","",1,20180116
587fa322-fb10-4ec5-8f06-07298e96ca05,57,Network activity,domain,"https-drive-accounts-goog1e.cf","",1,20180116
58828772-0390-4cbb-a763-0bbb8e96ca05,57,Network activity,domain,"accounts-google.gq","",1,20180116
58828772-4ec0-4888-a537-0bbb8e96ca05,57,Network activity,domain,"yahoo-secure.tk","",1,20180116
58828772-5bd0-410b-87bf-0bbb8e96ca05,57,Network activity,domain,"mail-google-com.gq","",1,20180116
58828772-5f6c-4ee7-adb7-0bbb8e96ca05,57,Network activity,domain,"yahoo-noreply.tk","",1,20180116
58828772-603c-4ccc-ab02-0bbb8e96ca05,57,Network activity,domain,"google-authorize.gq","",1,20180116
58828772-b108-4592-a9e2-0bbb8e96ca05,57,Network activity,domain,"files-mail-google.ml","",1,20180116
58828772-cac4-4aff-a5cc-0bbb8e96ca05,57,Network activity,domain,"google-settings.ml","",1,20180116
58828772-d120-4619-b0a2-0bbb8e96ca05,57,Network activity,domain,"mail-mg16-yahoo.cf","",1,20180116
58828ebd-afe8-46f2-9782-07298e96ca05,57,Network activity,domain,"gmail-retry.tk","",1,20170120
58828ebd-e824-48c2-888e-07298e96ca05,57,Network activity,domain,"mail-163.tk","",1,20170120
58828ebd-ef30-4937-b5f0-07298e96ca05,57,Network activity,domain,"gmail-secure.tk","",1,20170120
588a5521-f080-4aad-93b1-0bbb8e96ca05,57,Network activity,domain,"accounts-google.cc","",1,20180116
5893a06c-4bd4-4112-97a8-0bbb8e96ca05,57,Network activity,domain,"httpsdocs-google.info","",1,20180116
58b44b3a-c44c-4104-9ec1-53938e96ca05,57,Network activity,domain,"yahoo-verification.us","",1,20180116
58b83e4a-9e80-4357-b4ef-53928e96ca05,57,Network activity,domain,"drive-mail.us","",1,20170302
58b84631-6960-41b3-b7a4-53938e96ca05,57,Network activity,domain,"docs-mail-google.us","",1,20170302
58b98d25-6d24-4081-abae-53928e96ca05,57,Network activity,domain,"login-live.us","",1,20170303
58c2ce5b-4d04-488d-a6c5-53938e96ca05,57,Network activity,domain,"drive-mail.info","",1,20170310
58c676e9-d594-4dcc-8daf-53928e96ca05,57,Network activity,domain,"gooog1e.com","",1,20170313
58c67caf-8e54-40a7-be8a-53928e96ca05,57,Network activity,domain,"drive-goog1e.com","",1,20170313
58c91f4c-dfe8-4639-9ded-53938e96ca05,57,Network activity,domain,"mydrive-mail.asia","",1,20170315
58dbfa91-0c20-4d50-83d8-53938e96ca05,57,Network activity,domain,"accounts-gooog1e.info","",1,20180116
58dbfa91-d540-4a8b-a255-53938e96ca05,57,Network activity,domain,"mail-secret.info","",1,20180116
58dbfabb-3344-4411-ba5c-53938e96ca05,57,Network activity,domain,"myaccounts-mail.com","",1,20180116
58dbfada-dd70-4742-8b09-53928e96ca05,57,Network activity,domain,"yahoo-edit.us","",1,20180116
58dd97e8-44dc-4bc3-ad48-53938e96ca05,57,Network activity,domain,"outlook-login.com","",1,20170330
58dd97e8-ed28-4f49-811e-53938e96ca05,57,Network activity,domain,"account-gooogle.info","",1,20170330
58e2afc8-fb0c-40f7-9da1-53928e96ca05,57,Network activity,domain,"accounts-mail.space","",1,20170403
58e7b5c8-64c0-43cf-a8fd-53928e96ca05,57,Network activity,domain,"accounts-goog1e.info","",1,20170407
58e7b5c8-9a60-4396-b42c-53928e96ca05,57,Network activity,domain,"cc-mail-secret.com","",1,20170407
58e7b5c8-f7f8-49f8-9246-53928e96ca05,57,Network activity,domain,"drive-mail.online","",1,20170407
58eba748-0438-4514-bd1f-53938e96ca05,57,Network activity,domain,"webmail-dalailama.com","",1,20170410
58eba748-1028-4648-a69f-53938e96ca05,57,Network activity,domain,"myaccounts-gooog1e.space","",1,20170410
58eba748-88cc-4103-b1f4-53938e96ca05,57,Network activity,domain,"accounts-gooog1e.space","",1,20170410
58ee49a7-7740-4766-9547-5d828e96ca05,57,Network activity,domain,"mail-aol.space","",1,20170412
58ee4d32-1f88-411b-bbe5-5d828e96ca05,57,Network activity,domain,"mail-epochtimes.space","",1,20170412
58ee553c-4c6c-4fa6-8c2f-5d828e96ca05,57,Network activity,domain,"accounts-email.space","",1,20170412
58efbb0f-19b4-4a87-8f27-5d828e96ca05,57,Network activity,domain,"files-mail.space","",1,20170413
58f90cf2-98f0-4a03-a482-53928e96ca05,57,Network activity,domain,"mail-gooog1e.info","",1,20170420
58f9103e-e3a0-419f-80b8-5d828e96ca05,57,Network activity,domain,"mail-protect.space","",1,20170420
58fe51b3-ae50-45a7-ab7f-53928e96ca05,57,Network activity,domain,"email-163.space","",1,20170424
58fe5290-6718-4a5b-9ec2-5d828e96ca05,57,Network activity,domain,"drive-gooog1e.space","",1,20170424
58fe5c42-db88-4f68-a450-5d828e96ca05,57,Network activity,domain,"mail-attachment-usercontent.space","",1,20170424
5907849c-97a4-4d52-aca1-5d828e96ca05,57,Network activity,domain,"drlve-gooog1e.com","",1,20170501
59078a5c-50a0-44b8-be71-53928e96ca05,57,Network activity,domain,"mail-youxinpai.com","",1,20170501
590cd842-783c-4e0d-9d45-53928e96ca05,57,Network activity,domain,"accounts-gooog1e.asia","",1,20170505
590cd918-792c-4c08-a3f7-53928e96ca05,57,Network activity,domain,"accounts-gooog1e.online","",1,20170505
590cdccf-e228-4406-84c2-5d828e96ca05,57,Network activity,domain,"mail-guazi.space","",1,20170505
590cdff8-7884-467e-88d4-53938e96ca05,57,Network activity,domain,"mail-sina.space","",1,20170505
590ce0f7-43d0-4e1e-9c10-53938e96ca05,57,Network activity,domain,"winupdate.space","",1,20170505
590ce20b-83b4-4cba-9dc7-53938e96ca05,57,Network activity,domain,"ymail-settings.space","",1,20170505
59109412-5e18-4f66-be68-53928e96ca05,57,Network activity,domain,"mail-modular.space","",1,20170508
5910c536-b214-46e2-9385-5d828e96ca05,57,Network activity,domain,"login-live.space","",1,20170508
5910c63a-bc38-4957-b1f0-5d828e96ca05,57,Network activity,domain,"logln-yahoo.com","",1,20170508
5910cb7b-bf90-463b-aba2-5d828e96ca05,57,Network activity,domain,"webmail-mpt.space","",1,20170508
59123c8a-948c-4abd-b79b-5d828e96ca05,57,Network activity,domain,"wengiguowengui.space","",1,20170509
5919cd19-cb28-413f-9b83-53928e96ca05,57,Network activity,domain,"mail-defense.space","",1,20170515
591e040b-ce60-45df-ba1e-5d828e96ca05,57,Network activity,domain,"files-gooog1e.space","",1,20170518
591e0d44-e8b8-4c0e-a959-5d828e96ca05,57,Network activity,domain,"mail-extend.space","",1,20170518
59272a06-6768-4f85-b5f9-5d828e96ca05,57,Network activity,domain,"mail-platform.space","",1,20170525
592c726a-2c78-4466-8ed6-53938e96ca05,57,Network activity,domain,"mail-info.space","",1,20170529
592c7284-ab6c-4d44-9ff1-53938e96ca05,57,Network activity,domain,"drive-goo.space","",1,20170529
59304dd8-2f88-45ab-8a63-5d828e96ca05,57,Network activity,domain,"webmail-dalailama.space","",1,20170601
5935b5e6-6838-4e13-8e4a-53928e96ca05,57,Network activity,domain,"xin-corp.space","",1,20170605
5935b5e6-e930-41fe-9c27-53928e96ca05,57,Network activity,domain,"mail-defend.space","",1,20170605
59396b77-2f9c-40dd-938c-53938e96ca05,57,Network activity,domain,"edit-ymail.space","",1,20170608
59396b77-c09c-4765-aac8-53938e96ca05,57,Network activity,domain,"appinstall-mail.space","",1,20170608
593ee83f-77c8-4e61-8dc0-53928e96ca05,57,Network activity,domain,"myaccounts-gooog1e.com","",1,20170612
59511af6-6c28-42aa-b561-06b28e96ca05,57,Network activity,domain,"accounts-mailbox.space","",1,20170626
595120ce-76a0-4dc0-852e-06b38e96ca05,57,Network activity,domain,"mail-defense.tk","",1,20170626
595d4924-1ce8-45be-b051-06e38e96ca05,57,Network activity,domain,"myapp-gooog1e.com","",1,20180116
595d4924-e9ec-4caa-be6f-06e38e96ca05,57,Network activity,domain,"email-netvigator.info","",1,20180116
595dc225-f7b0-4818-a102-06e38e96ca05,57,Network activity,domain,"mail-dsi-go.space","",1,20170706
595dc260-a7f4-4875-b35b-06e28e96ca05,57,Network activity,domain,"mail-continue.space","",1,20170706
595dc260-e70c-4de7-aac2-06e28e96ca05,57,Network activity,domain,"mail-package.space","",1,20170706
5a15eb13-28c8-45b7-934a-5f708e96ca05,57,Network activity,domain,"drive-accounts-google.ga","",1,20171122
5a15eb13-336c-4698-bda5-5f708e96ca05,57,Network activity,domain,"drive-google.ml","",1,20171122
5a15eb13-5758-40af-b0d2-5f708e96ca05,57,Network activity,domain,"accounts-google.co.in","",1,20171122
5a15eb13-7070-44b6-a867-5f708e96ca05,57,Network activity,domain,"gmail-relation.tk","",1,20171122
5a15eb13-7720-47c6-8c44-5f708e96ca05,57,Network activity,domain,"docs-mail.space","",1,20171122
5a15eb13-82fc-4c1c-b200-5f708e96ca05,57,Network activity,domain,"drive-google.cf","",1,20171122
5a15eb13-8b7c-47c4-9bca-5f708e96ca05,57,Network activity,domain,"dalailama.space","",1,20171122
5a15eb13-a0ac-44d1-97d8-5f708e96ca05,57,Network activity,domain,"drive-google.me","",1,20171122
5a15eb13-d054-4b3d-8577-5f708e96ca05,57,Network activity,domain,"drive-google.space","",1,20171122
5a15eb13-eb0c-48d0-a98d-5f708e96ca05,57,Network activity,domain,"epochtimes.space","",1,20171122
5a15eb13-ef74-4ea4-9173-5f708e96ca05,57,Network activity,domain,"drive-google.gq","",1,20171122
5a15eb14-0558-4518-ac84-5f708e96ca05,57,Network activity,domain,"google-sign.tk","",1,20171122
5a15eb14-1170-4c82-a6d3-5f708e96ca05,57,Network activity,domain,"https-google-drive.ml","",1,20171122
5a15eb14-1884-4430-8e51-5f708e96ca05,57,Network activity,domain,"https-my-accounts-google.gq","",1,20171122
5a15eb14-314c-4df1-a63c-5f708e96ca05,57,Network activity,domain,"gmail-ssl.tk","",1,20171122
5a15eb14-595c-4990-a1e2-5f708e96ca05,57,Network activity,domain,"httpsdrive-myaccounts-google.cf","",1,20171122
5a15eb14-5bd8-4238-ae27-5f708e96ca05,57,Network activity,domain,"myaccounts-google.space","",1,20171122
5a15eb14-755c-4d9e-9a18-5f708e96ca05,57,Network activity,domain,"mail-status.com","",1,20171122
5a15eb14-7acc-436d-a895-5f708e96ca05,57,Network activity,domain,"tibet-office.net","",1,20171122
5a15eb14-853c-4a10-a97f-5f708e96ca05,57,Network activity,domain,"httpsdrive-google.gq","",1,20171122
5a15eb14-9ebc-4d27-89de-5f708e96ca05,57,Network activity,domain,"my-office.cf","",1,20171122
5a15eb14-9ed0-4a34-ae55-5f708e96ca05,57,Network activity,domain,"google-issue.tk","",1,20171122
5a15eb14-9f00-4534-a69f-5f708e96ca05,57,Network activity,domain,"yahoo-device.tk","",1,20171122
5a15eb14-a634-40f6-9cc0-5f708e96ca05,57,Network activity,domain,"mydrive-google.space","",1,20171122
5a15eb14-b000-4b12-af5f-5f708e96ca05,57,Network activity,domain,"mail-secret.online","",1,20171122
5a15eb14-b3ec-4060-a321-5f708e96ca05,57,Network activity,domain,"httpsaccounts-google.cf","",1,20171122
5a15eb14-c00c-4bab-83dc-5f708e96ca05,57,Network activity,domain,"mail-guazi.com","",1,20171122
5a5e58ea-2fe8-495b-89d6-06de8e96ca05,57,Network activity,domain,"phpinfo.pw","",1,20180116
5a5e59b5-adf0-4031-80bb-06de8e96ca05,57,Network activity,ip-dst,"45.63.0.49","",1,20180116
5a5e59b5-c328-49e9-9334-06de8e96ca05,57,Network activity,ip-dst,"115.126.39.107","",1,20180116
5a5e59b5-fc40-4c1d-8e76-06de8e96ca05,57,Network activity,ip-dst,"104.207.132.165","",1,20180116
5a5e6617-3c34-41c1-9a1d-09238e96ca05,57,Network activity,domain,"www.drive-mail.us","",1,20180116
5a5e6617-6b6c-4c4e-8981-09238e96ca05,57,Network activity,domain,"accounts.gooog1e.com","",1,20180116
5a5e6617-8fb0-45a7-b730-09238e96ca05,57,Network activity,domain,"www.google-sign.tk","",1,20180116
5a5e6617-9444-4079-ad77-09238e96ca05,57,Network activity,domain,"drive.postmailsecret.com","",1,20180116
5a5e6617-9f1c-4e58-add8-09238e96ca05,57,Network activity,domain,"www.gmail-profile.com","",1,20180116
5a5e6617-b918-45a8-a427-09238e96ca05,57,Network activity,domain,"webmail.postmailsecret.com","",1,20180116
5a5e6617-c6e4-4925-b6ef-09238e96ca05,57,Network activity,domain,"www.yahoo-verification.us","",1,20180116
5a5e6617-cab0-4c5c-b2d3-09238e96ca05,57,Network activity,domain,"www.drive-mail.online","",1,20180116
5a5e6617-de24-4be4-989c-09238e96ca05,57,Network activity,domain,"www.drive-mail.info","",1,20180116
5a5e6617-ed6c-4dc4-9ef0-09238e96ca05,57,Network activity,domain,"www.login-live.us","",1,20180116
5a5e6618-0500-41e5-b930-09238e96ca05,57,Network activity,domain,"webmail.dalailama.space","",1,20180116
5a5e6618-3184-4bb3-8947-09238e96ca05,57,Network activity,domain,"www.drlve-gooog1e.com","",1,20180116
5a5e6618-37a8-4ec6-88ca-09238e96ca05,57,Network activity,domain,"drive.accounts-gooog1e.online","",1,20180116
5a5e6618-545c-4112-8d51-09238e96ca05,57,Network activity,domain,"https.drive-google.gq","",1,20180116
5a5e6618-7c7c-4624-8a90-09238e96ca05,57,Network activity,domain,"drive.gooog1e.com","",1,20180116
5a5e6618-8c7c-4664-9f5a-09238e96ca05,57,Network activity,domain,"myaccount-mail.com","",1,20180116
5a5e6618-baa4-404c-842e-09238e96ca05,57,Network activity,domain,"www.mail-attachment-usercontent.space","",1,20180116
5a5e6618-be5c-43ac-9491-09238e96ca05,57,Network activity,domain,"drive.myaccount-mail.com","",1,20180116
5a5e6618-e1f8-4f65-b342-09238e96ca05,57,Network activity,domain,"www.mail-protect.space","",1,20180116
5a5e6618-e678-425a-bb9f-09238e96ca05,57,Network activity,domain,"drive.mail-status.com","",1,20180116
1 uuid event_id category type value comment to_ids date
2 587fa321-03c8-4bfd-9152-07298e96ca05 57 Network activity domain google-protected.gq 1 20180116
3 587fa321-0aa8-4976-9e0b-07298e96ca05 57 Network activity domain httpsaccounts-google.info 1 20180116
4 587fa321-1a34-46ff-9a98-07298e96ca05 57 Network activity domain yahoo-safety.com 1 20180116
5 587fa321-2abc-4a62-a220-07298e96ca05 57 Network activity domain mail-doubt.com 1 20180116
6 587fa321-2c48-4b14-915e-07298e96ca05 57 Network activity domain httpsdrive-accounts-google.site 1 20180116
7 587fa321-3998-4684-961b-07298e96ca05 57 Network activity domain gmail-profile.com 1 20180116
8 587fa321-3c10-4fdc-98cb-07298e96ca05 57 Network activity domain google-post.com 1 20180116
9 587fa321-3dd8-4b9d-a1a9-07298e96ca05 57 Network activity domain t1bet.net 1 20180116
10 587fa321-4520-4b40-87c8-07298e96ca05 57 Network activity domain mydrive-google.com 1 20180116
11 587fa321-4ab0-4b27-9e1e-07298e96ca05 57 Network activity domain httpsmail-google.cf 1 20180116
12 587fa321-5938-4cb4-9b4b-07298e96ca05 57 Network activity domain httpsaccounts-google.pw 1 20180116
13 587fa321-6b28-4688-9f8e-07298e96ca05 57 Network activity domain httpsaccounts-google.site 1 20180116
14 587fa321-7160-4d05-b9dd-07298e96ca05 57 Network activity domain google-secure.gq 1 20180116
15 587fa321-7f20-46c1-9bd2-07298e96ca05 57 Network activity domain accounts-goog1e.com 1 20180116
16 587fa321-8128-4bd5-9dbc-07298e96ca05 57 Network activity domain accounts-google.info 1 20180116
17 587fa321-8644-420d-b070-07298e96ca05 57 Network activity domain postmailsecret.com 1 20180116
18 587fa321-8ac8-4e39-9241-07298e96ca05 57 Network activity domain https-mail-google.gq 1 20180116
19 587fa321-8b3c-4300-a70b-07298e96ca05 57 Network activity domain yahoo-protect.com 1 20180116
20 587fa321-9df0-4ca1-948f-07298e96ca05 57 Network activity domain accountsgoog1e.info 1 20180116
21 587fa321-a0f0-4f2a-9149-07298e96ca05 57 Network activity domain yahoomaintain.com 1 20180116
22 587fa321-a574-41cd-932a-07298e96ca05 57 Network activity domain https-mail-google.ml 1 20180116
23 587fa321-b674-4ca5-9f07-07298e96ca05 57 Network activity domain httpsdrive-google.pw 1 20180116
24 587fa321-be20-4fe3-92f4-07298e96ca05 57 Network activity domain google-secret.com 1 20180116
25 587fa321-be78-4001-bb08-07298e96ca05 57 Network activity domain https-drive-google.com 1 20180116
26 587fa321-ca80-495e-8d0c-07298e96ca05 57 Network activity domain gmail-safety.pw 1 20180116
27 587fa321-cb00-4c50-9a6f-07298e96ca05 57 Network activity domain httpsmyaccounts-google.space 1 20180116
28 587fa321-cd40-40b2-aeea-07298e96ca05 57 Network activity domain hotmail-sign.com 1 20180116
29 587fa321-d4ec-4a9f-a9cb-07298e96ca05 57 Network activity domain httpsaccounts-google.com 1 20180116
30 587fa321-e068-49d4-852b-07298e96ca05 57 Network activity domain yahoo-images.com 1 20180116
31 587fa321-eb20-4b18-9740-07298e96ca05 57 Network activity domain httpsdrive-google.site 1 20180116
32 587fa322-0718-42ca-a7e2-07298e96ca05 57 Network activity domain mydrive-google.asia 1 20180116
33 587fa322-0724-494e-bae1-07298e96ca05 57 Network activity domain drive-accounts-google.com 1 20180116
34 587fa322-0730-4b97-aeba-07298e96ca05 57 Network activity domain httpsdrive-google.space 1 20180116
35 587fa322-0d88-4d42-8935-07298e96ca05 57 Network activity domain httpsaccounts-drive-google.gq 1 20180116
36 587fa322-1618-4702-9a3e-07298e96ca05 57 Network activity domain goog1e.space 1 20180116
37 587fa322-2b9c-4091-89e8-07298e96ca05 57 Network activity domain httpsgoogle-drive.gq 1 20180116
38 587fa322-3004-4276-9bde-07298e96ca05 57 Network activity domain https-drive-google.cf 1 20180116
39 587fa322-323c-4ba6-8fd6-07298e96ca05 57 Network activity domain mydrive-accounts-google.ml 1 20180116
40 587fa322-34fc-4f71-a8ba-07298e96ca05 57 Network activity domain https-drive-google.ml 1 20180116
41 587fa322-3504-44a3-9617-07298e96ca05 57 Network activity domain mail-accounts-google.online 1 20180116
42 587fa322-3948-484b-8f15-07298e96ca05 57 Network activity domain httpsdrive-mail-google.gq 1 20180116
43 587fa322-3fb4-4ae1-9474-07298e96ca05 57 Network activity domain myaccounts-google.info 1 20180116
44 587fa322-4e2c-43dc-b683-07298e96ca05 57 Network activity domain drivegoogle.biz 1 20180116
45 587fa322-5284-467a-af2a-07298e96ca05 57 Network activity domain myaccounts-google.online 1 20180116
46 587fa322-56a4-4e03-ad12-07298e96ca05 57 Network activity domain mail-qq.online 1 20180116
47 587fa322-5e3c-415c-96c9-07298e96ca05 57 Network activity domain mail-secret.com 1 20180116
48 587fa322-5f50-470e-b879-07298e96ca05 57 Network activity domain drive-mail-google.com 1 20180116
49 587fa322-7ae4-4613-b3d5-07298e96ca05 57 Network activity domain httpsaccounts-google.ga 1 20180116
50 587fa322-7e2c-4594-aa21-07298e96ca05 57 Network activity domain httpsmyaccount-google.info 1 20180116
51 587fa322-8410-4810-ac33-07298e96ca05 57 Network activity domain httpsmail-google.ml 1 20180116
52 587fa322-90d4-4f92-a61e-07298e96ca05 57 Network activity domain mydrive-google.online 1 20180116
53 587fa322-970c-4966-abc9-07298e96ca05 57 Network activity domain drive-accounts-goog1e.cf 1 20180116
54 587fa322-a65c-4bd7-8c7d-07298e96ca05 57 Network activity domain myaccountsgoogle.info 1 20180116
55 587fa322-b2a4-4870-8b10-07298e96ca05 57 Network activity domain https-drive-google.gq 1 20180116
56 587fa322-b494-40f5-844b-07298e96ca05 57 Network activity domain accounts-goog1e.in 1 20180116
57 587fa322-b95c-42f0-ab69-07298e96ca05 57 Network activity domain mg-mail-yahoo.us 1 20180116
58 587fa322-ba50-47d9-82ba-07298e96ca05 57 Network activity domain httpsdrive-google.net 1 20180116
59 587fa322-c228-40b2-b26f-07298e96ca05 57 Network activity domain drive-accounts-gooogle.com 1 20180116
60 587fa322-c2c8-4f33-89b8-07298e96ca05 57 Network activity domain httpsmydrive-accounts-goog1e.gq 1 20180116
61 587fa322-d4e0-46cf-b549-07298e96ca05 57 Network activity domain microsoft-inc.us 1 20180116
62 587fa322-d7c0-431d-935e-07298e96ca05 57 Network activity domain google-drive.gq 1 20180116
63 587fa322-d888-4b55-bb55-07298e96ca05 57 Network activity domain httpsaccount-google.gq 1 20180116
64 587fa322-dadc-4b51-963d-07298e96ca05 57 Network activity domain files-mail-qq.online 1 20180116
65 587fa322-db48-45a2-b841-07298e96ca05 57 Network activity domain https-myaccounts-google.space 1 20180116
66 587fa322-e5d0-40eb-bbc4-07298e96ca05 57 Network activity domain drive-accounts-google.ml 1 20180116
67 587fa322-ead0-4eae-891e-07298e96ca05 57 Network activity domain drive-mail-google.cf 1 20180116
68 587fa322-f124-4da4-b7dc-07298e96ca05 57 Network activity domain myaccounts-google.tk 1 20180116
69 587fa322-fb10-4ec5-8f06-07298e96ca05 57 Network activity domain https-drive-accounts-goog1e.cf 1 20180116
70 58828772-0390-4cbb-a763-0bbb8e96ca05 57 Network activity domain accounts-google.gq 1 20180116
71 58828772-4ec0-4888-a537-0bbb8e96ca05 57 Network activity domain yahoo-secure.tk 1 20180116
72 58828772-5bd0-410b-87bf-0bbb8e96ca05 57 Network activity domain mail-google-com.gq 1 20180116
73 58828772-5f6c-4ee7-adb7-0bbb8e96ca05 57 Network activity domain yahoo-noreply.tk 1 20180116
74 58828772-603c-4ccc-ab02-0bbb8e96ca05 57 Network activity domain google-authorize.gq 1 20180116
75 58828772-b108-4592-a9e2-0bbb8e96ca05 57 Network activity domain files-mail-google.ml 1 20180116
76 58828772-cac4-4aff-a5cc-0bbb8e96ca05 57 Network activity domain google-settings.ml 1 20180116
77 58828772-d120-4619-b0a2-0bbb8e96ca05 57 Network activity domain mail-mg16-yahoo.cf 1 20180116
78 58828ebd-afe8-46f2-9782-07298e96ca05 57 Network activity domain gmail-retry.tk 1 20170120
79 58828ebd-e824-48c2-888e-07298e96ca05 57 Network activity domain mail-163.tk 1 20170120
80 58828ebd-ef30-4937-b5f0-07298e96ca05 57 Network activity domain gmail-secure.tk 1 20170120
81 588a5521-f080-4aad-93b1-0bbb8e96ca05 57 Network activity domain accounts-google.cc 1 20180116
82 5893a06c-4bd4-4112-97a8-0bbb8e96ca05 57 Network activity domain httpsdocs-google.info 1 20180116
83 58b44b3a-c44c-4104-9ec1-53938e96ca05 57 Network activity domain yahoo-verification.us 1 20180116
84 58b83e4a-9e80-4357-b4ef-53928e96ca05 57 Network activity domain drive-mail.us 1 20170302
85 58b84631-6960-41b3-b7a4-53938e96ca05 57 Network activity domain docs-mail-google.us 1 20170302
86 58b98d25-6d24-4081-abae-53928e96ca05 57 Network activity domain login-live.us 1 20170303
87 58c2ce5b-4d04-488d-a6c5-53938e96ca05 57 Network activity domain drive-mail.info 1 20170310
88 58c676e9-d594-4dcc-8daf-53928e96ca05 57 Network activity domain gooog1e.com 1 20170313
89 58c67caf-8e54-40a7-be8a-53928e96ca05 57 Network activity domain drive-goog1e.com 1 20170313
90 58c91f4c-dfe8-4639-9ded-53938e96ca05 57 Network activity domain mydrive-mail.asia 1 20170315
91 58dbfa91-0c20-4d50-83d8-53938e96ca05 57 Network activity domain accounts-gooog1e.info 1 20180116
92 58dbfa91-d540-4a8b-a255-53938e96ca05 57 Network activity domain mail-secret.info 1 20180116
93 58dbfabb-3344-4411-ba5c-53938e96ca05 57 Network activity domain myaccounts-mail.com 1 20180116
94 58dbfada-dd70-4742-8b09-53928e96ca05 57 Network activity domain yahoo-edit.us 1 20180116
95 58dd97e8-44dc-4bc3-ad48-53938e96ca05 57 Network activity domain outlook-login.com 1 20170330
96 58dd97e8-ed28-4f49-811e-53938e96ca05 57 Network activity domain account-gooogle.info 1 20170330
97 58e2afc8-fb0c-40f7-9da1-53928e96ca05 57 Network activity domain accounts-mail.space 1 20170403
98 58e7b5c8-64c0-43cf-a8fd-53928e96ca05 57 Network activity domain accounts-goog1e.info 1 20170407
99 58e7b5c8-9a60-4396-b42c-53928e96ca05 57 Network activity domain cc-mail-secret.com 1 20170407
100 58e7b5c8-f7f8-49f8-9246-53928e96ca05 57 Network activity domain drive-mail.online 1 20170407
101 58eba748-0438-4514-bd1f-53938e96ca05 57 Network activity domain webmail-dalailama.com 1 20170410
102 58eba748-1028-4648-a69f-53938e96ca05 57 Network activity domain myaccounts-gooog1e.space 1 20170410
103 58eba748-88cc-4103-b1f4-53938e96ca05 57 Network activity domain accounts-gooog1e.space 1 20170410
104 58ee49a7-7740-4766-9547-5d828e96ca05 57 Network activity domain mail-aol.space 1 20170412
105 58ee4d32-1f88-411b-bbe5-5d828e96ca05 57 Network activity domain mail-epochtimes.space 1 20170412
106 58ee553c-4c6c-4fa6-8c2f-5d828e96ca05 57 Network activity domain accounts-email.space 1 20170412
107 58efbb0f-19b4-4a87-8f27-5d828e96ca05 57 Network activity domain files-mail.space 1 20170413
108 58f90cf2-98f0-4a03-a482-53928e96ca05 57 Network activity domain mail-gooog1e.info 1 20170420
109 58f9103e-e3a0-419f-80b8-5d828e96ca05 57 Network activity domain mail-protect.space 1 20170420
110 58fe51b3-ae50-45a7-ab7f-53928e96ca05 57 Network activity domain email-163.space 1 20170424
111 58fe5290-6718-4a5b-9ec2-5d828e96ca05 57 Network activity domain drive-gooog1e.space 1 20170424
112 58fe5c42-db88-4f68-a450-5d828e96ca05 57 Network activity domain mail-attachment-usercontent.space 1 20170424
113 5907849c-97a4-4d52-aca1-5d828e96ca05 57 Network activity domain drlve-gooog1e.com 1 20170501
114 59078a5c-50a0-44b8-be71-53928e96ca05 57 Network activity domain mail-youxinpai.com 1 20170501
115 590cd842-783c-4e0d-9d45-53928e96ca05 57 Network activity domain accounts-gooog1e.asia 1 20170505
116 590cd918-792c-4c08-a3f7-53928e96ca05 57 Network activity domain accounts-gooog1e.online 1 20170505
117 590cdccf-e228-4406-84c2-5d828e96ca05 57 Network activity domain mail-guazi.space 1 20170505
118 590cdff8-7884-467e-88d4-53938e96ca05 57 Network activity domain mail-sina.space 1 20170505
119 590ce0f7-43d0-4e1e-9c10-53938e96ca05 57 Network activity domain winupdate.space 1 20170505
120 590ce20b-83b4-4cba-9dc7-53938e96ca05 57 Network activity domain ymail-settings.space 1 20170505
121 59109412-5e18-4f66-be68-53928e96ca05 57 Network activity domain mail-modular.space 1 20170508
122 5910c536-b214-46e2-9385-5d828e96ca05 57 Network activity domain login-live.space 1 20170508
123 5910c63a-bc38-4957-b1f0-5d828e96ca05 57 Network activity domain logln-yahoo.com 1 20170508
124 5910cb7b-bf90-463b-aba2-5d828e96ca05 57 Network activity domain webmail-mpt.space 1 20170508
125 59123c8a-948c-4abd-b79b-5d828e96ca05 57 Network activity domain wengiguowengui.space 1 20170509
126 5919cd19-cb28-413f-9b83-53928e96ca05 57 Network activity domain mail-defense.space 1 20170515
127 591e040b-ce60-45df-ba1e-5d828e96ca05 57 Network activity domain files-gooog1e.space 1 20170518
128 591e0d44-e8b8-4c0e-a959-5d828e96ca05 57 Network activity domain mail-extend.space 1 20170518
129 59272a06-6768-4f85-b5f9-5d828e96ca05 57 Network activity domain mail-platform.space 1 20170525
130 592c726a-2c78-4466-8ed6-53938e96ca05 57 Network activity domain mail-info.space 1 20170529
131 592c7284-ab6c-4d44-9ff1-53938e96ca05 57 Network activity domain drive-goo.space 1 20170529
132 59304dd8-2f88-45ab-8a63-5d828e96ca05 57 Network activity domain webmail-dalailama.space 1 20170601
133 5935b5e6-6838-4e13-8e4a-53928e96ca05 57 Network activity domain xin-corp.space 1 20170605
134 5935b5e6-e930-41fe-9c27-53928e96ca05 57 Network activity domain mail-defend.space 1 20170605
135 59396b77-2f9c-40dd-938c-53938e96ca05 57 Network activity domain edit-ymail.space 1 20170608
136 59396b77-c09c-4765-aac8-53938e96ca05 57 Network activity domain appinstall-mail.space 1 20170608
137 593ee83f-77c8-4e61-8dc0-53928e96ca05 57 Network activity domain myaccounts-gooog1e.com 1 20170612
138 59511af6-6c28-42aa-b561-06b28e96ca05 57 Network activity domain accounts-mailbox.space 1 20170626
139 595120ce-76a0-4dc0-852e-06b38e96ca05 57 Network activity domain mail-defense.tk 1 20170626
140 595d4924-1ce8-45be-b051-06e38e96ca05 57 Network activity domain myapp-gooog1e.com 1 20180116
141 595d4924-e9ec-4caa-be6f-06e38e96ca05 57 Network activity domain email-netvigator.info 1 20180116
142 595dc225-f7b0-4818-a102-06e38e96ca05 57 Network activity domain mail-dsi-go.space 1 20170706
143 595dc260-a7f4-4875-b35b-06e28e96ca05 57 Network activity domain mail-continue.space 1 20170706
144 595dc260-e70c-4de7-aac2-06e28e96ca05 57 Network activity domain mail-package.space 1 20170706
145 5a15eb13-28c8-45b7-934a-5f708e96ca05 57 Network activity domain drive-accounts-google.ga 1 20171122
146 5a15eb13-336c-4698-bda5-5f708e96ca05 57 Network activity domain drive-google.ml 1 20171122
147 5a15eb13-5758-40af-b0d2-5f708e96ca05 57 Network activity domain accounts-google.co.in 1 20171122
148 5a15eb13-7070-44b6-a867-5f708e96ca05 57 Network activity domain gmail-relation.tk 1 20171122
149 5a15eb13-7720-47c6-8c44-5f708e96ca05 57 Network activity domain docs-mail.space 1 20171122
150 5a15eb13-82fc-4c1c-b200-5f708e96ca05 57 Network activity domain drive-google.cf 1 20171122
151 5a15eb13-8b7c-47c4-9bca-5f708e96ca05 57 Network activity domain dalailama.space 1 20171122
152 5a15eb13-a0ac-44d1-97d8-5f708e96ca05 57 Network activity domain drive-google.me 1 20171122
153 5a15eb13-d054-4b3d-8577-5f708e96ca05 57 Network activity domain drive-google.space 1 20171122
154 5a15eb13-eb0c-48d0-a98d-5f708e96ca05 57 Network activity domain epochtimes.space 1 20171122
155 5a15eb13-ef74-4ea4-9173-5f708e96ca05 57 Network activity domain drive-google.gq 1 20171122
156 5a15eb14-0558-4518-ac84-5f708e96ca05 57 Network activity domain google-sign.tk 1 20171122
157 5a15eb14-1170-4c82-a6d3-5f708e96ca05 57 Network activity domain https-google-drive.ml 1 20171122
158 5a15eb14-1884-4430-8e51-5f708e96ca05 57 Network activity domain https-my-accounts-google.gq 1 20171122
159 5a15eb14-314c-4df1-a63c-5f708e96ca05 57 Network activity domain gmail-ssl.tk 1 20171122
160 5a15eb14-595c-4990-a1e2-5f708e96ca05 57 Network activity domain httpsdrive-myaccounts-google.cf 1 20171122
161 5a15eb14-5bd8-4238-ae27-5f708e96ca05 57 Network activity domain myaccounts-google.space 1 20171122
162 5a15eb14-755c-4d9e-9a18-5f708e96ca05 57 Network activity domain mail-status.com 1 20171122
163 5a15eb14-7acc-436d-a895-5f708e96ca05 57 Network activity domain tibet-office.net 1 20171122
164 5a15eb14-853c-4a10-a97f-5f708e96ca05 57 Network activity domain httpsdrive-google.gq 1 20171122
165 5a15eb14-9ebc-4d27-89de-5f708e96ca05 57 Network activity domain my-office.cf 1 20171122
166 5a15eb14-9ed0-4a34-ae55-5f708e96ca05 57 Network activity domain google-issue.tk 1 20171122
167 5a15eb14-9f00-4534-a69f-5f708e96ca05 57 Network activity domain yahoo-device.tk 1 20171122
168 5a15eb14-a634-40f6-9cc0-5f708e96ca05 57 Network activity domain mydrive-google.space 1 20171122
169 5a15eb14-b000-4b12-af5f-5f708e96ca05 57 Network activity domain mail-secret.online 1 20171122
170 5a15eb14-b3ec-4060-a321-5f708e96ca05 57 Network activity domain httpsaccounts-google.cf 1 20171122
171 5a15eb14-c00c-4bab-83dc-5f708e96ca05 57 Network activity domain mail-guazi.com 1 20171122
172 5a5e58ea-2fe8-495b-89d6-06de8e96ca05 57 Network activity domain phpinfo.pw 1 20180116
173 5a5e59b5-adf0-4031-80bb-06de8e96ca05 57 Network activity ip-dst 45.63.0.49 1 20180116
174 5a5e59b5-c328-49e9-9334-06de8e96ca05 57 Network activity ip-dst 115.126.39.107 1 20180116
175 5a5e59b5-fc40-4c1d-8e76-06de8e96ca05 57 Network activity ip-dst 104.207.132.165 1 20180116
176 5a5e6617-3c34-41c1-9a1d-09238e96ca05 57 Network activity domain www.drive-mail.us 1 20180116
177 5a5e6617-6b6c-4c4e-8981-09238e96ca05 57 Network activity domain accounts.gooog1e.com 1 20180116
178 5a5e6617-8fb0-45a7-b730-09238e96ca05 57 Network activity domain www.google-sign.tk 1 20180116
179 5a5e6617-9444-4079-ad77-09238e96ca05 57 Network activity domain drive.postmailsecret.com 1 20180116
180 5a5e6617-9f1c-4e58-add8-09238e96ca05 57 Network activity domain www.gmail-profile.com 1 20180116
181 5a5e6617-b918-45a8-a427-09238e96ca05 57 Network activity domain webmail.postmailsecret.com 1 20180116
182 5a5e6617-c6e4-4925-b6ef-09238e96ca05 57 Network activity domain www.yahoo-verification.us 1 20180116
183 5a5e6617-cab0-4c5c-b2d3-09238e96ca05 57 Network activity domain www.drive-mail.online 1 20180116
184 5a5e6617-de24-4be4-989c-09238e96ca05 57 Network activity domain www.drive-mail.info 1 20180116
185 5a5e6617-ed6c-4dc4-9ef0-09238e96ca05 57 Network activity domain www.login-live.us 1 20180116
186 5a5e6618-0500-41e5-b930-09238e96ca05 57 Network activity domain webmail.dalailama.space 1 20180116
187 5a5e6618-3184-4bb3-8947-09238e96ca05 57 Network activity domain www.drlve-gooog1e.com 1 20180116
188 5a5e6618-37a8-4ec6-88ca-09238e96ca05 57 Network activity domain drive.accounts-gooog1e.online 1 20180116
189 5a5e6618-545c-4112-8d51-09238e96ca05 57 Network activity domain https.drive-google.gq 1 20180116
190 5a5e6618-7c7c-4624-8a90-09238e96ca05 57 Network activity domain drive.gooog1e.com 1 20180116
191 5a5e6618-8c7c-4664-9f5a-09238e96ca05 57 Network activity domain myaccount-mail.com 1 20180116
192 5a5e6618-baa4-404c-842e-09238e96ca05 57 Network activity domain www.mail-attachment-usercontent.space 1 20180116
193 5a5e6618-be5c-43ac-9491-09238e96ca05 57 Network activity domain drive.myaccount-mail.com 1 20180116
194 5a5e6618-e1f8-4f65-b342-09238e96ca05 57 Network activity domain www.mail-protect.space 1 20180116
195 5a5e6618-e678-425a-bb9f-09238e96ca05 57 Network activity domain drive.mail-status.com 1 20180116

4240
data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/indicators.json Normal file
View File

File diff suppressed because it is too large Load Diff

4463
data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff

64
data/ioc/spyware/citizen_lab/201803_BadTraffic/iocs.csv Normal file
View File

@@ -0,0 +1,64 @@
uuid,event_id,category,type,value,comment,to_ids,date
5a9ebab6-193c-4062-8a28-630f8064ab0b,134,Network activity,domain,"updserv-east-cdn3.com","",1,20180306
5a9ebab6-1cf8-44f7-9995-630f8064ab0b,134,Network activity,domain,"downloading.syriantelecom.co","",1,20180306
5a9ebab6-1dc4-4139-92f9-630f8064ab0b,134,Network activity,domain,"computing.downloaders.today","",1,20180306
5a9ebab6-389c-4de0-be65-630f8064ab0b,134,Network activity,domain,"ms-cdn-88.com","",1,20180306
5a9ebab6-41d4-4b46-8c16-630f8064ab0b,134,Network activity,domain,"solitude.file-download.today","",1,20180306
5a9ebab6-479c-4201-b823-630f8064ab0b,134,Network activity,domain,"window.processingdownloads.today","",1,20180306
5a9ebab6-49a8-4bb1-81d7-630f8064ab0b,134,Network activity,domain,"redirection.bid","",1,20180306
5a9ebab6-5b58-489e-90e2-630f8064ab0b,134,Network activity,domain,"download.downloading.shop","",1,20180306
5a9ebab6-adc4-48ac-8d5d-630f8064ab0b,134,Network activity,domain,"epiphany.download-document.world","",1,20180306
5a9ebab6-b230-4313-9195-630f8064ab0b,134,Network activity,domain,"cdn-upd-ms6.com","",1,20180306
5a9ebab6-b9b8-412b-9929-630f8064ab0b,134,Network activity,domain,"epoch.wind-files.today","",1,20180306
5a9ebab6-c2ac-45da-902c-630f8064ab0b,134,Network activity,domain,"system.documentations.live","",1,20180306
5a9ebab6-caf4-41b4-8e69-630f8064ab0b,134,Network activity,domain,"internet.document-management.today","",1,20180306
5a9ebab6-dd2c-446e-94a1-630f8064ab0b,134,Network activity,domain,"storage.computingdownloads.life","",1,20180306
5a9ebab6-def0-4a56-9745-630f8064ab0b,134,Network activity,domain,"downloading.internetdownloading.co","",1,20180306
5a9ebab6-e0ac-49ac-b6fa-630f8064ab0b,134,Network activity,domain,"download.syriantelecommunications.co","",1,20180306
5a9ebab6-f734-4a44-a766-630f8064ab0b,134,Network activity,domain,"download.downloadering.co","",1,20180306
5a9ebaec-0668-4191-b597-65188064ab0b,134,Artifacts dropped,md5,"6ce947913231bd968c86a2737bae7bba","",0,20180306
5a9ebaec-0ba0-4c9f-91f1-65188064ab0b,134,Artifacts dropped,md5,"40383bee9846ecbd78581402e3379051","",0,20180306
5a9ebaec-0d08-4751-b2a6-65188064ab0b,134,Artifacts dropped,md5,"43b39fd4ddc386092372da19f6278c25","",0,20180306
5a9ebaec-0d40-42e6-8472-65188064ab0b,134,Artifacts dropped,md5,"32bc51088953377d601c6b27ca7484a9","",0,20180306
5a9ebaec-1034-4a7d-8335-65188064ab0b,134,Artifacts dropped,md5,"08b8b4787f3ce90c6c1483cc127b1cdc","",0,20180306
5a9ebaec-1c94-40ca-b487-65188064ab0b,134,Artifacts dropped,md5,"a070fd2cce434a6f0b0d0fa6d3278d22","",0,20180306
5a9ebaec-1de8-45fc-8681-65188064ab0b,134,Artifacts dropped,md5,"8c8eb5cfc5642a773c5f2b5f59148aa3","",0,20180306
5a9ebaec-1fdc-4320-a7d2-65188064ab0b,134,Artifacts dropped,md5,"56bc314bc0d4a0a230a4de2bf978b5ae","",0,20180306
5a9ebaec-29e0-421c-9135-65188064ab0b,134,Artifacts dropped,md5,"4fe4094302c26e7ea2c58f5ca9f7f993","",0,20180306
5a9ebaec-2ee4-46ad-9e1f-65188064ab0b,134,Artifacts dropped,md5,"9b0de56f7f862db73e223f41099fc74c","",0,20180306
5a9ebaec-359c-4b66-afb6-65188064ab0b,134,Artifacts dropped,md5,"7ad8ad340c084f8185e2bb18cbfde891","",0,20180306
5a9ebaec-43dc-4fd9-b2b3-65188064ab0b,134,Artifacts dropped,md5,"08d971f5f4707ae6ea56ed2f243c38b7","",0,20180306
5a9ebaec-4b84-43af-a448-65188064ab0b,134,Artifacts dropped,md5,"205a5502ff0da4a471c4dad0e06c6c57","",0,20180306
5a9ebaec-4cf0-4b40-9d1f-65188064ab0b,134,Artifacts dropped,md5,"461446151be0033a668782c2d7ba58cb","",0,20180306
5a9ebaec-4d40-4614-a23e-65188064ab0b,134,Artifacts dropped,md5,"3729531c71163cddcded7e70c02a3004","",0,20180306
5a9ebaec-5038-4cff-8b98-65188064ab0b,134,Artifacts dropped,md5,"449ba12127133ecd0440a558b083468c","",0,20180306
5a9ebaec-50e4-4d9e-85c8-65188064ab0b,134,Artifacts dropped,md5,"3632fb080545d3518d57320466f96cb3","",0,20180306
5a9ebaec-55f8-4be5-8e12-65188064ab0b,134,Artifacts dropped,md5,"90373539c60529153d0d6b0cc857e845","",0,20180306
5a9ebaec-56e8-4a86-b564-65188064ab0b,134,Artifacts dropped,md5,"df0045bd4168893922480f7ccb29860a","",0,20180306
5a9ebaec-5d38-493a-a73c-65188064ab0b,134,Artifacts dropped,md5,"7fd98d6bb1e9d6bcf2e1984e812c1e46","",0,20180306
5a9ebaec-87ac-4368-b185-65188064ab0b,134,Artifacts dropped,md5,"e436e849d9496ef3f651c1904786c78f","",0,20180306
5a9ebaec-887c-4c49-baa1-65188064ab0b,134,Artifacts dropped,md5,"8fea3de31a58415c3fec2e6dd4095575","",0,20180306
5a9ebaec-9cb8-477d-a13f-65188064ab0b,134,Artifacts dropped,md5,"a5ae6e0d74052d4f889f2538fdd7cb9b","",0,20180306
5a9ebaec-9dd4-42eb-aef1-65188064ab0b,134,Artifacts dropped,md5,"5c3f0dcf4aaa699b50154aa245923c86","",0,20180306
5a9ebaec-a0c8-4282-8b2b-65188064ab0b,134,Artifacts dropped,md5,"6a442a610c047a7a306a12f423978bfb","",0,20180306
5a9ebaec-af4c-40fc-8e98-65188064ab0b,134,Artifacts dropped,md5,"d7ec065cc3f563928504f80692578d2f","",0,20180306
5a9ebaec-ba64-42f1-9505-65188064ab0b,134,Artifacts dropped,md5,"58239ea5747d3375278ce7c04db22c1b","",0,20180306
5a9ebaec-bb18-4c5d-879d-65188064ab0b,134,Artifacts dropped,md5,"20755b98d7c094747b75b157413e3422","",0,20180306
5a9ebaec-bb2c-495d-a460-65188064ab0b,134,Artifacts dropped,md5,"be6f2a03dfddbaf1166854730961d13c","",0,20180306
5a9ebaec-bbec-446d-a785-65188064ab0b,134,Artifacts dropped,md5,"8bb2ba6f1cfa3bd99146688cd1e76bb0","",0,20180306
5a9ebaec-c054-4a65-8ff3-65188064ab0b,134,Artifacts dropped,md5,"f344da38958dbc730ddebc10660cd451","",0,20180306
5a9ebaec-c1f8-45f5-abd0-65188064ab0b,134,Artifacts dropped,md5,"001316808aa7108b467e8ecc06139c2e","",0,20180306
5a9ebaec-d490-4f27-be9b-65188064ab0b,134,Artifacts dropped,md5,"e80d8a0c35133f7485d8e87ade903919","",0,20180306
5a9ebaec-e354-4d5d-bafb-65188064ab0b,134,Artifacts dropped,md5,"fa90508007b94a4dbfeb8b48d5443ec8","",0,20180306
5a9ebaec-e6dc-44c8-a030-65188064ab0b,134,Artifacts dropped,md5,"be8a344487bcfea66de8e0f0f14d869e","",0,20180306
5a9ebaec-f230-436a-b587-65188064ab0b,134,Artifacts dropped,md5,"f36e67109ae368c9db109d0a41b5817c","",0,20180306
5a9ebaec-f83c-46dd-9ceb-65188064ab0b,134,Artifacts dropped,md5,"89180820b47bb11ccf0c8505371e98d1","",0,20180306
5a9ebaec-ff78-4858-a1e3-65188064ab0b,134,Artifacts dropped,md5,"6491df10c766be9c487fb9495d04df6e","",0,20180306
5aa03a55-0118-4f2a-9ab5-67a48064ab0b,134,Network activity,domain,"internet.downloadingdocuments.com","",1,20180307
5aa03a55-6920-413a-a285-67a48064ab0b,134,Network activity,domain,"epoch.englishdownloaders.today","",1,20180307
5aa03a55-7f20-4130-9def-67a48064ab0b,134,Network activity,domain,"upd-ms3-app-state.com","",1,20180307
5aa03a55-d3dc-4b53-a6e4-67a48064ab0b,134,Network activity,domain,"document.downloadingsystem.com","",1,20180307
5aa03a55-e36c-4dc5-934d-67a48064ab0b,134,Network activity,domain,"system.filedownloaders.com","",1,20180307
5aa03c02-0bd0-42ee-ade7-67a28064ab0b,134,Network activity,domain,"solitude.filedownloads.online","",1,20180307
5aa03c02-8520-4c2c-8ae7-67a28064ab0b,134,Network activity,domain,"bombinate.winload.info","",1,20180307
5aa03c02-e238-4288-9217-67a28064ab0b,134,Network activity,domain,"epoch.uploaders.online","",1,20180307
1 uuid event_id category type value comment to_ids date
2 5a9ebab6-193c-4062-8a28-630f8064ab0b 134 Network activity domain updserv-east-cdn3.com 1 20180306
3 5a9ebab6-1cf8-44f7-9995-630f8064ab0b 134 Network activity domain downloading.syriantelecom.co 1 20180306
4 5a9ebab6-1dc4-4139-92f9-630f8064ab0b 134 Network activity domain computing.downloaders.today 1 20180306
5 5a9ebab6-389c-4de0-be65-630f8064ab0b 134 Network activity domain ms-cdn-88.com 1 20180306
6 5a9ebab6-41d4-4b46-8c16-630f8064ab0b 134 Network activity domain solitude.file-download.today 1 20180306
7 5a9ebab6-479c-4201-b823-630f8064ab0b 134 Network activity domain window.processingdownloads.today 1 20180306
8 5a9ebab6-49a8-4bb1-81d7-630f8064ab0b 134 Network activity domain redirection.bid 1 20180306
9 5a9ebab6-5b58-489e-90e2-630f8064ab0b 134 Network activity domain download.downloading.shop 1 20180306
10 5a9ebab6-adc4-48ac-8d5d-630f8064ab0b 134 Network activity domain epiphany.download-document.world 1 20180306
11 5a9ebab6-b230-4313-9195-630f8064ab0b 134 Network activity domain cdn-upd-ms6.com 1 20180306
12 5a9ebab6-b9b8-412b-9929-630f8064ab0b 134 Network activity domain epoch.wind-files.today 1 20180306
13 5a9ebab6-c2ac-45da-902c-630f8064ab0b 134 Network activity domain system.documentations.live 1 20180306
14 5a9ebab6-caf4-41b4-8e69-630f8064ab0b 134 Network activity domain internet.document-management.today 1 20180306
15 5a9ebab6-dd2c-446e-94a1-630f8064ab0b 134 Network activity domain storage.computingdownloads.life 1 20180306
16 5a9ebab6-def0-4a56-9745-630f8064ab0b 134 Network activity domain downloading.internetdownloading.co 1 20180306
17 5a9ebab6-e0ac-49ac-b6fa-630f8064ab0b 134 Network activity domain download.syriantelecommunications.co 1 20180306
18 5a9ebab6-f734-4a44-a766-630f8064ab0b 134 Network activity domain download.downloadering.co 1 20180306
19 5a9ebaec-0668-4191-b597-65188064ab0b 134 Artifacts dropped md5 6ce947913231bd968c86a2737bae7bba 0 20180306
20 5a9ebaec-0ba0-4c9f-91f1-65188064ab0b 134 Artifacts dropped md5 40383bee9846ecbd78581402e3379051 0 20180306
21 5a9ebaec-0d08-4751-b2a6-65188064ab0b 134 Artifacts dropped md5 43b39fd4ddc386092372da19f6278c25 0 20180306
22 5a9ebaec-0d40-42e6-8472-65188064ab0b 134 Artifacts dropped md5 32bc51088953377d601c6b27ca7484a9 0 20180306
23 5a9ebaec-1034-4a7d-8335-65188064ab0b 134 Artifacts dropped md5 08b8b4787f3ce90c6c1483cc127b1cdc 0 20180306
24 5a9ebaec-1c94-40ca-b487-65188064ab0b 134 Artifacts dropped md5 a070fd2cce434a6f0b0d0fa6d3278d22 0 20180306
25 5a9ebaec-1de8-45fc-8681-65188064ab0b 134 Artifacts dropped md5 8c8eb5cfc5642a773c5f2b5f59148aa3 0 20180306
26 5a9ebaec-1fdc-4320-a7d2-65188064ab0b 134 Artifacts dropped md5 56bc314bc0d4a0a230a4de2bf978b5ae 0 20180306
27 5a9ebaec-29e0-421c-9135-65188064ab0b 134 Artifacts dropped md5 4fe4094302c26e7ea2c58f5ca9f7f993 0 20180306
28 5a9ebaec-2ee4-46ad-9e1f-65188064ab0b 134 Artifacts dropped md5 9b0de56f7f862db73e223f41099fc74c 0 20180306
29 5a9ebaec-359c-4b66-afb6-65188064ab0b 134 Artifacts dropped md5 7ad8ad340c084f8185e2bb18cbfde891 0 20180306
30 5a9ebaec-43dc-4fd9-b2b3-65188064ab0b 134 Artifacts dropped md5 08d971f5f4707ae6ea56ed2f243c38b7 0 20180306
31 5a9ebaec-4b84-43af-a448-65188064ab0b 134 Artifacts dropped md5 205a5502ff0da4a471c4dad0e06c6c57 0 20180306
32 5a9ebaec-4cf0-4b40-9d1f-65188064ab0b 134 Artifacts dropped md5 461446151be0033a668782c2d7ba58cb 0 20180306
33 5a9ebaec-4d40-4614-a23e-65188064ab0b 134 Artifacts dropped md5 3729531c71163cddcded7e70c02a3004 0 20180306
34 5a9ebaec-5038-4cff-8b98-65188064ab0b 134 Artifacts dropped md5 449ba12127133ecd0440a558b083468c 0 20180306
35 5a9ebaec-50e4-4d9e-85c8-65188064ab0b 134 Artifacts dropped md5 3632fb080545d3518d57320466f96cb3 0 20180306
36 5a9ebaec-55f8-4be5-8e12-65188064ab0b 134 Artifacts dropped md5 90373539c60529153d0d6b0cc857e845 0 20180306
37 5a9ebaec-56e8-4a86-b564-65188064ab0b 134 Artifacts dropped md5 df0045bd4168893922480f7ccb29860a 0 20180306
38 5a9ebaec-5d38-493a-a73c-65188064ab0b 134 Artifacts dropped md5 7fd98d6bb1e9d6bcf2e1984e812c1e46 0 20180306
39 5a9ebaec-87ac-4368-b185-65188064ab0b 134 Artifacts dropped md5 e436e849d9496ef3f651c1904786c78f 0 20180306
40 5a9ebaec-887c-4c49-baa1-65188064ab0b 134 Artifacts dropped md5 8fea3de31a58415c3fec2e6dd4095575 0 20180306
41 5a9ebaec-9cb8-477d-a13f-65188064ab0b 134 Artifacts dropped md5 a5ae6e0d74052d4f889f2538fdd7cb9b 0 20180306
42 5a9ebaec-9dd4-42eb-aef1-65188064ab0b 134 Artifacts dropped md5 5c3f0dcf4aaa699b50154aa245923c86 0 20180306
43 5a9ebaec-a0c8-4282-8b2b-65188064ab0b 134 Artifacts dropped md5 6a442a610c047a7a306a12f423978bfb 0 20180306
44 5a9ebaec-af4c-40fc-8e98-65188064ab0b 134 Artifacts dropped md5 d7ec065cc3f563928504f80692578d2f 0 20180306
45 5a9ebaec-ba64-42f1-9505-65188064ab0b 134 Artifacts dropped md5 58239ea5747d3375278ce7c04db22c1b 0 20180306
46 5a9ebaec-bb18-4c5d-879d-65188064ab0b 134 Artifacts dropped md5 20755b98d7c094747b75b157413e3422 0 20180306
47 5a9ebaec-bb2c-495d-a460-65188064ab0b 134 Artifacts dropped md5 be6f2a03dfddbaf1166854730961d13c 0 20180306
48 5a9ebaec-bbec-446d-a785-65188064ab0b 134 Artifacts dropped md5 8bb2ba6f1cfa3bd99146688cd1e76bb0 0 20180306
49 5a9ebaec-c054-4a65-8ff3-65188064ab0b 134 Artifacts dropped md5 f344da38958dbc730ddebc10660cd451 0 20180306
50 5a9ebaec-c1f8-45f5-abd0-65188064ab0b 134 Artifacts dropped md5 001316808aa7108b467e8ecc06139c2e 0 20180306
51 5a9ebaec-d490-4f27-be9b-65188064ab0b 134 Artifacts dropped md5 e80d8a0c35133f7485d8e87ade903919 0 20180306
52 5a9ebaec-e354-4d5d-bafb-65188064ab0b 134 Artifacts dropped md5 fa90508007b94a4dbfeb8b48d5443ec8 0 20180306
53 5a9ebaec-e6dc-44c8-a030-65188064ab0b 134 Artifacts dropped md5 be8a344487bcfea66de8e0f0f14d869e 0 20180306
54 5a9ebaec-f230-436a-b587-65188064ab0b 134 Artifacts dropped md5 f36e67109ae368c9db109d0a41b5817c 0 20180306
55 5a9ebaec-f83c-46dd-9ceb-65188064ab0b 134 Artifacts dropped md5 89180820b47bb11ccf0c8505371e98d1 0 20180306
56 5a9ebaec-ff78-4858-a1e3-65188064ab0b 134 Artifacts dropped md5 6491df10c766be9c487fb9495d04df6e 0 20180306
57 5aa03a55-0118-4f2a-9ab5-67a48064ab0b 134 Network activity domain internet.downloadingdocuments.com 1 20180307
58 5aa03a55-6920-413a-a285-67a48064ab0b 134 Network activity domain epoch.englishdownloaders.today 1 20180307
59 5aa03a55-7f20-4130-9def-67a48064ab0b 134 Network activity domain upd-ms3-app-state.com 1 20180307
60 5aa03a55-d3dc-4b53-a6e4-67a48064ab0b 134 Network activity domain document.downloadingsystem.com 1 20180307
61 5aa03a55-e36c-4dc5-934d-67a48064ab0b 134 Network activity domain system.filedownloaders.com 1 20180307
62 5aa03c02-0bd0-42ee-ade7-67a28064ab0b 134 Network activity domain solitude.filedownloads.online 1 20180307
63 5aa03c02-8520-4c2c-8ae7-67a28064ab0b 134 Network activity domain bombinate.winload.info 1 20180307
64 5aa03c02-e238-4288-9217-67a28064ab0b 134 Network activity domain epoch.uploaders.online 1 20180307

1115
data/ioc/spyware/citizen_lab/201803_BadTraffic/misp.json Normal file
View File

File diff suppressed because it is too large Load Diff

113
data/ioc/spyware/citizen_lab/201803_BadTraffic/openioc.ioc Normal file
View File

@@ -0,0 +1,113 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5a84a4bc-1498-4808-9cf1-6ce78e96ca05" last-modified="2018-02-14T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #134</short_description>
<description>Bad Traffic</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2018-02-14T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="5a84a4bc-1498-4808-9cf1-6ce78e96ca05">
<IndicatorItem id="document.downloadingsystem.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="epoch.englishdownloaders.today" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="internet.downloadingdocuments.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="system.filedownloaders.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="upd-ms3-app-state.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="bombinate.winload.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="epoch.uploaders.online" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="solitude.filedownloads.online" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="download.downloading.shop" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="downloading.syriantelecom.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="download.syriantelecommunications.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="redirection.bid" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="downloading.internetdownloading.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="download.downloadering.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="updserv-east-cdn3.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="computing.downloaders.today" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="storage.computingdownloads.life" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="window.processingdownloads.today" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="ms-cdn-88.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="solitude.file-download.today" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="system.documentations.live" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="epiphany.download-document.world" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="epoch.wind-files.today" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="internet.document-management.today" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="cdn-upd-ms6.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

1633
data/ioc/spyware/citizen_lab/201803_BadTraffic/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff

41
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/indicators.csv Normal file
View File

@@ -0,0 +1,41 @@
uuid,event_id,category,type,value,comment,to_ids,date
5a71edfd-1054-4f90-b881-09238e96ca05,133,Network activity,domain,"tibetnews.info","",1,20180131
5a71edfd-1460-419f-bf27-09238e96ca05,133,Network activity,domain,"tibetnews.today","",1,20180131
5a71edfd-2d74-416f-b7f1-09238e96ca05,133,Network activity,domain,"daynew.today","",1,20180131
5a71edfd-3760-46ea-ac88-09238e96ca05,133,Network activity,domain,"daynews.today","",1,20180131
5a71edfd-5044-404c-8b48-09238e96ca05,133,Network activity,domain,"commail.co","",1,20180131
5a71edfd-65f0-498f-8143-09238e96ca05,133,Network activity,domain,"comemail.email","",1,20180131
5a71edfd-6f60-4192-8e0f-09238e96ca05,133,Network activity,domain,"tibethouse.info","",1,20180131
5a71edfd-f620-4e5f-bc15-09238e96ca05,133,Network activity,domain,"tibetfrum.info","",1,20180131
5a71edfd-f73c-4213-9784-09238e96ca05,133,Network activity,domain,"comemails.email","",1,20180131
5b657bbb-48f4-4cc2-a236-72cf8064ab0b,133,Network activity,ip-dst,"27.126.186.222","",1,20180804
5b657bbb-9bdc-4b23-b160-72cf8064ab0b,133,Network activity,ip-dst,"115.126.86.151","",1,20180804
5b657bbb-d594-49ae-8e85-72cf8064ab0b,133,Network activity,ip-dst,"45.127.97.222","",1,20180804
5b657bbb-e338-4722-af6a-72cf8064ab0b,133,Network activity,ip-dst,"103.55.24.196","",1,20180804
5b657bbb-eed0-4569-a919-72cf8064ab0b,133,Network activity,ip-dst,"203.189.232.207","",1,20180804
5b657bbb-f600-4013-bb4b-72cf8064ab0b,133,Network activity,ip-dst,"27.126.176.169","",1,20180804
5b657c1b-46f4-4103-9646-72cb8064ab0b,133,Network activity,domain,"google.comemails.email","",1,20180804
5b657c1b-5dc0-4f64-8569-72cb8064ab0b,133,Network activity,domain,"www.google.comemails.email","",1,20180804
5b657c1b-7ab4-4be5-bdfa-72cb8064ab0b,133,Network activity,domain,"google.commail.co","",1,20180804
5b657c1b-7b50-4ccb-8487-72cb8064ab0b,133,Network activity,domain,"www.comemail.email","",1,20180804
5b657c1b-8868-476a-ad15-72cb8064ab0b,133,Network activity,domain,"mail.google.commail.co","",1,20180804
5b657c1b-9da8-4d2a-be4e-72cb8064ab0b,133,Network activity,domain,"google.commail.email","",1,20180804
5b657c1b-de48-4c26-a83a-72cb8064ab0b,133,Network activity,domain,"google.comemail.email","",1,20180804
5b657c33-0f28-4582-acc2-72cd8064ab0b,133,Attribution,whois-registrant-email,"bqfkdrmnhh0623@gmail.com","",0,20180804
5b657c43-9d0c-49d7-97a8-72cc8064ab0b,133,Attribution,whois-registrant-name,"huang ning","",0,20180804
5b657c55-0d84-46ef-9e3b-167e8064ab0b,133,Attribution,whois-registrant-phone,"8677687877","",0,20180804
5b657c65-3318-46b2-9cd8-15688064ab0b,133,Artifacts dropped,md5,"75b86a01196854919626e87d5bd45a38","",0,20180804
5b657c65-56dc-4bb8-800d-15688064ab0b,133,Artifacts dropped,md5,"054bad7ec0e19cec931078d45382fee6","",0,20180804
5b657c65-5c00-46f9-b147-15688064ab0b,133,Artifacts dropped,md5,"88e85fb6074ae50a3ccc9b410805ffe5","",0,20180804
5b657c65-7318-4bf3-8278-15688064ab0b,133,Artifacts dropped,md5,"058a5d47f8834fccfff8971f0544e387","",0,20180804
5b657c65-7f80-448a-992b-15688064ab0b,133,Artifacts dropped,md5,"57ffde3504934e25904bcc57d27f9217","",0,20180804
5b657c65-86ec-442d-b077-15688064ab0b,133,Artifacts dropped,md5,"4d85904b15c0adc8664f71bc2c5496bf","",0,20180804
5b657c65-8bcc-4a7e-aa47-15688064ab0b,133,Artifacts dropped,md5,"124c475d67aa8391f5220efcc64ca5b3","",0,20180804
5b657c65-9788-4a4c-b5a9-15688064ab0b,133,Artifacts dropped,md5,"c25acaa45b0cf65a39c8413fa99e1fe8","",0,20180804
5b657c65-b82c-4e03-aa1b-15688064ab0b,133,Artifacts dropped,md5,"b1c114ae9172a3bacc5c6b30c410f354","",0,20180804
5b657c65-cb5c-4c8a-b8db-15688064ab0b,133,Artifacts dropped,md5,"72c88c4a9d2316b266a6702374411a99","",0,20180804
5b657c65-f658-4b36-9ac8-15688064ab0b,133,Artifacts dropped,md5,"91e976f76cc027931fed4cf70702efff","",0,20180804
5b657d14-0654-4e9b-b833-72cf8064ab0b,133,Artifacts dropped,md5,"e1b03f5837533ecc9a05e19650d68e1d","",0,20180804
5b657d14-2854-4f64-9d64-72cf8064ab0b,133,Artifacts dropped,md5,"67e866c461c285853b225d2b2c850c4f","",0,20180804
5b657d14-8f34-41e0-ba68-72cf8064ab0b,133,Artifacts dropped,md5,"11e0f3e1c7d8855ed7f1dcfce4b7702a","",0,20180804
5b657d2e-f628-4a1e-b142-72cb8064ab0b,133,Payload delivery,email-src,"tibetanparliarnent@yahoo.com","",0,20180804
1 uuid event_id category type value comment to_ids date
2 5a71edfd-1054-4f90-b881-09238e96ca05 133 Network activity domain tibetnews.info 1 20180131
3 5a71edfd-1460-419f-bf27-09238e96ca05 133 Network activity domain tibetnews.today 1 20180131
4 5a71edfd-2d74-416f-b7f1-09238e96ca05 133 Network activity domain daynew.today 1 20180131
5 5a71edfd-3760-46ea-ac88-09238e96ca05 133 Network activity domain daynews.today 1 20180131
6 5a71edfd-5044-404c-8b48-09238e96ca05 133 Network activity domain commail.co 1 20180131
7 5a71edfd-65f0-498f-8143-09238e96ca05 133 Network activity domain comemail.email 1 20180131
8 5a71edfd-6f60-4192-8e0f-09238e96ca05 133 Network activity domain tibethouse.info 1 20180131
9 5a71edfd-f620-4e5f-bc15-09238e96ca05 133 Network activity domain tibetfrum.info 1 20180131
10 5a71edfd-f73c-4213-9784-09238e96ca05 133 Network activity domain comemails.email 1 20180131
11 5b657bbb-48f4-4cc2-a236-72cf8064ab0b 133 Network activity ip-dst 27.126.186.222 1 20180804
12 5b657bbb-9bdc-4b23-b160-72cf8064ab0b 133 Network activity ip-dst 115.126.86.151 1 20180804
13 5b657bbb-d594-49ae-8e85-72cf8064ab0b 133 Network activity ip-dst 45.127.97.222 1 20180804
14 5b657bbb-e338-4722-af6a-72cf8064ab0b 133 Network activity ip-dst 103.55.24.196 1 20180804
15 5b657bbb-eed0-4569-a919-72cf8064ab0b 133 Network activity ip-dst 203.189.232.207 1 20180804
16 5b657bbb-f600-4013-bb4b-72cf8064ab0b 133 Network activity ip-dst 27.126.176.169 1 20180804
17 5b657c1b-46f4-4103-9646-72cb8064ab0b 133 Network activity domain google.comemails.email 1 20180804
18 5b657c1b-5dc0-4f64-8569-72cb8064ab0b 133 Network activity domain www.google.comemails.email 1 20180804
19 5b657c1b-7ab4-4be5-bdfa-72cb8064ab0b 133 Network activity domain google.commail.co 1 20180804
20 5b657c1b-7b50-4ccb-8487-72cb8064ab0b 133 Network activity domain www.comemail.email 1 20180804
21 5b657c1b-8868-476a-ad15-72cb8064ab0b 133 Network activity domain mail.google.commail.co 1 20180804
22 5b657c1b-9da8-4d2a-be4e-72cb8064ab0b 133 Network activity domain google.commail.email 1 20180804
23 5b657c1b-de48-4c26-a83a-72cb8064ab0b 133 Network activity domain google.comemail.email 1 20180804
24 5b657c33-0f28-4582-acc2-72cd8064ab0b 133 Attribution whois-registrant-email bqfkdrmnhh0623@gmail.com 0 20180804
25 5b657c43-9d0c-49d7-97a8-72cc8064ab0b 133 Attribution whois-registrant-name huang ning 0 20180804
26 5b657c55-0d84-46ef-9e3b-167e8064ab0b 133 Attribution whois-registrant-phone 8677687877 0 20180804
27 5b657c65-3318-46b2-9cd8-15688064ab0b 133 Artifacts dropped md5 75b86a01196854919626e87d5bd45a38 0 20180804
28 5b657c65-56dc-4bb8-800d-15688064ab0b 133 Artifacts dropped md5 054bad7ec0e19cec931078d45382fee6 0 20180804
29 5b657c65-5c00-46f9-b147-15688064ab0b 133 Artifacts dropped md5 88e85fb6074ae50a3ccc9b410805ffe5 0 20180804
30 5b657c65-7318-4bf3-8278-15688064ab0b 133 Artifacts dropped md5 058a5d47f8834fccfff8971f0544e387 0 20180804
31 5b657c65-7f80-448a-992b-15688064ab0b 133 Artifacts dropped md5 57ffde3504934e25904bcc57d27f9217 0 20180804
32 5b657c65-86ec-442d-b077-15688064ab0b 133 Artifacts dropped md5 4d85904b15c0adc8664f71bc2c5496bf 0 20180804
33 5b657c65-8bcc-4a7e-aa47-15688064ab0b 133 Artifacts dropped md5 124c475d67aa8391f5220efcc64ca5b3 0 20180804
34 5b657c65-9788-4a4c-b5a9-15688064ab0b 133 Artifacts dropped md5 c25acaa45b0cf65a39c8413fa99e1fe8 0 20180804
35 5b657c65-b82c-4e03-aa1b-15688064ab0b 133 Artifacts dropped md5 b1c114ae9172a3bacc5c6b30c410f354 0 20180804
36 5b657c65-cb5c-4c8a-b8db-15688064ab0b 133 Artifacts dropped md5 72c88c4a9d2316b266a6702374411a99 0 20180804
37 5b657c65-f658-4b36-9ac8-15688064ab0b 133 Artifacts dropped md5 91e976f76cc027931fed4cf70702efff 0 20180804
38 5b657d14-0654-4e9b-b833-72cf8064ab0b 133 Artifacts dropped md5 e1b03f5837533ecc9a05e19650d68e1d 0 20180804
39 5b657d14-2854-4f64-9d64-72cf8064ab0b 133 Artifacts dropped md5 67e866c461c285853b225d2b2c850c4f 0 20180804
40 5b657d14-8f34-41e0-ba68-72cf8064ab0b 133 Artifacts dropped md5 11e0f3e1c7d8855ed7f1dcfce4b7702a 0 20180804
41 5b657d2e-f628-4a1e-b142-72cb8064ab0b 133 Payload delivery email-src tibetanparliarnent@yahoo.com 0 20180804

674
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/indicators.json Normal file
View File

@@ -0,0 +1,674 @@
{"response":[{
"Event": {
"id": "133",
"orgc_id": "2",
"org_id": "2",
"date": "2018-01-31",
"threat_level_id": "2",
"info": "Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces",
"published": true,
"uuid": "5a71edc8-26a8-43fb-8271-5c948e96ca05",
"attribute_count": "40",
"analysis": "2",
"timestamp": "1533377838",
"distribution": "1",
"proposal_email_lock": false,
"locked": false,
"publish_timestamp": "1533378310",
"sharing_group_id": "0",
"Org": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
},
"Orgc": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
},
"Attribute": [
{
"id": "18346",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657c65-f658-4b36-9ac8-15688064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377637",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "91e976f76cc027931fed4cf70702efff",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18347",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657c65-7f80-448a-992b-15688064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377637",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "57ffde3504934e25904bcc57d27f9217",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18348",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657c65-3318-46b2-9cd8-15688064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377637",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "75b86a01196854919626e87d5bd45a38",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18349",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657c65-9788-4a4c-b5a9-15688064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377637",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "c25acaa45b0cf65a39c8413fa99e1fe8",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18350",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657c65-86ec-442d-b077-15688064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377637",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "4d85904b15c0adc8664f71bc2c5496bf",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18351",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657c65-5c00-46f9-b147-15688064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377637",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "88e85fb6074ae50a3ccc9b410805ffe5",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18352",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657c65-7318-4bf3-8278-15688064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377637",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "058a5d47f8834fccfff8971f0544e387",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18353",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657c65-8bcc-4a7e-aa47-15688064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377637",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "124c475d67aa8391f5220efcc64ca5b3",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18354",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657c65-56dc-4bb8-800d-15688064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377637",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "054bad7ec0e19cec931078d45382fee6",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18355",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657c65-b82c-4e03-aa1b-15688064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377637",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "b1c114ae9172a3bacc5c6b30c410f354",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18356",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657c65-cb5c-4c8a-b8db-15688064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377637",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "72c88c4a9d2316b266a6702374411a99",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18357",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657d14-2854-4f64-9d64-72cf8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377812",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "67e866c461c285853b225d2b2c850c4f",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18358",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657d14-0654-4e9b-b833-72cf8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377812",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "e1b03f5837533ecc9a05e19650d68e1d",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18359",
"type": "md5",
"category": "Artifacts dropped",
"to_ids": false,
"uuid": "5b657d14-8f34-41e0-ba68-72cf8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377812",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "11e0f3e1c7d8855ed7f1dcfce4b7702a",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18343",
"type": "whois-registrant-email",
"category": "Attribution",
"to_ids": false,
"uuid": "5b657c33-0f28-4582-acc2-72cd8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377587",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "bqfkdrmnhh0623@gmail.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18344",
"type": "whois-registrant-name",
"category": "Attribution",
"to_ids": false,
"uuid": "5b657c43-9d0c-49d7-97a8-72cc8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377603",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "huang ning",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18345",
"type": "whois-registrant-phone",
"category": "Attribution",
"to_ids": false,
"uuid": "5b657c55-0d84-46ef-9e3b-167e8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377621",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "8677687877",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18048",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5a71edfd-5044-404c-8b48-09238e96ca05",
"event_id": "133",
"distribution": "5",
"timestamp": "1517415933",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "commail.co",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18049",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5a71edfd-f620-4e5f-bc15-09238e96ca05",
"event_id": "133",
"distribution": "5",
"timestamp": "1517415933",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "tibetfrum.info",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18050",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5a71edfd-6f60-4192-8e0f-09238e96ca05",
"event_id": "133",
"distribution": "5",
"timestamp": "1517415933",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "tibethouse.info",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18051",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5a71edfd-1054-4f90-b881-09238e96ca05",
"event_id": "133",
"distribution": "5",
"timestamp": "1517415933",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "tibetnews.info",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18052",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5a71edfd-2d74-416f-b7f1-09238e96ca05",
"event_id": "133",
"distribution": "5",
"timestamp": "1517415933",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "daynew.today",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18053",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5a71edfd-3760-46ea-ac88-09238e96ca05",
"event_id": "133",
"distribution": "5",
"timestamp": "1517415933",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "daynews.today",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18054",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5a71edfd-1460-419f-bf27-09238e96ca05",
"event_id": "133",
"distribution": "5",
"timestamp": "1517415933",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "tibetnews.today",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18055",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5a71edfd-f73c-4213-9784-09238e96ca05",
"event_id": "133",
"distribution": "5",
"timestamp": "1517415933",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "comemails.email",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18056",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5a71edfd-65f0-498f-8143-09238e96ca05",
"event_id": "133",
"distribution": "5",
"timestamp": "1517415933",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "comemail.email",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18336",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657c1b-de48-4c26-a83a-72cb8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377563",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "google.comemail.email",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18337",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657c1b-46f4-4103-9646-72cb8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377563",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "google.comemails.email",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18338",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657c1b-7ab4-4be5-bdfa-72cb8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377563",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "google.commail.co",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18339",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657c1b-9da8-4d2a-be4e-72cb8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377563",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "google.commail.email",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18340",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657c1b-8868-476a-ad15-72cb8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377563",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "mail.google.commail.co",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18341",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657c1b-7b50-4ccb-8487-72cb8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377563",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "www.comemail.email",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18342",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657c1b-5dc0-4f64-8569-72cb8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377563",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "www.google.comemails.email",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18330",
"type": "ip-dst",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657bbb-48f4-4cc2-a236-72cf8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377467",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "27.126.186.222",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18331",
"type": "ip-dst",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657bbb-e338-4722-af6a-72cf8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377467",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "103.55.24.196",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18332",
"type": "ip-dst",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657bbb-eed0-4569-a919-72cf8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377467",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "203.189.232.207",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18333",
"type": "ip-dst",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657bbb-d594-49ae-8e85-72cf8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377467",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "45.127.97.222",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18334",
"type": "ip-dst",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657bbb-9bdc-4b23-b160-72cf8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377467",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "115.126.86.151",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18335",
"type": "ip-dst",
"category": "Network activity",
"to_ids": true,
"uuid": "5b657bbb-f600-4013-bb4b-72cf8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377467",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "27.126.176.169",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18360",
"type": "email-src",
"category": "Payload delivery",
"to_ids": false,
"uuid": "5b657d2e-f628-4a1e-b142-72cb8064ab0b",
"event_id": "133",
"distribution": "5",
"timestamp": "1533377838",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "tibetanparliarnent@yahoo.com",
"SharingGroup": [],
"ShadowAttribute": []
}
],
"ShadowAttribute": [],
"Tag": []
}
}]}

101
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/openioc.ioc Normal file
View File

@@ -0,0 +1,101 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5a71edc8-26a8-43fb-8271-5c948e96ca05" last-modified="2018-01-31T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #133</short_description>
<description>Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2018-01-31T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="5a71edc8-26a8-43fb-8271-5c948e96ca05">
<IndicatorItem id="commail.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="tibetfrum.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="tibethouse.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="tibetnews.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="daynew.today" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="daynews.today" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="tibetnews.today" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="comemails.email" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="comemail.email" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="google.comemail.email" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="google.comemails.email" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="google.commail.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="google.commail.email" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mail.google.commail.co" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.comemail.email" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.google.comemails.email" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="27.126.186.222" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="103.55.24.196" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="203.189.232.207" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="45.127.97.222" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="115.126.86.151" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="27.126.176.169" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

1
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/rules.snort Normal file
View File

@@ -0,0 +1 @@
alert tcp any any -> $HOME_NET any (flow:to_server,established; msg:"Indecent Powershell LOGIN"; content: "LOGIN| 7c 2a 7c |"; pcre:"/LOGIN\|\*\|[0-9\.]+\|\*\|[0-9\.]+\|\*\|/"; sid:1000000;)

273
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/rules.yara Normal file
View File

@@ -0,0 +1,273 @@
rule powershell_dropper {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a = "$decentID = [System.Convert]::FromBase64String($indecentID)"
$b = "if($tmp[1].CPU -gt 0) {} else {[ReverseTCPShell]::run()}"
$c = "function Get-RSACode()"
$d = "-file %temp%\\233.ps1"
condition:
1 of them
}
rule dropper_strings {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a = "bitsadmin /canceft\\windows\\currebitsadmin /addfibitsadmin /Resumbitsadmin /SetNosoftware"
$b = "\\microsotifyCmdLine %s rle %s c:\\windowsbitsadmin /creat\\system32\\net.ex"
$c = "rundll32.exe %s Main"
$d = "d1fasg34"
$e = "FindResource %s error"
condition:
uint16(0) == 0x5A4D and 2 of them
}
rule payload_wab32res_strings {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a1 = "%02d%02d%02d%02d%02d%03d"
$a2 = "459B2-3311-54C3- /Processid:{712"
$a3 = "CreateProcess %s"
$a4 = "FakeRun.dll"
$a5 = "Release\\FakeRun.pdb"
condition:
uint16(0) == 0x5A4D and 2 of them
}
rule pcnt_cert {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a = "MIIDWjCCAkICCQCdeJZhGKJakTANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJV"
$b = "UzERMA8GA1UECAwITmVicmFza2ExEDAOBgNVBAcMB0xpbmNvbG4xDTALBgNVBAoM"
$c = "BFBDTlQxDTALBgNVBAsMBFBDTlQxHTAbBgkqhkiG9w0BCQEWDnBjbnRAZ21haWwu"
$d = "Y29tMB4XDTE4MDEwNjA2MDMyMloXDTI4MDEwNDA2MDMyMlowbzELMAkGA1UEBhMC"
$e = "VVMxETAPBgNVBAgMCE5lYnJhc2thMRAwDgYDVQQHDAdMaW5jb2xuMQ0wCwYDVQQK"
$f = "DARQQ05UMQ0wCwYDVQQLDARQQ05UMR0wGwYJKoZIhvcNAQkBFg5wY250QGdtYWls"
$g = "LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK+ihHezE6jjS2Vl"
$h = "/rIIQsrczmbjU/4KYDiLiCcrxN0tht6GzL281KGoW13IiQvKILANmx02IAy5tzij"
$i = "0W9ZvFAIRRYVDpoSU+EyXz4LjHgXvw6VeG9v3HV99iSmphkq7mLYee0EPYP6wSdB"
condition:
uint16(0) == 0x5A4D and all of them
}
rule custom_decryption {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$encrypt = { 8b d6 81 e2 07 00 00 80 79 05 4a 83 ca f8 42 8a 04 1e 0f be 0c 95 28 7e 46 00 34 01 0f be c0 0f af c8 80 f1 67 88 0c 1e 46 3b f7 7c d3 }
$encrypt2 = { 8A 0C 30 8B D0 83 E2 07 80 F1 01 0F BE C9 0F BE 54 95 D0 0F AF D1 80 F2 85 88 14 30 40 }
$decrypt_file1 = { 0f b6 01 8b d6 83 e2 07 34 01 0f be c0 83 c6 04 0f be }
$decrypt_file2 = { 0f af d0 0f b6 41 01 34 01 0f be c0 88 11 8d 14 0f 83 e2 07 0f be }
$decrypt_file3 = { 0f af d0 0f b6 41 02 34 01 0f be c0 88 51 01 8d 14 0b 83 e2 07 0f be }
$decrypt_file4 = { 0f af d0 0f b6 41 03 34 01 0f be c0 88 51 02 8b 55 fc 03 d1 83 e2 07 0f be }
condition:
uint16(0) == 0x5A4D and ($encrypt or $encrypt2 or all of ($decrypt_file*))
}
rule tclient_strings {
meta:
author = "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a = "sdf81msdf7"
$b = "software\\klive"
$c = "\\Registry\\User\\%s\\Software\\KLive"
$d = "%s\\wab32res.dll"
$e = "[!]NtDeleteValueKey Error:%ul"
$f = "%sDebugLog.TXT"
$g = "Server connect to [%s:%d] Sucesse! token = %s"
$h = "192.168.70.1"
$i = "Start %d connect %s:%d"
condition:
uint16(0) == 0x5A4D and 3 of them
}
rule tclient_string {
meta:
author= "Etienne Maynier"
email = "etienne@citizenlab.ca"
strings:
$a = "showgodmoney1gz"
$b = "MDDEFGEGETGIZ"
condition:
uint16(0) == 0x5A4D and 2 of them
}
rule dsng_installer_dll_characteristics {
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$s1 = "dsng.dll"
$s2 = "InstallD" fullword
$s3 = "InstallZ" fullword
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
all of them
}
rule dsng_installer_dll_stringset {
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$s1 = "KCOM Server Security Guard"
$s2 = "LoadFlgDllFun"
$s3 = "Installv" fullword
$s4 = "Dll path %s"
$s5 = "MainFunVvv"
$s6 = "http://dsas.asdf.com/"
condition:
//MZ header
uint16(0) == 0x5A4D and
//PE signature
uint32(uint32(0x3C)) == 0x00004550 and
2 of them
}
rule tibetan_indecent_rtf_meta {
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$operator = "{\\operator Windows \\'d3\\'c3\\'bb\\'a7}"
condition:
any of them
}
rule tibetan_indecent_ppsx_meta
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$createdby = "<dc:creator>Windows User</dc:creator>"
$createdate = "<dcterms:created xsi:type=\"dcterms:W3CDTF\">2017-10-23T00:57:05Z</dcterms:created>"
condition:
all of them
}
rule tibetan_indecent_powershell
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$decents1 = "$indecentID" ascii wide
$decents2 = "$decentID" ascii wide
$decents3 = "powershell" ascii wide nocase
condition:
all of them
}
rule tibetan_indecent_pe_loader_pdb
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
//C:\Users\learn\Desktop\免杀\
$pdb = {43 3a 5c 55 73 65 72 73 5c 6c 65 61 72 6e 5c 44 65 73 6b 74 6f 70 5c e5 85 8d e6 9d 80}
condition:
all of them
}
rule tibetan_indecent_powershell_tcpshell_funcs
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$class = "public class ReverseTCPShell" ascii wide nocase
$func1 = "public static void run" ascii wide nocase
$func2 = "public static void runth" ascii wide nocase
$func3 = "public static void start" ascii wide nocase
$func4 = "public static bool isOnline" ascii wide nocase
$func5 = "public static void startCmd" ascii wide nocase
$func6 = "public static void CmdExited" ascii wide nocase
$func7 = "public static void DataReceived" ascii wide nocase
$func8 = "public static void FileReceive" ascii wide nocase
$func9 = "public static void CmdManager" ascii wide nocase
$func10 = "public static void SortOutputHandler" ascii wide nocase
$func11 = "public static void SendLoginInfo" ascii wide nocase
$func12 = "public static void Send" ascii wide nocase
$func13 = "public static int SendWithSplit" ascii wide nocase
condition:
6 of them
}
rule tibetan_indecent_infrastructure_strings
{
meta:
author = "Matt Brooks, @cmatthewbrooks"
strings:
$cc1 = "103.55.24.196" ascii wide nocase
$cc2 = "118.99.59.105" ascii wide nocase
$cc3 = "27.126.186.222" ascii wide nocase
$cc4 = "45.127.97.222" ascii wide nocase
$cc5 = "comemail.email" ascii wide nocase
$cc6 = "commail.co" ascii wide nocase
$cc7 = "daynew.today" ascii wide nocase
$cc8 = "daynews.today" ascii wide nocase
$cc9 = "tibetfrum.info" ascii wide nocase
$cc10 = "tibethouse.info" ascii wide nocase
$cc11 = "tibetnews.info" ascii wide nocase
$cc12 = "tibetnews.today" ascii wide nocase
condition:
any of them
}
rule silent_ppk_strings
{
meta:
author = "Geoff Alexander <geoff@citizenlab.ca>"
strings:
$s1 = "MainCommandJobSub"
$s2 = "MainFun002"
$s3 = "mRecvPkgFun"
$s4 = "while -- ClientConnect"
$s5 = "svsdll.log"
$s6 = "ppk.dat"
condition:
uint16(0) == 0x5a4d and 4 of ($s*)
}

1010
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff

21
data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/iocs.csv Normal file
View File

@@ -0,0 +1,21 @@
uuid,event_id,category,type,value,comment,to_ids,date
5bb2777f-11e4-4591-b2d2-700d8064ab0b,138,Payload delivery,domain,"kingdom-news.com","",1,20181001
5bb2777f-17dc-4422-b198-700d8064ab0b,138,Payload delivery,domain,"all-sales.info","",1,20181001
5bb2777f-1d34-42cc-b869-700d8064ab0b,138,Payload delivery,domain,"nouvelles247.com","",1,20181001
5bb2777f-2ef0-4e54-b5dd-700d8064ab0b,138,Payload delivery,domain,"findmyplants.com","",1,20181001
5bb2777f-36c4-4621-abf9-700d8064ab0b,138,Payload delivery,domain,"arabnews365.com","",1,20181001
5bb2777f-4fb0-4727-9c47-700d8064ab0b,138,Payload delivery,domain,"kingdom-deals.com","",1,20181001
5bb2777f-5a18-4c67-9a35-700d8064ab0b,138,Payload delivery,domain,"akhbar-arabia.com","",1,20181001
5bb2777f-6e5c-496e-975b-700d8064ab0b,138,Payload delivery,domain,"muslim-world.info","",1,20181001
5bb2777f-9834-4835-9cd0-700d8064ab0b,138,Payload delivery,domain,"news-gazette.info","",1,20181001
5bb2777f-a8fc-4c13-8aed-700d8064ab0b,138,Payload delivery,domain,"arabworld.biz","",1,20181001
5bb2777f-a91c-45dc-99ae-700d8064ab0b,138,Payload delivery,domain,"dinneraroundyou.com","",1,20181001
5bb2777f-ad24-4ab7-bb07-700d8064ab0b,138,Payload delivery,domain,"promosdereve.com","",1,20181001
5bb2777f-cc98-4611-8d13-700d8064ab0b,138,Payload delivery,domain,"housesfurniture.com","",1,20181001
5bb2777f-ebd0-4410-b335-700d8064ab0b,138,Payload delivery,domain,"daily-sport.news","",1,20181001
5bb2777f-f954-4227-9e89-700d8064ab0b,138,Payload delivery,domain,"mideast-today.com","",1,20181001
5bb27780-ba04-4fa1-9198-700d8064ab0b,138,Payload delivery,domain,"wonderfulinsights.com","",1,20181001
5bb27780-e238-499c-a677-700d8064ab0b,138,Payload delivery,domain,"social-life.info","",1,20181001
5bb27780-fe30-4662-9264-700d8064ab0b,138,Payload delivery,domain,"sunday-deals.com","",1,20181001
5bb277a3-277c-4cc9-a7d0-4c668064ab0b,138,Network activity,domain,"beststores4u.com","",1,20181001
5bb277a3-ac80-403b-a3a7-4c668064ab0b,138,Network activity,domain,"cheapapartmentsaroundme.com","",1,20181001
1 uuid event_id category type value comment to_ids date
2 5bb2777f-11e4-4591-b2d2-700d8064ab0b 138 Payload delivery domain kingdom-news.com 1 20181001
3 5bb2777f-17dc-4422-b198-700d8064ab0b 138 Payload delivery domain all-sales.info 1 20181001
4 5bb2777f-1d34-42cc-b869-700d8064ab0b 138 Payload delivery domain nouvelles247.com 1 20181001
5 5bb2777f-2ef0-4e54-b5dd-700d8064ab0b 138 Payload delivery domain findmyplants.com 1 20181001
6 5bb2777f-36c4-4621-abf9-700d8064ab0b 138 Payload delivery domain arabnews365.com 1 20181001
7 5bb2777f-4fb0-4727-9c47-700d8064ab0b 138 Payload delivery domain kingdom-deals.com 1 20181001
8 5bb2777f-5a18-4c67-9a35-700d8064ab0b 138 Payload delivery domain akhbar-arabia.com 1 20181001
9 5bb2777f-6e5c-496e-975b-700d8064ab0b 138 Payload delivery domain muslim-world.info 1 20181001
10 5bb2777f-9834-4835-9cd0-700d8064ab0b 138 Payload delivery domain news-gazette.info 1 20181001
11 5bb2777f-a8fc-4c13-8aed-700d8064ab0b 138 Payload delivery domain arabworld.biz 1 20181001
12 5bb2777f-a91c-45dc-99ae-700d8064ab0b 138 Payload delivery domain dinneraroundyou.com 1 20181001
13 5bb2777f-ad24-4ab7-bb07-700d8064ab0b 138 Payload delivery domain promosdereve.com 1 20181001
14 5bb2777f-cc98-4611-8d13-700d8064ab0b 138 Payload delivery domain housesfurniture.com 1 20181001
15 5bb2777f-ebd0-4410-b335-700d8064ab0b 138 Payload delivery domain daily-sport.news 1 20181001
16 5bb2777f-f954-4227-9e89-700d8064ab0b 138 Payload delivery domain mideast-today.com 1 20181001
17 5bb27780-ba04-4fa1-9198-700d8064ab0b 138 Payload delivery domain wonderfulinsights.com 1 20181001
18 5bb27780-e238-499c-a677-700d8064ab0b 138 Payload delivery domain social-life.info 1 20181001
19 5bb27780-fe30-4662-9264-700d8064ab0b 138 Payload delivery domain sunday-deals.com 1 20181001
20 5bb277a3-277c-4cc9-a7d0-4c668064ab0b 138 Network activity domain beststores4u.com 1 20181001
21 5bb277a3-ac80-403b-a3a7-4c668064ab0b 138 Network activity domain cheapapartmentsaroundme.com 1 20181001

377
data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/misp.json Normal file
View File

@@ -0,0 +1,377 @@
{"response":[{
"Event": {
"id": "138",
"orgc_id": "2",
"org_id": "2",
"date": "2018-10-01",
"threat_level_id": "1",
"info": "The Kingdom Came To Canada",
"published": true,
"uuid": "5bb27709-12a0-4240-b90e-6f848064ab0b",
"attribute_count": "20",
"analysis": "2",
"timestamp": "1538422691",
"distribution": "1",
"proposal_email_lock": false,
"locked": false,
"publish_timestamp": "1538423091",
"sharing_group_id": "0",
"Org": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
},
"Orgc": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
},
"Attribute": [
{
"id": "18379",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5bb277a3-277c-4cc9-a7d0-4c668064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422691",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "beststores4u.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18380",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5bb277a3-ac80-403b-a3a7-4c668064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422691",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "cheapapartmentsaroundme.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18361",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-5a18-4c67-9a35-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "akhbar-arabia.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18362",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-17dc-4422-b198-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "all-sales.info",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18363",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-36c4-4621-abf9-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "arabnews365.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18364",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-a8fc-4c13-8aed-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "arabworld.biz",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18365",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-ebd0-4410-b335-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "daily-sport.news",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18366",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-a91c-45dc-99ae-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "dinneraroundyou.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18367",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-2ef0-4e54-b5dd-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "findmyplants.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18368",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-cc98-4611-8d13-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "housesfurniture.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18369",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-4fb0-4727-9c47-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "kingdom-deals.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18370",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-11e4-4591-b2d2-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "kingdom-news.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18371",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-f954-4227-9e89-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "mideast-today.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18372",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-6e5c-496e-975b-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "muslim-world.info",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18373",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-9834-4835-9cd0-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "news-gazette.info",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18374",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-1d34-42cc-b869-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "nouvelles247.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18375",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-ad24-4ab7-bb07-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "promosdereve.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18376",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb27780-e238-499c-a677-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422656",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "social-life.info",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18377",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb27780-fe30-4662-9264-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422656",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "sunday-deals.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18378",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb27780-ba04-4fa1-9198-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422656",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "wonderfulinsights.com",
"SharingGroup": [],
"ShadowAttribute": []
}
],
"ShadowAttribute": [],
"RelatedEvent": [],
"Tag": [
{
"id": "5",
"name": "SOURCE:CITIZENLAB",
"colour": "#ffad0d",
"exportable": true,
"org_id": false
},
{
"id": "7",
"name": "DETECT",
"colour": "#cccccc",
"exportable": true,
"org_id": false
},
{
"id": "8",
"name": "PUBLISHED",
"colour": "#91caff",
"exportable": true,
"org_id": false
}
]
}
}]}

93
data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/openioc.ioc Normal file
View File

@@ -0,0 +1,93 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5bb27709-12a0-4240-b90e-6f848064ab0b" last-modified="2018-10-01T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #138</short_description>
<description>The Kingdom Came To Canada</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2018-10-01T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="5bb27709-12a0-4240-b90e-6f848064ab0b">
<IndicatorItem id="beststores4u.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="cheapapartmentsaroundme.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="akhbar-arabia.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="all-sales.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="arabnews365.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="arabworld.biz" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="daily-sport.news" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dinneraroundyou.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="findmyplants.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="housesfurniture.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="kingdom-deals.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="kingdom-news.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mideast-today.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="muslim-world.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="news-gazette.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="nouvelles247.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="promosdereve.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="social-life.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="sunday-deals.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="wonderfulinsights.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

537
data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/stix.xml Normal file
View File

@@ -0,0 +1,537 @@
<stix:STIX_Package
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
xmlns:marking="http://data-marking.mitre.org/Marking-1"
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:indicator="http://stix.mitre.org/Indicator-2"
xmlns:ttp="http://stix.mitre.org/TTP-1"
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
xsi:schemaLocation="
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-7dcd1bb3-5361-4e47-b0ef-3acaeee6a84b" version="1.1.1" timestamp="2018-10-01T19:46:38.446941+00:00">
<stix:STIX_Header>
<stix:Title>Export from MISP</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Related_Packages>
<stix:Related_Package>
<stix:Package id=":STIXPackage-5bb27709-12a0-4240-b90e-6f848064ab0b" version="1.1.1" timestamp="2018-10-01T15:38:11+00:00">
<stix:STIX_Header>
<stix:Title>The Kingdom Came To Canada (MISP Event #138)</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Incidents>
<stix:Incident id=":incident-5bb27709-12a0-4240-b90e-6f848064ab0b" timestamp="2018-10-01T15:44:51+00:00" xsi:type='incident:IncidentType'>
<incident:Title>The Kingdom Came To Canada</incident:Title>
<incident:External_ID source="MISP Event">138</incident:External_ID>
<incident:Time>
<incident:Incident_Discovery precision="second">2018-10-01T00:00:00+00:00</incident:Incident_Discovery>
<incident:Incident_Reported precision="second">2018-10-01T15:44:51+00:00</incident:Incident_Reported>
</incident:Time>
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
<incident:Related_Indicators>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb277a3-277c-4cc9-a7d0-4c668064ab0b" timestamp="2018-10-01T15:38:11+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: beststores4u.com (MISP Attribute #18379)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: beststores4u.com (MISP Attribute #18379)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb277a3-277c-4cc9-a7d0-4c668064ab0b">
<cybox:Object id=":DomainName-5bb277a3-277c-4cc9-a7d0-4c668064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">beststores4u.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:38:11+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb277a3-ac80-403b-a3a7-4c668064ab0b" timestamp="2018-10-01T15:38:11+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: cheapapartmentsaroundme.com (MISP Attribute #18380)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: cheapapartmentsaroundme.com (MISP Attribute #18380)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb277a3-ac80-403b-a3a7-4c668064ab0b">
<cybox:Object id=":DomainName-5bb277a3-ac80-403b-a3a7-4c668064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">cheapapartmentsaroundme.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:38:11+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-5a18-4c67-9a35-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: akhbar-arabia.com (MISP Attribute #18361)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: akhbar-arabia.com (MISP Attribute #18361)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-5a18-4c67-9a35-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-5a18-4c67-9a35-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">akhbar-arabia.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-17dc-4422-b198-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: all-sales.info (MISP Attribute #18362)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: all-sales.info (MISP Attribute #18362)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-17dc-4422-b198-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-17dc-4422-b198-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">all-sales.info</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-36c4-4621-abf9-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: arabnews365.com (MISP Attribute #18363)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: arabnews365.com (MISP Attribute #18363)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-36c4-4621-abf9-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-36c4-4621-abf9-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">arabnews365.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-a8fc-4c13-8aed-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: arabworld.biz (MISP Attribute #18364)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: arabworld.biz (MISP Attribute #18364)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-a8fc-4c13-8aed-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-a8fc-4c13-8aed-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">arabworld.biz</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-ebd0-4410-b335-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: daily-sport.news (MISP Attribute #18365)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: daily-sport.news (MISP Attribute #18365)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-ebd0-4410-b335-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-ebd0-4410-b335-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">daily-sport.news</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-a91c-45dc-99ae-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: dinneraroundyou.com (MISP Attribute #18366)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: dinneraroundyou.com (MISP Attribute #18366)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-a91c-45dc-99ae-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-a91c-45dc-99ae-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">dinneraroundyou.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-2ef0-4e54-b5dd-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: findmyplants.com (MISP Attribute #18367)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: findmyplants.com (MISP Attribute #18367)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-2ef0-4e54-b5dd-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-2ef0-4e54-b5dd-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">findmyplants.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-cc98-4611-8d13-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: housesfurniture.com (MISP Attribute #18368)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: housesfurniture.com (MISP Attribute #18368)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-cc98-4611-8d13-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-cc98-4611-8d13-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">housesfurniture.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-4fb0-4727-9c47-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: kingdom-deals.com (MISP Attribute #18369)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: kingdom-deals.com (MISP Attribute #18369)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-4fb0-4727-9c47-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-4fb0-4727-9c47-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">kingdom-deals.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-11e4-4591-b2d2-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: kingdom-news.com (MISP Attribute #18370)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: kingdom-news.com (MISP Attribute #18370)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-11e4-4591-b2d2-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-11e4-4591-b2d2-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">kingdom-news.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-f954-4227-9e89-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: mideast-today.com (MISP Attribute #18371)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: mideast-today.com (MISP Attribute #18371)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-f954-4227-9e89-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-f954-4227-9e89-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">mideast-today.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-6e5c-496e-975b-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: muslim-world.info (MISP Attribute #18372)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: muslim-world.info (MISP Attribute #18372)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-6e5c-496e-975b-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-6e5c-496e-975b-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">muslim-world.info</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-9834-4835-9cd0-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: news-gazette.info (MISP Attribute #18373)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: news-gazette.info (MISP Attribute #18373)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-9834-4835-9cd0-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-9834-4835-9cd0-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">news-gazette.info</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-1d34-42cc-b869-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: nouvelles247.com (MISP Attribute #18374)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: nouvelles247.com (MISP Attribute #18374)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-1d34-42cc-b869-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-1d34-42cc-b869-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">nouvelles247.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-ad24-4ab7-bb07-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: promosdereve.com (MISP Attribute #18375)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: promosdereve.com (MISP Attribute #18375)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-ad24-4ab7-bb07-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-ad24-4ab7-bb07-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">promosdereve.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb27780-e238-499c-a677-700d8064ab0b" timestamp="2018-10-01T15:37:36+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: social-life.info (MISP Attribute #18376)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: social-life.info (MISP Attribute #18376)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb27780-e238-499c-a677-700d8064ab0b">
<cybox:Object id=":DomainName-5bb27780-e238-499c-a677-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">social-life.info</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:36+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb27780-fe30-4662-9264-700d8064ab0b" timestamp="2018-10-01T15:37:36+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: sunday-deals.com (MISP Attribute #18377)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: sunday-deals.com (MISP Attribute #18377)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb27780-fe30-4662-9264-700d8064ab0b">
<cybox:Object id=":DomainName-5bb27780-fe30-4662-9264-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">sunday-deals.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:36+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb27780-ba04-4fa1-9198-700d8064ab0b" timestamp="2018-10-01T15:37:36+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: wonderfulinsights.com (MISP Attribute #18378)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: wonderfulinsights.com (MISP Attribute #18378)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb27780-ba04-4fa1-9198-700d8064ab0b">
<cybox:Object id=":DomainName-5bb27780-ba04-4fa1-9198-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">wonderfulinsights.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:36+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
</incident:Related_Indicators>
<incident:History>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">Event Threat Level: High</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: PUBLISHED</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: TLP:WHITE</incident:Journal_Entry>
</incident:History_Item>
</incident:History>
<incident:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>citizenlab</stixCommon:Name>
</stixCommon:Identity>
</incident:Information_Source>
<incident:Handling>
<marking:Marking>
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
</marking:Marking>
</incident:Handling>
</stix:Incident>
</stix:Incidents>
</stix:Package>
</stix:Related_Package>
</stix:Related_Packages>
</stix:STIX_Package>

3
data/ioc/spyware/citizen_lab/201905_EndlessMayfly/README.md Normal file
View File

@@ -0,0 +1,3 @@
# Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign
Indicators for the campaign "[Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign](https://citizenlab.ca/2019/05/burned-after-reading-endless-mayflys-ephemeral-disinformation-campaign/)" published by the Citizen Lab

8
data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.csv Normal file
View File

@@ -0,0 +1,8 @@
uuid,event_id,category,type,value,comment,to_ids,date,object_relation,attribute_tag,object_uuid,object_name,object_meta_category
"5cd56487-0b50-4e81-b7eb-651f0a14d415",138,"Payload delivery","md5","5b920c6cd1d8de54463f07965b8c43f3","",0,1557488775,"","","","",""
"5cd56487-b340-4b92-a378-651f0a14d415",138,"Payload delivery","md5","07d495245814c5c4996422b4b2f52473","",0,1557488775,"","","","",""
"5cd56487-4424-4859-99b3-651f0a14d415",138,"Payload delivery","md5","8522c77e48c846c2c026b6e16501a3b2","",0,1557488775,"","","","",""
"5cd56487-a880-4c60-a6f0-651f0a14d415",138,"Payload delivery","md5","bc31493e996db7fe45b7ed7aaa51fd54","",0,1557488775,"","","","",""
"5cd564a2-e098-43bc-8cd6-65920a14d415",138,"Network activity","ip-dst","217.182.54.223","",0,1557488802,"","","","",""
"5cd564a2-7c6c-46b2-acb4-65920a14d415",138,"Network activity","ip-dst","51.255.101.144","",0,1557488802,"","","","",""
1 uuid event_id category type value comment to_ids date object_relation attribute_tag object_uuid object_name object_meta_category
2 5cd56487-0b50-4e81-b7eb-651f0a14d415 138 Payload delivery md5 5b920c6cd1d8de54463f07965b8c43f3 0 1557488775
3 5cd56487-b340-4b92-a378-651f0a14d415 138 Payload delivery md5 07d495245814c5c4996422b4b2f52473 0 1557488775
4 5cd56487-4424-4859-99b3-651f0a14d415 138 Payload delivery md5 8522c77e48c846c2c026b6e16501a3b2 0 1557488775
5 5cd56487-a880-4c60-a6f0-651f0a14d415 138 Payload delivery md5 bc31493e996db7fe45b7ed7aaa51fd54 0 1557488775
6 5cd564a2-e098-43bc-8cd6-65920a14d415 138 Network activity ip-dst 217.182.54.223 0 1557488802
7 5cd564a2-7c6c-46b2-acb4-65920a14d415 138 Network activity ip-dst 51.255.101.144 0 1557488802

37
data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.ioc Normal file
View File

@@ -0,0 +1,37 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5cd56458-a1b0-4129-8649-64d90a14d415" last-modified="2019-05-10T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #138</short_description>
<description>Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign (5cd56458-a1b0-4129-8649-64d90a14d415)</description>
<keywords />
<authored_by>MAIN</authored_by>
<authored_date>2019-05-10T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="5cd5657b-86f0-43c7-88a5-64db0a14d415">
<IndicatorItem id="5cd56487-0b50-4e81-b7eb-651f0a14d415" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5">5b920c6cd1d8de54463f07965b8c43f3</Content>
</IndicatorItem>
<IndicatorItem id="5cd56487-b340-4b92-a378-651f0a14d415" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5">07d495245814c5c4996422b4b2f52473</Content>
</IndicatorItem>
<IndicatorItem id="5cd56487-4424-4859-99b3-651f0a14d415" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5">8522c77e48c846c2c026b6e16501a3b2</Content>
</IndicatorItem>
<IndicatorItem id="5cd56487-a880-4c60-a6f0-651f0a14d415" condition="is">
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
<Content type="md5">bc31493e996db7fe45b7ed7aaa51fd54</Content>
</IndicatorItem>
<IndicatorItem id="5cd564a2-e098-43bc-8cd6-65920a14d415" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP">217.182.54.223</Content>
</IndicatorItem>
<IndicatorItem id="5cd564a2-7c6c-46b2-acb4-65920a14d415" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP">51.255.101.144</Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

1
data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.json Normal file
View File

@@ -0,0 +1 @@
{"response": [{"Event":{"id":"138","orgc_id":"1","org_id":"1","date":"2019-05-10","threat_level_id":"2","info":"Burned After Reading: Endless Mayfly\u2019s Ephemeral Disinformation Campaign","published":true,"uuid":"5cd56458-a1b0-4129-8649-64d90a14d415","attribute_count":"6","analysis":"2","timestamp":"1557488802","distribution":"1","proposal_email_lock":false,"locked":false,"publish_timestamp":"1557488829","sharing_group_id":"0","disable_correlation":false,"extends_uuid":"","event_creator_email":"tek@randhome.io","Org":{"id":"1","name":"MAIN","uuid":"5bd8e936-9bd4-4da2-8837-04067fcbd4ab"},"Orgc":{"id":"1","name":"MAIN","uuid":"5bd8e936-9bd4-4da2-8837-04067fcbd4ab"},"Attribute":[{"id":"16779","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-0b50-4e81-b7eb-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"5b920c6cd1d8de54463f07965b8c43f3","Galaxy":[],"ShadowAttribute":[]},{"id":"16780","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-b340-4b92-a378-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"07d495245814c5c4996422b4b2f52473","Galaxy":[],"ShadowAttribute":[]},{"id":"16781","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-4424-4859-99b3-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"8522c77e48c846c2c026b6e16501a3b2","Galaxy":[],"ShadowAttribute":[]},{"id":"16782","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-a880-4c60-a6f0-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"bc31493e996db7fe45b7ed7aaa51fd54","Galaxy":[],"ShadowAttribute":[]},{"id":"16783","type":"ip-dst","category":"Network activity","to_ids":false,"uuid":"5cd564a2-e098-43bc-8cd6-65920a14d415","event_id":"138","distribution":"5","timestamp":"1557488802","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"217.182.54.223","Galaxy":[],"ShadowAttribute":[]},{"id":"16784","type":"ip-dst","category":"Network activity","to_ids":false,"uuid":"5cd564a2-7c6c-46b2-acb4-65920a14d415","event_id":"138","distribution":"5","timestamp":"1557488802","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"51.255.101.144","Galaxy":[],"ShadowAttribute":[]}],"ShadowAttribute":[],"RelatedEvent":[],"Galaxy":[],"Object":[]}}]}

172
data/ioc/spyware/citizen_lab/201905_EndlessMayfly/stix.xml Normal file
View File

@@ -0,0 +1,172 @@
<stix:STIX_Package
xmlns:ciqIdentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
xmlns:AccountObj="http://cybox.mitre.org/objects#AccountObject-2"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
xmlns:WinExecutableFileObj="http://cybox.mitre.org/objects#WinExecutableFileObject-2"
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
xmlns:PortObj="http://cybox.mitre.org/objects#PortObject-2"
xmlns:SystemObj="http://cybox.mitre.org/objects#SystemObject-2"
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
xmlns:WinServiceObj="http://cybox.mitre.org/objects#WinServiceObject-2"
xmlns:WhoisObj="http://cybox.mitre.org/objects#WhoisObject-2"
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
xmlns:ttp="http://stix.mitre.org/TTP-1"
xmlns:SocketAddressObj="http://cybox.mitre.org/objects#SocketAddressObject-1"
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
xmlns:indicator="http://stix.mitre.org/Indicator-2"
xmlns:marking="http://data-marking.mitre.org/Marking-1"
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xmlns:X509CertificateObj="http://cybox.mitre.org/objects#X509CertificateObject-2"
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
xmlns:ProcessObj="http://cybox.mitre.org/objects#ProcessObject-2"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:NetworkConnectionObj="http://cybox.mitre.org/objects#NetworkConnectionObject-2"
xmlns:NetworkSocketObj="http://cybox.mitre.org/objects#NetworkSocketObject-2"
id="ORGNAME:Package-7b229daa-536d-496a-ab24-4eaf42d9a226" version="1.1.1" timestamp="2019-05-10T11:48:29.630785">
<stix:STIX_Header>
<stix:Title>Export from ORGNAME MISP</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Related_Packages>
<stix:Related_Package>
<stix:Package id="ORGNAME:STIXPackage-5cd56458-a1b0-4129-8649-64d90a14d415" version="1.1.1" timestamp="2019-05-10T11:46:42">
<stix:STIX_Header>
<stix:Title>Export from ORGNAME MISP</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Incidents>
<stix:Incident id="ORGNAME:incident-5cd56458-a1b0-4129-8649-64d90a14d415" timestamp="2019-05-10T11:47:09" xsi:type='incident:IncidentType'>
<incident:Title>Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign</incident:Title>
<incident:External_ID source="MISP Event">138</incident:External_ID>
<incident:Time>
<incident:Incident_Discovery precision="second">2019-05-10T00:00:00</incident:Incident_Discovery>
<incident:Incident_Reported precision="second">2019-05-10T11:47:09</incident:Incident_Reported>
</incident:Time>
<incident:Reporter>
<stixCommon:Identity>
<stixCommon:Name>MAIN</stixCommon:Name>
</stixCommon:Identity>
</incident:Reporter>
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
<incident:Related_Observables>
<incident:Related_Observable>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Observable id="ORGNAME:File-5cd56487-0b50-4e81-b7eb-651f0a14d415">
<cybox:Object id="ORGNAME:FileObject-5cd56487-0b50-4e81-b7eb-651f0a14d415">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">5b920c6cd1d8de54463f07965b8c43f3</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</stixCommon:Observable>
</incident:Related_Observable>
<incident:Related_Observable>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Observable id="ORGNAME:File-5cd56487-b340-4b92-a378-651f0a14d415">
<cybox:Object id="ORGNAME:FileObject-5cd56487-b340-4b92-a378-651f0a14d415">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">07d495245814c5c4996422b4b2f52473</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</stixCommon:Observable>
</incident:Related_Observable>
<incident:Related_Observable>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Observable id="ORGNAME:File-5cd56487-4424-4859-99b3-651f0a14d415">
<cybox:Object id="ORGNAME:FileObject-5cd56487-4424-4859-99b3-651f0a14d415">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">8522c77e48c846c2c026b6e16501a3b2</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</stixCommon:Observable>
</incident:Related_Observable>
<incident:Related_Observable>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Observable id="ORGNAME:File-5cd56487-a880-4c60-a6f0-651f0a14d415">
<cybox:Object id="ORGNAME:FileObject-5cd56487-a880-4c60-a6f0-651f0a14d415">
<cybox:Properties xsi:type="FileObj:FileObjectType">
<FileObj:Hashes>
<cyboxCommon:Hash>
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
<cyboxCommon:Simple_Hash_Value condition="Equals">bc31493e996db7fe45b7ed7aaa51fd54</cyboxCommon:Simple_Hash_Value>
</cyboxCommon:Hash>
</FileObj:Hashes>
</cybox:Properties>
</cybox:Object>
</stixCommon:Observable>
</incident:Related_Observable>
<incident:Related_Observable>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Observable id="ORGNAME:Address-5cd564a2-e098-43bc-8cd6-65920a14d415">
<cybox:Object id="ORGNAME:AddressObject-5cd564a2-e098-43bc-8cd6-65920a14d415">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false" is_destination="true">
<AddressObj:Address_Value condition="Equals">217.182.54.223</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</stixCommon:Observable>
</incident:Related_Observable>
<incident:Related_Observable>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Observable id="ORGNAME:Address-5cd564a2-7c6c-46b2-acb4-65920a14d415">
<cybox:Object id="ORGNAME:AddressObject-5cd564a2-7c6c-46b2-acb4-65920a14d415">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false" is_destination="true">
<AddressObj:Address_Value condition="Equals">51.255.101.144</AddressObj:Address_Value>
</cybox:Properties>
</cybox:Object>
</stixCommon:Observable>
</incident:Related_Observable>
</incident:Related_Observables>
<incident:History>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">Event Threat Level: Medium</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: misp:tool="misp2stix"</incident:Journal_Entry>
</incident:History_Item>
</incident:History>
<incident:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>MAIN</stixCommon:Name>
</stixCommon:Identity>
</incident:Information_Source>
</stix:Incident>
</stix:Incidents>
</stix:Package>
</stix:Related_Package>
</stix:Related_Packages>
</stix:STIX_Package>

4
data/ioc/spyware/citizen_lab/201909_MissingLink/README.md Normal file
View File

@@ -0,0 +1,4 @@
# MISSING LINK: Tibetan Groups Targeted with Mobile Exploits
Indicators for the campaign "[MISSING LINK: Tibetan Groups Targeted with Mobile Exploits](https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits)" published by the Citizen Lab

137
data/ioc/spyware/citizen_lab/201909_MissingLink/decode_scotch_c2_communications.py Normal file
View File

@@ -0,0 +1,137 @@
#!/usr/bin/env python3
"""
Python script decoding network capture of the Scotch malware C2 communications
"""
__author__ = "Etienne Maynier"
__license__ = "MIT"
import base64
import pyshark
from io import BytesIO
import gzip
import json
import argparse
COMMANDS = {
-1: "VOID",
0: "OFFLINE",
1: "ONLINE",
2: "DEV_INFO",
3: "GET_PLUGIN_INFO",
4: "GET_CALLLOG",
5: "GET_CONTACT",
6: "GET_LOCATION",
7: "GET_SMS",
8: "GET_FILE",
9: "CLEAR",
10: "SHELL",
11: "NOTIFICATION",
12: "CAMERA",
13: "RECORD",
14: "SCREEN_SNAP"
}
ERRORS = {
-1 : "UNKNOW",
0: "SUCCESS",
1: "SERVER_ERROR",
2: "PLUGIN_DATA_NOT_FOUND",
3: "PLUGIN_NO_NEED_UPDATE",
4: "COMMAND_NOT_MATCH",
5: "CONTEXT_NOT_FOUND",
6: "GET_WHISKY_ID_FAILED",
7: "GET_DEVICE_ID_FAILED",
8: "COMMAND_TYPE_NOT_REGISTERED",
9: "PERMISION_NOT_GRANTED",
10: "CONTENT_RESOLVER_CURSOR_EXCEPTION",
11: "CONTENT_RESOLVER_CURSOR_NULL_OR_ZERO",
12: "CONTENT_RESOLVER_CURSOR_GET_EXCEPTION",
13: "GET_ACTIVITY_FAILED",
14: "OBSERVER_ALREADY_REGISTER",
15: "OBSERVER_ALREADY_UNREGISTER",
16: "GET_DEVICE_INFO_FAILED",
17: "GET_SMS_FAILED",
18: "GET_SMS_TO_JSON_FAILED",
19: "GET_CONTACT_FAILED",
20: "GET_CONTACT_TO_JSON_FAILED",
21: "GET_CALLLOG_FAILED",
22: "GET_CALLLOG_TO_JSON_FAILED",
23: "GET_LOCATION_FAILED",
24: "GET_LOCATION_TO_JSON_FAILED",
25: "GET_LOCATION_SERVICE_FAILED",
26: "GPS_PROVIDER_NOT_ENABLE",
27: "NETWORK_PROVIDER_NOT_ENABLE",
28: "FETCH_FILE_NO_PATH_SUBCMD",
29: "FETCH_FILE_NO_SUCH_FILE",
30: "FETCH_FILE_READ_FILE_FAILED",
31: "FETCH_FILE_NO_READ_PERMISSION",
32: "FETCH_FILE_TO_LARGE",
33: "UPLOAD_FILE_FAILED",
34: "LIST_DIR_NO_PATH_SUBCMD",
35: "LIST_DIR_NOT_EXIST",
36: "LIST_DIR_IS_NOT_DIR",
37: "LIST_DIR_NO_READ_PERMISSION",
38: "UPDATE_FILE_NO_FORCE_SUBCMD",
39: "UPDATE_FILE_NO_PATH_SUBCMD",
40: "UPDATE_FILE_NO_MODIFY_SUBCMD",
41: "UPDATE_FILE_NO_SHA256_SUBCMD",
42: "UPDATE_FILE_NO_SUCH_FILE",
43: "UPDATE_FILE_READ_FILE_FAILED",
44: "UPDATE_FILE_NO_READ_PERMISSION",
45: "UPDATE_FILE_TO_LARGE",
46: "UPDATE_FILE_NO_NEED_UPDATE",
47: "UPDATE_FILE_CALC_SHA256_FAILED",
48: "UPDATE_FILE_NO_SUCH_SUBCMD",
49: "GET_PACKAGE_NAME_FAILED",
50: "GET_REPLACE_SO_PATH_FAILED",
51: "CLEAR_SOME_FILE_FAILED",
52: "CLEAR_NO_IS_ALL_ARGUMENT",
53: "CLEAR_RETURN_TO_JSON_FAILED",
54: "GET_SHELL_RESULT_FAILED",
55: "GET_CAMERA_FEATURE_FAILED",
56: "GET_CAMERA_JSON_FAILED",
57: "GET_CAMERA_PREVIEW_FAILED",
58: "GET_CAMERA_SNAP_TO_FILE_FAILED",
59: "SEND_SMS_GENERIC_FAILURE",
60: "SEND_SMS_RADIO_OFF",
61: "SEND_SMS_NULL_PDU",
62: "SEND_SMS_NO_SERVER",
63: "SEND_SMS_CODE_ERROR",
64: "GET_RECORD_TO_FILE_FALIED",
65: "GET_RECORD_TIME_TOO_LONG_FAILED",
66: "GET_RECORD_RECORDING_FAILED",
67: "SCREEN_SNAP_IN_HOST_FAILED",
68: "SCREEN_SNAP_CREATE_BITMAP_FAILED",
69: "SCREEN_SNAP_OUT_HOST_FAILED",
70: "SCREEN_SNAP_GET_MEDIA_PROJECTION_FAILED",
71: "PLUGIN_LOAD_FAILED",
72: "PLUGIN_DOWNLOAD_FAILED"
}
def decode(data):
d = base64.b64decode(data)
return gzip.GzipFile(fileobj=BytesIO(d)).read()
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='Scotch Whisky C2 communications')
parser.add_argument('PCAP')
args = parser.parse_args()
cap = pyshark.FileCapture(args.PCAP)
for p in cap:
if 'DATA-TEXT-LINES' in p:
# pyshark bug here when there are multiple lines
# Ugly, but the world is ugly
data = str(p['DATA-TEXT-LINES'])[24:].replace('\n', '').replace('\t', '').replace("\\n", '')
if "[truncated]" in data:
# Even worse :o
data = bytearray.fromhex(p.tcp.payload.replace(':', ''))[4:].decode('utf-8')
cleartext = decode(data)
js = json.loads(cleartext)
if p.tcp.dstport == "10011":
print("CLIENT -> SERVER : {:15s} | {:27s} -> [{}]".format(COMMANDS[js['cmd_type']], ERRORS[js['error']], js['data'] if 'data' in js else ''))
else:
print("SERVER -> CLIENT : {:15s} | {:27s} -> [{}]".format(COMMANDS[js['cmd_type']], ERRORS[js['error']], js['data'] if 'data' in js else ''))

72
data/ioc/spyware/citizen_lab/201909_MissingLink/iocs.csv Normal file
View File

@@ -0,0 +1,72 @@
uuid,event_id,category,type,value,comment,to_ids,date
5bec8d6d-6cc8-4aef-b8c9-171c8064ab0b,140,Network activity,domain,"msap.services","",1,20181114
5bec8d6d-71e0-40b6-add8-171c8064ab0b,140,Network activity,domain,"www.msap.services","",1,20181114
5bec8d7b-b658-4050-8b3c-45cc8064ab0b,140,Network activity,ip-dst,"144.202.59.23","iOS exploit server",1,20190920
5bed8343-d968-4c72-a106-2b328064ab0b,140,Network activity,ip-dst,"66.42.58.59","iOS C2",1,20190920
5bed84bf-8710-4cba-b9eb-05688064ab0b,140,Network activity,ip-dst,"43.251.16.87","",1,20181115
5d76c6d3-0658-494c-afb4-61de8064ab0b,140,Network activity,url,"http://www.msap.services/S5gDoN","",0,20190909
5d76c6d3-0d28-4b27-9ac6-61de8064ab0b,140,Network activity,url,"http://bit.ly/2B4GwEf","",0,20190909
5d76c6d3-1170-4f0e-ade3-61de8064ab0b,140,Network activity,url,"http://www.msap.services/EzpOhU","",0,20190909
5d76c6d3-14c4-4b77-85be-61de8064ab0b,140,Network activity,url,"http://bit.ly/2AYy61a","",0,20190909
5d76c6d3-1708-4847-8b18-61de8064ab0b,140,Network activity,url,"http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL29wZW4/aWQ9MUlTakl2eFoxX1g5YkdJSnQtMlpKeDRDRWwzdVVhRmlv","",0,20190909
5d76c6d3-2150-4f97-80c4-61de8064ab0b,140,Network activity,url,"http://msap.services/yHJbS6","",0,20190909
5d76c6d3-2f9c-40b2-8cd5-61de8064ab0b,140,Network activity,url,"http://www.msap.services/70FtQX","",0,20190909
5d76c6d3-578c-4a96-88fe-61de8064ab0b,140,Network activity,url,"http://bit.ly/2PSvdau","",0,20190909
5d76c6d3-5824-4b00-8dda-61de8064ab0b,140,Network activity,url,"http://suo.im/5okeFb","",0,20190909
5d76c6d3-7058-403d-a9b1-61de8064ab0b,140,Network activity,url,"http://www.msap.services/GfHuRi","",0,20190909
5d76c6d3-8604-4125-b369-61de8064ab0b,140,Network activity,url,"http://www.msap.services/XgL5A9","",0,20190909
5d76c6d3-8624-44df-8338-61de8064ab0b,140,Network activity,url,"http://bit.ly/2T2CoeX","",0,20190909
5d76c6d3-936c-411b-a0c9-61de8064ab0b,140,Network activity,url,"http://bit.ly/2QroNMt","",0,20190909
5d76c6d3-a174-4130-a62c-61de8064ab0b,140,Network activity,url,"http://www.msap.services/6FeBOy","",0,20190909
5d76c6d3-a530-4671-8fab-61de8064ab0b,140,Network activity,url,"http://bit.ly/2SVPqdY","",0,20190909
5d76c6d3-b644-45e2-a9d7-61de8064ab0b,140,Network activity,url,"http://www.msap.services/1R7mqD","",0,20190909
5d76c6d3-b878-442a-b476-61de8064ab0b,140,Network activity,url,"http://bit.ly/2z1WayM","",0,20190909
5d76c6d3-b8ec-438c-8161-61de8064ab0b,140,Network activity,url,"http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly93d3cubnl0aW1lcy5jb20vMjAxOC8xMS8wMi9vYml0dWFyaWVzL2xvZGktZ3lhcmktZGVhZC5odG1s","",0,20190909
5d76c6d3-bb64-4b8d-b773-61de8064ab0b,140,Network activity,url,"http://www.msap.services/yHJbS6","",0,20190909
5d76c6d3-bd08-4528-9fab-61de8064ab0b,140,Network activity,url,"http://www.msap.services/F8XGNe","",0,20190909
5d76c6d3-ce00-497f-9284-61de8064ab0b,140,Network activity,url,"http://suo.im/5ot25j","",0,20190909
5d76c6d3-d218-49a3-96f3-61de8064ab0b,140,Network activity,url,"http://bit.ly/2qHg3Xt","",0,20190909
5d76c6d3-f8f0-4399-a2ae-61de8064ab0b,140,Network activity,url,"http//www.msap.services/2bKr8Z","",0,20190909
5d76c6d4-0854-4d51-8fb7-61de8064ab0b,140,Network activity,url,"http://www.msap.services/ZpzstM","",0,20190909
5d76c6d4-12f0-4f58-9a9b-61de8064ab0b,140,Network activity,url,"http://www.msap.services/ZQfqzs","",0,20190909
5d76c6d4-2fb8-46f2-a589-61de8064ab0b,140,Network activity,url,"http://bit.ly/2Drl90q","",0,20190909
5d76c6d4-3b64-4591-b0df-61de8064ab0b,140,Network activity,url,"http://45.76.149.154:5000/web/info?org=aHR0cDovL3d3dy5waGF5dWwuY29tL25ld3MvYXJ0aWNsZS5hc3B4P2lkPTQxNDc0JmZiY2xpZD1Jd0FSM1RadGdjanppUkhNZFJuOEdhZ1RMUV9iMHFrX0VBZWY2YldxRU5SanhaZkkzRFdPNFpsRExPcFdz","",0,20190909
5d76c6d4-52b4-413f-bf04-61de8064ab0b,140,Network activity,url,"https://www.energy-mail.org/B20V54","",0,20190909
5d76c6d4-7398-45b0-b5e9-61de8064ab0b,140,Network activity,url,"http://bit.ly/2T6pCMf","",0,20190909
5d76c6d4-c2a8-4ee3-bf3d-61de8064ab0b,140,Network activity,url,"https://bit.ly/2MgSRwL","",0,20190909
5d76c6d4-dde0-484e-ac13-61de8064ab0b,140,Network activity,url,"https://bit.ly/2XePmYt","",0,20190909
5d76c70f-df94-4cd0-b977-4cea8064ab0b,140,Network activity,domain,"www.energy-mail.org","",1,20190909
5d76c730-b4c0-4746-af7e-61db8064ab0b,140,Network activity,url,"http://43.251.16.87:5000//dev/loader","",0,20190909
5d76c7a0-2dac-4e65-a0ca-67208064ab0b,140,Network activity,ip-dst,"45.32.75.217","",1,20190909
5d76c7a0-3c28-4110-aa88-67208064ab0b,140,Network activity,ip-dst,"45.76.149.154","Android exploit server",1,20190920
5d76c98c-0998-4c3d-94fa-61de8064ab0b,140,Network activity,domain,"bf.mk","",1,20190909
5d76c98c-0cb4-4be5-b3d6-61de8064ab0b,140,Network activity,domain,"rf.mk","",1,20190909
5d76c98c-1b78-4933-98f8-61de8064ab0b,140,Network activity,domain,"mailcontactanalysis.online","",1,20190909
5d76c98c-3358-4897-a52b-61de8064ab0b,140,Network activity,domain,"mailnotes.online","",1,20190909
5d76c98c-52b4-4bb9-b61b-61de8064ab0b,140,Network activity,domain,"mailanalysis.services","",1,20190909
5d76c98c-6be4-4b4a-9a37-61de8064ab0b,140,Network activity,domain,"polarismail.services","",1,20190909
5d76c98c-77cc-4a32-b989-61de8064ab0b,140,Network activity,domain,"energy-mail.org","",1,20190909
5d76c98c-8960-4e6c-be1c-61de8064ab0b,140,Network activity,domain,"izelense.com","",1,20190909
5d76c98c-95a0-4186-9d08-61de8064ab0b,140,Network activity,domain,"antmoving.online","",1,20190909
5d76c98c-a620-4e86-969b-61de8064ab0b,140,Network activity,domain,"gmailapp.me","",1,20190909
5d76c98c-be94-4716-9cc3-61de8064ab0b,140,Network activity,domain,"beemail.online","",1,20190909
5d76c98c-f230-436d-a69f-61de8064ab0b,140,Network activity,domain,"walkingnote.online","",1,20190909
5d76c9b2-5654-4b42-a28f-61dc8064ab0b,140,Attribution,whois-registrant-email,"ornaments798@outlook.com","",0,20190909
5d76c9b2-8b24-4fb2-8ff3-61dc8064ab0b,140,Attribution,whois-registrant-email,"dashenqu832@outlook.com","",0,20190909
5d76cc33-7aac-4eb8-a1be-66c48064ab0b,140,Network activity,ip-dst,"45.78.79.100","",1,20190909
5d76cf56-94f8-4a16-84d5-67af8064ab0b,140,Network activity,ip-dst,"149.28.93.11","",1,20190909
5d76d19b-0704-42fa-95c5-61df8064ab0b,140,Network activity,ip-dst,"95.169.2.57","",1,20190909
5d76d6f2-f44c-4b21-ba2d-67578064ab0b,140,Network activity,ip-dst,"206.189.65.198","",1,20190909
5d76dae6-bdc4-4cca-8161-61de8064ab0b,140,Network activity,ip-dst,"140.82.17.222","",1,20190909
5d76dcf6-f094-47a0-8fd4-4cea8064ab0b,140,Network activity,ip-dst,"45.76.53.26","",1,20190909
5d76de15-2544-4f39-baed-61db8064ab0b,140,Network activity,ip-dst,"45.32.91.137","",1,20190909
5d76dfaf-574c-4253-b1f1-67578064ab0b,140,Artifacts dropped,sha256,"0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560","iOS payload",1,20190909
5d76e2eb-37c8-4b75-b5d7-67578064ab0b,140,Payload delivery,email-src,"touchxun658@gmail.com","OAuth email addresses",0,20190909
5d76e2eb-abe8-44bb-8dbf-67578064ab0b,140,Payload delivery,email-src,"antmoving.online@gmail.com","OAuth email addresses",0,20190909
5d76e2eb-df2c-4913-b458-67578064ab0b,140,Payload delivery,email-src,"energymail.org@gmail.com","OAuth email addresses",0,20190909
5d76e2eb-e004-41d8-bc9d-67578064ab0b,140,Payload delivery,email-src,"jameslewis199106@gmail.com","OAuth email addresses",0,20190909
5d8545bf-ec98-4d0c-a8a3-55038064ab0b,140,Payload delivery,sha256,"6977e6098815cd91016be9d76f194ed4622640d03c6cdd66b1032306a2190af7","libbourbon",0,20190920
5d8545d4-ee30-435b-827e-55078064ab0b,140,Payload delivery,sha256,"e510c361c8101384277dd95cc2c8e76715dd241f58553f592245b620422beaf3","Whisky",0,20190920
5d8545e3-c264-43d8-9666-55068064ab0b,140,Payload delivery,sha256,"0d13e403303b52edae6beb76a6fe7ed454f340aae1246b9a3f55ca728da2d6aa","Scotch",0,20190920
5d854603-8bf4-44fe-96ae-47ce8064ab0b,140,Payload delivery,sha256,"b85fe634f3c5b1022a1adbc21f3b85b58451ca2b89e9380fc5f22b9340a18b88","Loader",0,20190920
5d892cd4-fba0-4c21-90d9-0b328064ab0b,140,Network activity,user-agent,"hots scot","Scotch user agent",1,20190923
1 uuid event_id category type value comment to_ids date
2 5bec8d6d-6cc8-4aef-b8c9-171c8064ab0b 140 Network activity domain msap.services 1 20181114
3 5bec8d6d-71e0-40b6-add8-171c8064ab0b 140 Network activity domain www.msap.services 1 20181114
4 5bec8d7b-b658-4050-8b3c-45cc8064ab0b 140 Network activity ip-dst 144.202.59.23 iOS exploit server 1 20190920
5 5bed8343-d968-4c72-a106-2b328064ab0b 140 Network activity ip-dst 66.42.58.59 iOS C2 1 20190920
6 5bed84bf-8710-4cba-b9eb-05688064ab0b 140 Network activity ip-dst 43.251.16.87 1 20181115
7 5d76c6d3-0658-494c-afb4-61de8064ab0b 140 Network activity url http://www.msap.services/S5gDoN 0 20190909
8 5d76c6d3-0d28-4b27-9ac6-61de8064ab0b 140 Network activity url http://bit.ly/2B4GwEf 0 20190909
9 5d76c6d3-1170-4f0e-ade3-61de8064ab0b 140 Network activity url http://www.msap.services/EzpOhU 0 20190909
10 5d76c6d3-14c4-4b77-85be-61de8064ab0b 140 Network activity url http://bit.ly/2AYy61a 0 20190909
11 5d76c6d3-1708-4847-8b18-61de8064ab0b 140 Network activity url http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL29wZW4/aWQ9MUlTakl2eFoxX1g5YkdJSnQtMlpKeDRDRWwzdVVhRmlv 0 20190909
12 5d76c6d3-2150-4f97-80c4-61de8064ab0b 140 Network activity url http://msap.services/yHJbS6 0 20190909
13 5d76c6d3-2f9c-40b2-8cd5-61de8064ab0b 140 Network activity url http://www.msap.services/70FtQX 0 20190909
14 5d76c6d3-578c-4a96-88fe-61de8064ab0b 140 Network activity url http://bit.ly/2PSvdau 0 20190909
15 5d76c6d3-5824-4b00-8dda-61de8064ab0b 140 Network activity url http://suo.im/5okeFb 0 20190909
16 5d76c6d3-7058-403d-a9b1-61de8064ab0b 140 Network activity url http://www.msap.services/GfHuRi 0 20190909
17 5d76c6d3-8604-4125-b369-61de8064ab0b 140 Network activity url http://www.msap.services/XgL5A9 0 20190909
18 5d76c6d3-8624-44df-8338-61de8064ab0b 140 Network activity url http://bit.ly/2T2CoeX 0 20190909
19 5d76c6d3-936c-411b-a0c9-61de8064ab0b 140 Network activity url http://bit.ly/2QroNMt 0 20190909
20 5d76c6d3-a174-4130-a62c-61de8064ab0b 140 Network activity url http://www.msap.services/6FeBOy 0 20190909
21 5d76c6d3-a530-4671-8fab-61de8064ab0b 140 Network activity url http://bit.ly/2SVPqdY 0 20190909
22 5d76c6d3-b644-45e2-a9d7-61de8064ab0b 140 Network activity url http://www.msap.services/1R7mqD 0 20190909
23 5d76c6d3-b878-442a-b476-61de8064ab0b 140 Network activity url http://bit.ly/2z1WayM 0 20190909
24 5d76c6d3-b8ec-438c-8161-61de8064ab0b 140 Network activity url http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly93d3cubnl0aW1lcy5jb20vMjAxOC8xMS8wMi9vYml0dWFyaWVzL2xvZGktZ3lhcmktZGVhZC5odG1s 0 20190909
25 5d76c6d3-bb64-4b8d-b773-61de8064ab0b 140 Network activity url http://www.msap.services/yHJbS6 0 20190909
26 5d76c6d3-bd08-4528-9fab-61de8064ab0b 140 Network activity url http://www.msap.services/F8XGNe 0 20190909
27 5d76c6d3-ce00-497f-9284-61de8064ab0b 140 Network activity url http://suo.im/5ot25j 0 20190909
28 5d76c6d3-d218-49a3-96f3-61de8064ab0b 140 Network activity url http://bit.ly/2qHg3Xt 0 20190909
29 5d76c6d3-f8f0-4399-a2ae-61de8064ab0b 140 Network activity url http//www.msap.services/2bKr8Z 0 20190909
30 5d76c6d4-0854-4d51-8fb7-61de8064ab0b 140 Network activity url http://www.msap.services/ZpzstM 0 20190909
31 5d76c6d4-12f0-4f58-9a9b-61de8064ab0b 140 Network activity url http://www.msap.services/ZQfqzs 0 20190909
32 5d76c6d4-2fb8-46f2-a589-61de8064ab0b 140 Network activity url http://bit.ly/2Drl90q 0 20190909
33 5d76c6d4-3b64-4591-b0df-61de8064ab0b 140 Network activity url http://45.76.149.154:5000/web/info?org=aHR0cDovL3d3dy5waGF5dWwuY29tL25ld3MvYXJ0aWNsZS5hc3B4P2lkPTQxNDc0JmZiY2xpZD1Jd0FSM1RadGdjanppUkhNZFJuOEdhZ1RMUV9iMHFrX0VBZWY2YldxRU5SanhaZkkzRFdPNFpsRExPcFdz 0 20190909
34 5d76c6d4-52b4-413f-bf04-61de8064ab0b 140 Network activity url https://www.energy-mail.org/B20V54 0 20190909
35 5d76c6d4-7398-45b0-b5e9-61de8064ab0b 140 Network activity url http://bit.ly/2T6pCMf 0 20190909
36 5d76c6d4-c2a8-4ee3-bf3d-61de8064ab0b 140 Network activity url https://bit.ly/2MgSRwL 0 20190909
37 5d76c6d4-dde0-484e-ac13-61de8064ab0b 140 Network activity url https://bit.ly/2XePmYt 0 20190909
38 5d76c70f-df94-4cd0-b977-4cea8064ab0b 140 Network activity domain www.energy-mail.org 1 20190909
39 5d76c730-b4c0-4746-af7e-61db8064ab0b 140 Network activity url http://43.251.16.87:5000//dev/loader 0 20190909
40 5d76c7a0-2dac-4e65-a0ca-67208064ab0b 140 Network activity ip-dst 45.32.75.217 1 20190909
41 5d76c7a0-3c28-4110-aa88-67208064ab0b 140 Network activity ip-dst 45.76.149.154 Android exploit server 1 20190920
42 5d76c98c-0998-4c3d-94fa-61de8064ab0b 140 Network activity domain bf.mk 1 20190909
43 5d76c98c-0cb4-4be5-b3d6-61de8064ab0b 140 Network activity domain rf.mk 1 20190909
44 5d76c98c-1b78-4933-98f8-61de8064ab0b 140 Network activity domain mailcontactanalysis.online 1 20190909
45 5d76c98c-3358-4897-a52b-61de8064ab0b 140 Network activity domain mailnotes.online 1 20190909
46 5d76c98c-52b4-4bb9-b61b-61de8064ab0b 140 Network activity domain mailanalysis.services 1 20190909
47 5d76c98c-6be4-4b4a-9a37-61de8064ab0b 140 Network activity domain polarismail.services 1 20190909
48 5d76c98c-77cc-4a32-b989-61de8064ab0b 140 Network activity domain energy-mail.org 1 20190909
49 5d76c98c-8960-4e6c-be1c-61de8064ab0b 140 Network activity domain izelense.com 1 20190909
50 5d76c98c-95a0-4186-9d08-61de8064ab0b 140 Network activity domain antmoving.online 1 20190909
51 5d76c98c-a620-4e86-969b-61de8064ab0b 140 Network activity domain gmailapp.me 1 20190909
52 5d76c98c-be94-4716-9cc3-61de8064ab0b 140 Network activity domain beemail.online 1 20190909
53 5d76c98c-f230-436d-a69f-61de8064ab0b 140 Network activity domain walkingnote.online 1 20190909
54 5d76c9b2-5654-4b42-a28f-61dc8064ab0b 140 Attribution whois-registrant-email ornaments798@outlook.com 0 20190909
55 5d76c9b2-8b24-4fb2-8ff3-61dc8064ab0b 140 Attribution whois-registrant-email dashenqu832@outlook.com 0 20190909
56 5d76cc33-7aac-4eb8-a1be-66c48064ab0b 140 Network activity ip-dst 45.78.79.100 1 20190909
57 5d76cf56-94f8-4a16-84d5-67af8064ab0b 140 Network activity ip-dst 149.28.93.11 1 20190909
58 5d76d19b-0704-42fa-95c5-61df8064ab0b 140 Network activity ip-dst 95.169.2.57 1 20190909
59 5d76d6f2-f44c-4b21-ba2d-67578064ab0b 140 Network activity ip-dst 206.189.65.198 1 20190909
60 5d76dae6-bdc4-4cca-8161-61de8064ab0b 140 Network activity ip-dst 140.82.17.222 1 20190909
61 5d76dcf6-f094-47a0-8fd4-4cea8064ab0b 140 Network activity ip-dst 45.76.53.26 1 20190909
62 5d76de15-2544-4f39-baed-61db8064ab0b 140 Network activity ip-dst 45.32.91.137 1 20190909
63 5d76dfaf-574c-4253-b1f1-67578064ab0b 140 Artifacts dropped sha256 0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560 iOS payload 1 20190909
64 5d76e2eb-37c8-4b75-b5d7-67578064ab0b 140 Payload delivery email-src touchxun658@gmail.com OAuth email addresses 0 20190909
65 5d76e2eb-abe8-44bb-8dbf-67578064ab0b 140 Payload delivery email-src antmoving.online@gmail.com OAuth email addresses 0 20190909
66 5d76e2eb-df2c-4913-b458-67578064ab0b 140 Payload delivery email-src energymail.org@gmail.com OAuth email addresses 0 20190909
67 5d76e2eb-e004-41d8-bc9d-67578064ab0b 140 Payload delivery email-src jameslewis199106@gmail.com OAuth email addresses 0 20190909
68 5d8545bf-ec98-4d0c-a8a3-55038064ab0b 140 Payload delivery sha256 6977e6098815cd91016be9d76f194ed4622640d03c6cdd66b1032306a2190af7 libbourbon 0 20190920
69 5d8545d4-ee30-435b-827e-55078064ab0b 140 Payload delivery sha256 e510c361c8101384277dd95cc2c8e76715dd241f58553f592245b620422beaf3 Whisky 0 20190920
70 5d8545e3-c264-43d8-9666-55068064ab0b 140 Payload delivery sha256 0d13e403303b52edae6beb76a6fe7ed454f340aae1246b9a3f55ca728da2d6aa Scotch 0 20190920
71 5d854603-8bf4-44fe-96ae-47ce8064ab0b 140 Payload delivery sha256 b85fe634f3c5b1022a1adbc21f3b85b58451ca2b89e9380fc5f22b9340a18b88 Loader 0 20190920
72 5d892cd4-fba0-4c21-90d9-0b328064ab0b 140 Network activity user-agent hots scot Scotch user agent 1 20190923

1171
data/ioc/spyware/citizen_lab/201909_MissingLink/misp.json Normal file
View File

File diff suppressed because it is too large Load Diff

129
data/ioc/spyware/citizen_lab/201909_MissingLink/openioc.ioc Normal file
View File

@@ -0,0 +1,129 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5bec8d43-b990-4129-a9f4-45d08064ab0b" last-modified="2019-09-24T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #140</short_description>
<description>MISSING LINK: Tibetan Groups Targeted with Mobile Exploits</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2019-09-24T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="5bec8d43-b990-4129-a9f4-45d08064ab0b">
<IndicatorItem id="0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560" condition="is">
<Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
<Content type="sha256"></Content>
</IndicatorItem>
<IndicatorItem id="www.energy-mail.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="antmoving.online" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="beemail.online" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="bf.mk" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="energy-mail.org" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="gmailapp.me" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="izelense.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mailanalysis.services" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mailcontactanalysis.online" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mailnotes.online" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="polarismail.services" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="rf.mk" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="walkingnote.online" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="www.msap.services" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="msap.services" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="45.32.75.217" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="45.76.149.154" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="45.78.79.100" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="149.28.93.11" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="95.169.2.57" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="206.189.65.198" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="140.82.17.222" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="45.76.53.26" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="45.32.91.137" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="144.202.59.23" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="66.42.58.59" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="43.251.16.87" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="hots scot" condition="is">
<Context document="Network" search="Network/UserAgent" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

1
data/ioc/spyware/citizen_lab/201909_MissingLink/snort.rules Normal file
View File

@@ -0,0 +1 @@
alert tcp $HOME_NET any -> $EXTERNAL_NET 10011 (msg:"MOONSHINE payload C2 activity"; flow:established,to_server; content:"GET"; content:"/ws?whisky_id|3d|"; content:"User-Agent: hots scot"; content:"Upgrade: websocket"; reference:url,https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits; classtype:trojan-activity; sid:3000003; rev:1;)

1623
data/ioc/spyware/citizen_lab/201909_MissingLink/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff

16
data/ioc/spyware/citizen_lab/202006_DarkBasin/README.md Normal file
View File

@@ -0,0 +1,16 @@
## Dark Basin Indicators of Compromise
This list of IOCs is being jointly released by Citizen Lab and NortonLifeLock, further to reports released on June 9, 2020.
Citizen Lab Report: [Dark Basin: Uncovering a Massive Hack-For-Hire Operation](https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/)
NortonLifeLock Report: [Mercenary.Amanda](https://www.nortonlifelock.com/blogs/security-response/mercenary-amanda-professional-hackers-hire)
Note: _NortonLifeLock tracks Dark Basin as Mercenary.Amanda_
Files included in this directory:
* openioc.ioc : IOCs in OpenIOC format
* stix.xml : IOCs in STIX XML format
* iocs.csv : IOCs in csv format
* misp.json : IOCs in MISP format
* snort.rules: IOCs as a Snort ruleset.

480
data/ioc/spyware/citizen_lab/202006_DarkBasin/iocs.csv Normal file
View File

@@ -0,0 +1,480 @@
uuid,event_id,category,type,value,comment,to_ids,date
5ede974a-00d8-4bb1-a02e-7a498064ab0b,147,Network activity,domain,"com-website33.org","",1,20200608
5ede974a-0118-48e1-8d89-7a498064ab0b,147,Network activity,domain,"srtnr.co","",1,20200608
5ede974a-014c-453e-b000-7a498064ab0b,147,Network activity,domain,"ecom-servicelogin.com","",1,20200608
5ede974a-0284-4135-adbb-7a498064ab0b,147,Network activity,domain,"emailserver499.com","",1,20200608
5ede974a-03f8-4089-9ec3-7a498064ab0b,147,Network activity,domain,"mailhostingsecurenet.com","",1,20200608
5ede974a-0440-45bf-af15-7a498064ab0b,147,Network activity,domain,"domainblacklistcheck.com","",1,20200608
5ede974a-0644-4281-87ba-7a498064ab0b,147,Network activity,domain,"corn-en-us.com","",1,20200608
5ede974a-06d8-4dfd-899b-7a498064ab0b,147,Network activity,domain,"lnkshrtnr.com","",1,20200608
5ede974a-0968-4995-8b4b-7a498064ab0b,147,Network activity,domain,"2mblk.com","",1,20200608
5ede974a-0a08-4a29-a4a3-7a498064ab0b,147,Network activity,domain,"mailtickr.com","",1,20200608
5ede974a-0ac4-408b-b5e4-7a498064ab0b,147,Network activity,domain,"corn-loginservicesverified.com","",1,20200608
5ede974a-0c88-45e2-8ab3-7a498064ab0b,147,Network activity,domain,"domainmanager33.website","",1,20200608
5ede974a-0d58-42d4-8444-7a498064ab0b,147,Network activity,domain,"mailserverenterprise.com","",1,20200608
5ede974a-0d88-4041-bb35-7a498064ab0b,147,Network activity,domain,"emailseverrus23.com","",1,20200608
5ede974a-0d88-4db6-8d5d-7a498064ab0b,147,Network activity,domain,"msrvrgh.com","",1,20200608
5ede974a-0e30-4512-be41-7a498064ab0b,147,Network activity,domain,"mailserver89.org","",1,20200608
5ede974a-0f94-4924-8a79-7a498064ab0b,147,Network activity,domain,"webserverhollandservice.com","",1,20200608
5ede974a-124c-417d-a74e-7a498064ab0b,147,Network activity,domain,"webnetonlineservice.com","",1,20200608
5ede974a-1394-4cd7-b32d-7a498064ab0b,147,Network activity,domain,"ablyazovangels.com","",1,20200608
5ede974a-1408-409d-98b3-7a498064ab0b,147,Network activity,domain,"mailauthenticatorservice.com","",1,20200608
5ede974a-155c-49d2-b611-7a498064ab0b,147,Network activity,domain,"redirectonline.xyz","",1,20200608
5ede974a-15c4-4f56-9c76-7a498064ab0b,147,Network activity,domain,"srtnr.com","",1,20200608
5ede974a-1770-4e23-b405-7a498064ab0b,147,Network activity,domain,"webmasterserver39.com","",1,20200608
5ede974a-1bd0-42d0-bdd1-7a498064ab0b,147,Network activity,domain,"webserver91.website","",1,20200608
5ede974a-1c10-41e3-a906-7a498064ab0b,147,Network activity,domain,"mailserverru2099.com","",1,20200608
5ede974a-1e90-4e26-9a90-7a498064ab0b,147,Network activity,domain,"phpwebserver34.tech","",1,20200608
5ede974a-1eb8-428d-b36b-7a498064ab0b,147,Network activity,domain,"short-ner.com","",1,20200608
5ede974a-1f64-4635-a8e9-7a498064ab0b,147,Network activity,domain,"comservicelogin.com","",1,20200608
5ede974a-1fac-46a2-9be7-7a498064ab0b,147,Network activity,domain,"corn-lang-eng.com","",1,20200608
5ede974a-2038-46e4-9331-7a498064ab0b,147,Network activity,domain,"mailserveruk.com","",1,20200608
5ede974a-2178-458e-a517-7a498064ab0b,147,Network activity,domain,"hostmailsecureserver.com","",1,20200608
5ede974a-2198-4e07-b618-7a498064ab0b,147,Network activity,domain,"netcomserviceonline.com","",1,20200608
5ede974a-26c0-48ae-be69-7a498064ab0b,147,Network activity,domain,"strurl.click","",1,20200608
5ede974a-28b0-4f26-b8ed-7a498064ab0b,147,Network activity,domain,"extranetserviceonline.com","",1,20200608
5ede974a-2b90-4d94-aa1a-7a498064ab0b,147,Network activity,domain,"domainserver322.com","",1,20200608
5ede974a-31a0-49cb-b011-7a498064ab0b,147,Network activity,domain,"allaboutiot.website","",1,20200608
5ede974a-322c-450d-ad4a-7a498064ab0b,147,Network activity,domain,"serverforshort.com","",1,20200608
5ede974a-33a0-4ca5-8ef5-7a498064ab0b,147,Network activity,domain,"mailcommunicationservice.com","",1,20200608
5ede974a-3484-42bd-ad35-7a498064ab0b,147,Network activity,domain,"hostemailserver.com","",1,20200608
5ede974a-376c-4b9f-92c5-7a498064ab0b,147,Network activity,domain,"servergateway56.com","",1,20200608
5ede974a-3a84-4dc8-9919-7a498064ab0b,147,Network activity,domain,"msrvrgeh.com","",1,20200608
5ede974a-3aa4-42eb-9d3d-7a498064ab0b,147,Network activity,domain,"shrtnerlnk.com","",1,20200608
5ede974a-3bf4-44f6-b012-7a498064ab0b,147,Network activity,domain,"com-website33.com","",1,20200608
5ede974a-3f64-4f6e-849d-7a498064ab0b,147,Network activity,domain,"nodeserver50.com","",1,20200608
5ede974a-40d0-4407-8e21-7a498064ab0b,147,Network activity,domain,"mailserver89.com","",1,20200608
5ede974a-4134-4408-bffb-7a498064ab0b,147,Network activity,domain,"ablyazovcog.com","",1,20200608
5ede974a-4514-446e-b980-7a498064ab0b,147,Network activity,domain,"servermain43.com","",1,20200608
5ede974a-4744-4707-8722-7a498064ab0b,147,Network activity,domain,"servermailing34.com","",1,20200608
5ede974a-4a18-483e-889b-7a498064ab0b,147,Network activity,domain,"newserver39.com","",1,20200608
5ede974a-4a5c-467a-93ee-7a498064ab0b,147,Network activity,domain,"serversap54.com","",1,20200608
5ede974a-4c68-4da6-9f19-7a498064ab0b,147,Network activity,domain,"emailvalidateservice.com","",1,20200608
5ede974a-4eb0-4f7b-acd7-7a498064ab0b,147,Network activity,domain,"corn-servicelogin.com","",1,20200608
5ede974a-50e0-4cc7-8527-7a498064ab0b,147,Network activity,domain,"mailserveruk89.org","",1,20200608
5ede974a-515c-4ed2-b281-7a498064ab0b,147,Network activity,domain,"domainmanager33.com","",1,20200608
5ede974a-51b4-470b-8bc8-7a498064ab0b,147,Network activity,domain,"rockerhostings.com","",1,20200608
5ede974a-525c-4396-ba4d-7a498064ab0b,147,Network activity,domain,"servermappingserviceonline.com","",1,20200608
5ede974a-54c4-40da-ab7f-7a498064ab0b,147,Network activity,domain,"mailservershare.com","",1,20200608
5ede974a-5594-49f9-9ea6-7a498064ab0b,147,Network activity,domain,"euanticorruption.com","",1,20200608
5ede974a-55b4-4f05-bb4a-7a498064ab0b,147,Network activity,domain,"mailmarknotes.com","",1,20200608
5ede974a-563c-4c15-ba60-7a498064ab0b,147,Network activity,domain,"corn-msrvrgr.com","",1,20200608
5ede974a-5ab4-4cec-8481-7a498064ab0b,147,Network activity,domain,"netsecureemailservice.com","",1,20200608
5ede974a-5dd8-4f6b-831e-7a498064ab0b,147,Network activity,domain,"emailhostsecurehk.com","",1,20200608
5ede974a-5f68-40d7-83ee-7a498064ab0b,147,Network activity,domain,"corn-en-gb.com","",1,20200608
5ede974a-6238-4970-a66e-7a498064ab0b,147,Network activity,domain,"hostsecuremail544.com","",1,20200608
5ede974a-624c-4728-b4e2-7a498064ab0b,147,Network activity,domain,"shadymario.com","",1,20200608
5ede974a-6360-4a3a-ada0-7a498064ab0b,147,Network activity,domain,"ablyazovmafia.com","",1,20200608
5ede974a-63d0-44ec-8fa7-7a498064ab0b,147,Network activity,domain,"maildeliveryagent.com","",1,20200608
5ede974a-63fc-491f-b39b-7a498064ab0b,147,Network activity,domain,"getemailopens.com","",1,20200608
5ede974a-650c-4b2f-9da1-7a498064ab0b,147,Network activity,domain,"netsecureserver399.com","",1,20200608
5ede974a-6764-490c-b5a6-7a498064ab0b,147,Network activity,domain,"linkshortnr.com","",1,20200608
5ede974a-6918-4c89-bc38-7a498064ab0b,147,Network activity,domain,"pageserverru.com","",1,20200608
5ede974a-6b38-4858-9427-7a498064ab0b,147,Network activity,domain,"domainmanager33.site","",1,20200608
5ede974a-6b68-4e98-ac7d-7a498064ab0b,147,Network activity,domain,"mailerdomain56.com","",1,20200608
5ede974a-6d40-4201-8e7b-7a498064ab0b,147,Network activity,domain,"emailhostholland.com","",1,20200608
5ede974a-6ff4-4891-9efc-7a498064ab0b,147,Network activity,domain,"domainserver399.com","",1,20200608
5ede974a-72fc-4068-b954-7a498064ab0b,147,Network activity,domain,"sapserverhipe.com","",1,20200608
5ede974a-7358-473b-9cfd-7a498064ab0b,147,Network activity,domain,"imapserverholland.com","",1,20200608
5ede974a-74cc-423f-a7af-7a498064ab0b,147,Network activity,domain,"cyberanalyticals.com","",1,20200608
5ede974a-7628-40c5-86c9-7a498064ab0b,147,Network activity,domain,"santanaservice.com","",1,20200608
5ede974a-7680-41d3-bc19-7a498064ab0b,147,Network activity,domain,"softnetworksolutions.com","",1,20200608
5ede974a-77a8-419e-8feb-7a498064ab0b,147,Network activity,domain,"mailcollectorservice.com","",1,20200608
5ede974a-7aa0-48bf-ad8b-7a498064ab0b,147,Network activity,domain,"mailrockservice.com","",1,20200608
5ede974a-7b58-47aa-9a92-7a498064ab0b,147,Network activity,domain,"mblk1.com","",1,20200608
5ede974a-7ca0-4ba3-8d25-7a498064ab0b,147,Network activity,domain,"mailmarkservice.com","",1,20200608
5ede974a-7cc8-4a6d-ac95-7a498064ab0b,147,Network activity,domain,"phpwebserver34.xyz","",1,20200608
5ede974a-7ff4-4f69-890c-7a498064ab0b,147,Network activity,domain,"basemailservice.com","",1,20200608
5ede974a-8024-4293-b1ec-7a498064ab0b,147,Network activity,domain,"domainsserver4f.com","",1,20200608
5ede974a-81ec-4128-9036-7a498064ab0b,147,Network activity,domain,"ablyazovgang.com","",1,20200608
5ede974a-8504-4659-bfd7-7a498064ab0b,147,Network activity,domain,"webserverredirect99.com","",1,20200608
5ede974a-8b1c-4ee5-94be-7a498064ab0b,147,Network activity,domain,"smtpserver389.com","",1,20200608
5ede974a-8c14-48ff-aa3c-7a498064ab0b,147,Network activity,domain,"pageserver77.com","",1,20200608
5ede974a-8e70-479d-9aab-7a498064ab0b,147,Network activity,domain,"com-website33.biz","",1,20200608
5ede974a-8ec4-4b0a-9792-7a498064ab0b,147,Network activity,domain,"corn-fr-fr.com","",1,20200608
5ede974a-8ed4-4367-9b88-7a498064ab0b,147,Network activity,domain,"corn-ukr.com","",1,20200608
5ede974a-8fb8-4691-9e50-7a498064ab0b,147,Network activity,domain,"shortformurl.com","",1,20200608
5ede974a-90dc-40ea-9a33-7a498064ab0b,147,Network activity,domain,"checkmailserverhk.com","",1,20200608
5ede974a-90f0-4667-8747-7a498064ab0b,147,Network activity,domain,"securemailhost46.com","",1,20200608
5ede974a-91e4-4488-bb36-7a498064ab0b,147,Network activity,domain,"linksrtnr.com","",1,20200608
5ede974a-92e4-4d8e-a145-7a498064ab0b,147,Network activity,domain,"domainemailhostings.com","",1,20200608
5ede974a-930c-472e-a915-7a498064ab0b,147,Network activity,domain,"ablyazovorganisedcrime.com","",1,20200608
5ede974a-9570-481d-b627-7a498064ab0b,147,Network activity,domain,"hostemailsecureserver.com","",1,20200608
5ede974a-9658-41ca-8e4e-7a498064ab0b,147,Network activity,domain,"hostmailsecure.com","",1,20200608
5ede974a-969c-4f41-9b29-7a498064ab0b,147,Network activity,domain,"ablyazovcrimestory.com","",1,20200608
5ede974a-96bc-4de2-9a3f-7a498064ab0b,147,Network activity,domain,"maillinkservice.com","",1,20200608
5ede974a-9798-4cb1-ade2-7a498064ab0b,147,Network activity,domain,"hbh-europe-ripoff-report.com","",1,20200608
5ede974a-9900-4bde-bd24-7a498064ab0b,147,Network activity,domain,"onlinenetworkinghelp.com","",1,20200608
5ede974a-9908-4265-9d9c-7a498064ab0b,147,Network activity,domain,"hostsecuremail.com","",1,20200608
5ede974a-9de4-416e-82c6-7a498064ab0b,147,Network activity,domain,"emaildeliverysuccess.com","",1,20200608
5ede974a-a360-40c5-bf27-7a498064ab0b,147,Network activity,domain,"serverhello54.com","",1,20200608
5ede974a-a3b4-4400-8ce4-7a498064ab0b,147,Network activity,domain,"postserviceemaildomain.com","",1,20200608
5ede974a-a3b8-455c-ab4c-7a498064ab0b,147,Network activity,domain,"mailapiservice.com","",1,20200608
5ede974a-a478-4713-a96a-7a498064ab0b,147,Network activity,domain,"shortlinkcut.com","",1,20200608
5ede974a-a4a0-4395-876d-7a498064ab0b,147,Network activity,domain,"smtpserver466.com","",1,20200608
5ede974a-a4f8-4564-83d2-7a498064ab0b,147,Network activity,domain,"webredirect39.com","",1,20200608
5ede974a-abc4-47f7-8141-7a498064ab0b,147,Network activity,domain,"emailsecurenode.com","",1,20200608
5ede974a-af7c-4f6b-9404-7a498064ab0b,147,Network activity,domain,"websociofiles.com","",1,20200608
5ede974a-afd0-4e7b-a76d-7a498064ab0b,147,Network activity,domain,"hkdrillonline.com","",1,20200608
5ede974a-affc-4a69-ba79-7a498064ab0b,147,Network activity,domain,"searchsimple.net","",1,20200608
5ede974a-b078-4d6f-b0ba-7a498064ab0b,147,Network activity,domain,"emailservername299.com","",1,20200608
5ede974a-b100-401e-bc99-7a498064ab0b,147,Network activity,domain,"shortformurl.xyz","",1,20200608
5ede974a-b18c-4072-87f0-7a498064ab0b,147,Network activity,domain,"loginauths-service.com","",1,20200608
5ede974a-b358-4799-b811-7a498064ab0b,147,Network activity,domain,"webserveronline9.com","",1,20200608
5ede974a-b478-4eef-87bf-7a498064ab0b,147,Network activity,domain,"hathwaynetwork.com","",1,20200608
5ede974a-b634-4bd2-964f-7a498064ab0b,147,Network activity,domain,"ablyazovcriminals.com","",1,20200608
5ede974a-b64c-41fd-8fed-7a498064ab0b,147,Network activity,domain,"com-website33.info","",1,20200608
5ede974a-b704-4f9a-bac6-7a498064ab0b,147,Network activity,domain,"mailserver89.net","",1,20200608
5ede974a-b778-4722-af3a-7a498064ab0b,147,Network activity,domain,"softredirect.info","",1,20200608
5ede974a-b984-4338-b5aa-7a498064ab0b,147,Network activity,domain,"emailmappingservice.com","",1,20200608
5ede974a-ba64-44ff-aa99-7a498064ab0b,147,Network activity,domain,"logserver39.com","",1,20200608
5ede974a-ba84-4d86-8998-7a498064ab0b,147,Network activity,domain,"networkshareserver.com","",1,20200608
5ede974a-bc48-433f-ba2f-7a498064ab0b,147,Network activity,domain,"loginservercheck.com","",1,20200608
5ede974a-c1d4-4fb9-9ac9-7a498064ab0b,147,Network activity,domain,"ultronnetworksolution.com","",1,20200608
5ede974a-c230-41f6-9a49-7a498064ab0b,147,Network activity,domain,"mail-logger.com","",1,20200608
5ede974a-c258-4537-9381-7a498064ab0b,147,Network activity,domain,"loginserviceunified.com","",1,20200608
5ede974a-c3e8-4f50-863c-7a498064ab0b,147,Network activity,domain,"homeserver87.com","",1,20200608
5ede974a-c774-403d-88f0-7a498064ab0b,147,Network activity,domain,"mailannounceservice.com","",1,20200608
5ede974a-c7dc-42df-859a-7a498064ab0b,147,Network activity,domain,"linkshrtnr22.com","",1,20200608
5ede974a-caac-4790-9459-7a498064ab0b,147,Network activity,domain,"emailserverholland.com","",1,20200608
5ede974a-cdf8-44a2-948a-7a498064ab0b,147,Network activity,domain,"mailsecurehost.com","",1,20200608
5ede974a-d034-4204-95bd-7a498064ab0b,147,Network activity,domain,"phpwebserver34.best","",1,20200608
5ede974a-d2a4-4362-80d4-7a498064ab0b,147,Network activity,domain,"mailserveruk89.net","",1,20200608
5ede974a-d2e0-4497-ba46-7a498064ab0b,147,Network activity,domain,"msrfrgr.com","",1,20200608
5ede974a-d330-4e5c-a1e1-7a498064ab0b,147,Network activity,domain,"webserver39.com","",1,20200608
5ede974a-d6fc-4d48-8374-7a498064ab0b,147,Network activity,domain,"mailtransferserver.com","",1,20200608
5ede974a-d980-4714-a8f9-7a498064ab0b,147,Network activity,domain,"com-website33.net","",1,20200608
5ede974a-dabc-4879-9bd0-7a498064ab0b,147,Network activity,domain,"mailer-domain.com","",1,20200608
5ede974a-dac8-48f3-b108-7a498064ab0b,147,Network activity,domain,"servergateway33.com","",1,20200608
5ede974a-dae4-45a9-9694-7a498064ab0b,147,Network activity,domain,"browserextensions.info","",1,20200608
5ede974a-dcdc-4da8-a2f7-7a498064ab0b,147,Network activity,domain,"goomail.ml","",1,20200608
5ede974a-ddd8-474a-bf5e-7a498064ab0b,147,Network activity,domain,"mailserveruk89.com","",1,20200608
5ede974a-deb8-4412-95d1-7a498064ab0b,147,Network activity,domain,"postmarkapiservice.com","",1,20200608
5ede974a-df3c-4741-afa8-7a498064ab0b,147,Network activity,domain,"mailauthservice399.com","",1,20200608
5ede974a-e18c-467e-a40b-7a498064ab0b,147,Network activity,domain,"phpwebserver34.site","",1,20200608
5ede974a-e3dc-4e89-afab-7a498064ab0b,147,Network activity,domain,"mailchimpservice.com","",1,20200608
5ede974a-e538-4957-a77a-7a498064ab0b,147,Network activity,domain,"pageserver299.com","",1,20200608
5ede974a-e694-4282-9f6a-7a498064ab0b,147,Network activity,domain,"webhostwebcare.com","",1,20200608
5ede974a-e7e8-4cc0-ba44-7a498064ab0b,147,Network activity,domain,"netmapservice.com","",1,20200608
5ede974a-e8f0-402b-8d49-7a498064ab0b,147,Network activity,domain,"mywebredirect.info","",1,20200608
5ede974a-e8f0-4210-a5a8-7a498064ab0b,147,Network activity,domain,"sapserver39j.com","",1,20200608
5ede974a-eb54-4f98-8f5d-7a498064ab0b,147,Network activity,domain,"mailgatorservice.com","",1,20200608
5ede974a-ec28-413e-ac2c-7a498064ab0b,147,Network activity,domain,"4mblk.com","",1,20200608
5ede974a-eccc-432c-9ad7-7a498064ab0b,147,Network activity,domain,"myfacetik.cf","",1,20200608
5ede974a-ed04-4563-b839-7a498064ab0b,147,Network activity,domain,"ablyazovcriminalgang.com","",1,20200608
5ede974a-ed18-48ee-a223-7a498064ab0b,147,Network activity,domain,"mailingserver938.com","",1,20200608
5ede974a-f0c4-4628-a01d-7a498064ab0b,147,Network activity,domain,"openserverholland.com","",1,20200608
5ede974a-f210-4037-8741-7a498064ab0b,147,Network activity,domain,"emailserverhk48.com","",1,20200608
5ede974a-f598-4c2e-b774-7a498064ab0b,147,Network activity,domain,"emailauthservice.com","",1,20200608
5ede974a-f87c-402a-9b1a-7a498064ab0b,147,Network activity,domain,"rackserver39.com","",1,20200608
5ede974a-f934-4a99-9c8f-7a498064ab0b,147,Network activity,domain,"un-told.net","",1,20200608
5ede974a-fb04-40f9-aeff-7a498064ab0b,147,Network activity,domain,"ablyazovcrimesyndicate.com","",1,20200608
5ede974a-fb80-49d4-912d-7a498064ab0b,147,Network activity,domain,"searchsimple.info","",1,20200608
5ede974a-fc84-4a5c-a9b1-7a498064ab0b,147,Network activity,domain,"mailpostsecure.com","",1,20200608
5ede974a-fdd8-48f5-aede-7a498064ab0b,147,Network activity,domain,"emailserver399.com","",1,20200608
5ede974a-ffa4-4456-8d11-7a498064ab0b,147,Network activity,domain,"mailpostsecureservice.com","",1,20200608
5ede974b-0010-4ce9-aede-7a498064ab0b,147,Network activity,domain,"ultimateresponseservice.com","",1,20200608
5ede974b-0180-4724-9fc2-7a498064ab0b,147,Network activity,domain,"shortnerserviceonline.com","",1,20200608
5ede974b-0394-493e-92cc-7a498064ab0b,147,Network activity,domain,"hostbasicsg.com","",1,20200608
5ede974b-0394-4fcb-ab1d-7a498064ab0b,147,Network activity,domain,"loginservicesmailsonlinesaccounts.com","",1,20200608
5ede974b-048c-4ae5-900c-7a498064ab0b,147,Network activity,domain,"sapserverhg.com","",1,20200608
5ede974b-076c-40b4-acd9-7a498064ab0b,147,Network activity,domain,"demoprojectsuk.com","",1,20200608
5ede974b-1050-4a49-a531-7a498064ab0b,147,Network activity,domain,"selectedservicesg.com","",1,20200608
5ede974b-1060-4d92-a2c9-7a498064ab0b,147,Network activity,domain,"mailsecureservers.com","",1,20200608
5ede974b-1134-4ece-8e78-7a498064ab0b,147,Network activity,domain,"javaservermy.com","",1,20200608
5ede974b-11b8-463d-8aee-7a498064ab0b,147,Network activity,domain,"selectedmaxstores.com","",1,20200608
5ede974b-12b8-478f-9a4a-7a498064ab0b,147,Network activity,domain,"browserdirectservice.com","",1,20200608
5ede974b-133c-435b-a17d-7a498064ab0b,147,Network activity,domain,"trustedserviceonline.com","",1,20200608
5ede974b-138c-440a-9b4f-7a498064ab0b,147,Network activity,domain,"affliatedomainservice.com","",1,20200608
5ede974b-1390-41f2-9eef-7a498064ab0b,147,Network activity,domain,"registrationonlineeurope.com","",1,20200608
5ede974b-1518-4800-9a25-7a498064ab0b,147,Network activity,domain,"mylinbas.com","",1,20200608
5ede974b-1584-4172-9242-7a498064ab0b,147,Network activity,domain,"anitmationworldnews.com","",1,20200608
5ede974b-15f0-4ebc-818d-7a498064ab0b,147,Network activity,domain,"backwaterreservoir.com","",1,20200608
5ede974b-1900-4c7a-9a95-7a498064ab0b,147,Network activity,domain,"serverloadbalance.com","",1,20200608
5ede974b-1bf8-4a3a-a1a1-7a498064ab0b,147,Network activity,domain,"hiretechservicehg.com","",1,20200608
5ede974b-1d98-411f-854f-7a498064ab0b,147,Network activity,domain,"mailserveroutlook.com","",1,20200608
5ede974b-1e04-4f54-9d73-7a498064ab0b,147,Network activity,domain,"hostfeasta.com","",1,20200608
5ede974b-1fd0-4c51-aaa5-7a498064ab0b,147,Network activity,domain,"postserverem.com","",1,20200608
5ede974b-214c-4a18-84c3-7a498064ab0b,147,Network activity,domain,"selectiveservicemax.com","",1,20200608
5ede974b-226c-4b68-9093-7a498064ab0b,147,Network activity,domain,"linuxbasicsg1.com","",1,20200608
5ede974b-22b8-40e6-afe3-7a498064ab0b,147,Network activity,domain,"mailcommute.com","",1,20200608
5ede974b-25e4-459a-9744-7a498064ab0b,147,Network activity,domain,"onlineloginportalsg.com","",1,20200608
5ede974b-26c8-401d-afe0-7a498064ab0b,147,Network activity,domain,"basichostingrussia.com","",1,20200608
5ede974b-27cc-4146-b861-7a498064ab0b,147,Network activity,domain,"optionalblogging.com","",1,20200608
5ede974b-292c-4c75-9e27-7a498064ab0b,147,Network activity,domain,"mailserviceloginonline.com","",1,20200608
5ede974b-2930-48c9-b7ec-7a498064ab0b,147,Network activity,domain,"internetmarketingservicehg.com","",1,20200608
5ede974b-2a10-40d2-ad2d-7a498064ab0b,147,Network activity,domain,"hostbasicru.com","",1,20200608
5ede974b-2c70-49dc-9b5e-7a498064ab0b,147,Network activity,domain,"bellsouthnetwork.com","",1,20200608
5ede974b-2d00-4dc6-8bb2-7a498064ab0b,147,Network activity,domain,"domainhostworkeu.com","",1,20200608
5ede974b-2e14-46ca-84d1-7a498064ab0b,147,Network activity,domain,"onlineloginportalhk.com","",1,20200608
5ede974b-3010-4cee-95ae-7a498064ab0b,147,Network activity,domain,"secureserverasia.com","",1,20200608
5ede974b-3028-4600-82af-7a498064ab0b,147,Network activity,domain,"fastserverusa.com","",1,20200608
5ede974b-3108-4ce1-b76a-7a498064ab0b,147,Network activity,domain,"usewithcareathome.com","",1,20200608
5ede974b-3340-45f1-915d-7a498064ab0b,147,Network activity,domain,"buzzoffru.com","",1,20200608
5ede974b-3340-4c3f-bf88-7a498064ab0b,147,Network activity,domain,"webserver39490.com","",1,20200608
5ede974b-34c0-47a6-9887-7a498064ab0b,147,Network activity,domain,"buzzoffsg.com","",1,20200608
5ede974b-3538-441f-8489-7a498064ab0b,147,Network activity,domain,"shipnyatchholland.com","",1,20200608
5ede974b-3584-4b12-925f-7a498064ab0b,147,Network activity,domain,"standardofficeholland.com","",1,20200608
5ede974b-3594-4998-b9e1-7a498064ab0b,147,Network activity,domain,"domainlocalhostinghk.com","",1,20200608
5ede974b-3634-4a5f-b63d-7a498064ab0b,147,Network activity,domain,"watchmanservice.com","",1,20200608
5ede974b-3690-4c15-99b4-7a498064ab0b,147,Network activity,domain,"linuxbasicru.com","",1,20200608
5ede974b-3794-4593-8994-7a498064ab0b,147,Network activity,domain,"domainsforsupport.com","",1,20200608
5ede974b-3930-4de3-8ded-7a498064ab0b,147,Network activity,domain,"offshoretoursntravels.com","",1,20200608
5ede974b-3b48-441b-9258-7a498064ab0b,147,Network activity,domain,"chromeperfection.com","",1,20200608
5ede974b-3b88-4b23-9f2f-7a498064ab0b,147,Network activity,domain,"hostserverrus.com","",1,20200608
5ede974b-3bf0-48e4-b015-7a498064ab0b,147,Network activity,domain,"loginservicebasic.com","",1,20200608
5ede974b-3c58-49a5-91d9-7a498064ab0b,147,Network activity,domain,"frwrdrwr.com","",1,20200608
5ede974b-3fd0-4d16-94f7-7a498064ab0b,147,Network activity,domain,"hostbasicholl.com","",1,20200608
5ede974b-4078-4c94-97f9-7a498064ab0b,147,Network activity,domain,"planyourexoticvacation.com","",1,20200608
5ede974b-40c4-4a93-96e4-7a498064ab0b,147,Network activity,domain,"shrinkthisurl.com","",1,20200608
5ede974b-4178-428d-9a89-7a498064ab0b,147,Network activity,domain,"basichostnetservice.com","",1,20200608
5ede974b-44dc-476e-999f-7a498064ab0b,147,Network activity,domain,"domainlocalhostinguk.com","",1,20200608
5ede974b-4578-4f21-b8e0-7a498064ab0b,147,Network activity,domain,"ruslinbas.com","",1,20200608
5ede974b-4690-4211-b94f-7a498064ab0b,147,Network activity,domain,"updatenameserver45.com","",1,20200608
5ede974b-4868-4ba6-9d46-7a498064ab0b,147,Network activity,domain,"buzzoffmy.com","",1,20200608
5ede974b-48ac-49f7-aa25-7a498064ab0b,147,Network activity,domain,"webserveroginusa.com","",1,20200608
5ede974b-4918-4acf-8bc2-7a498064ab0b,147,Network activity,domain,"getreadytorunhalfmarathon.com","",1,20200608
5ede974b-49a4-4739-aceb-7a498064ab0b,147,Network activity,domain,"domainexpertswebuk.com","",1,20200608
5ede974b-4aac-4dc1-874c-7a498064ab0b,147,Network activity,domain,"luxlinbas.com","",1,20200608
5ede974b-4c1c-4135-96a3-7a498064ab0b,147,Network activity,domain,"auditionregistrationonline.com","",1,20200608
5ede974b-4c7c-4ff7-84df-7a498064ab0b,147,Network activity,domain,"strngbltru.com","",1,20200608
5ede974b-4cfc-4fb4-8b9b-7a498064ab0b,147,Network activity,domain,"hollandtourandtravel.com","",1,20200608
5ede974b-4de0-4c57-9268-7a498064ab0b,147,Network activity,domain,"domainhostnetworkusa.com","",1,20200608
5ede974b-4e40-4bc5-8730-7a498064ab0b,147,Network activity,domain,"homeforallorphans.com","",1,20200608
5ede974b-51d4-4035-8752-7a498064ab0b,147,Network activity,domain,"serverforhome.com","",1,20200608
5ede974b-51e8-4732-bf38-7a498064ab0b,147,Network activity,domain,"productdemoservice.com","",1,20200608
5ede974b-5228-4bc7-ac4a-7a498064ab0b,147,Network activity,domain,"exchangeserverformailing.com","",1,20200608
5ede974b-53d4-4528-b91f-7a498064ab0b,147,Network activity,domain,"dotnerserversg.com","",1,20200608
5ede974b-5454-4b4d-aa33-7a498064ab0b,147,Network activity,domain,"hostbasichk.com","",1,20200608
5ede974b-54c4-4074-9a98-7a498064ab0b,147,Network activity,domain,"redirectserviceonline.com","",1,20200608
5ede974b-56b4-4798-85da-7a498064ab0b,147,Network activity,domain,"standardofficeuk.com","",1,20200608
5ede974b-56c4-4a2a-8774-7a498064ab0b,147,Network activity,domain,"shoponlinefreeuk.com","",1,20200608
5ede974b-5740-4f87-978e-7a498064ab0b,147,Network activity,domain,"tnyurlservice.com","",1,20200608
5ede974b-583c-4616-a682-7a498064ab0b,147,Network activity,domain,"netsecurehostingmy.com","",1,20200608
5ede974b-5af4-43e2-afa4-7a498064ab0b,147,Network activity,domain,"personaldoaminru.com","",1,20200608
5ede974b-5cec-4d36-9d48-7a498064ab0b,147,Network activity,domain,"loginservicehelp.com","",1,20200608
5ede974b-5cf0-4e14-9200-7a498064ab0b,147,Network activity,domain,"youranotherserver.com","",1,20200608
5ede974b-5cf4-43bc-9d02-7a498064ab0b,147,Network activity,domain,"shrinkandshareurl.com","",1,20200608
5ede974b-5e04-4a75-8dde-7a498064ab0b,147,Network activity,domain,"domainformailinguk.com","",1,20200608
5ede974b-5ebc-4cef-b91d-7a498064ab0b,147,Network activity,domain,"serverfortechies.com","",1,20200608
5ede974b-5ebc-4d75-a571-7a498064ab0b,147,Network activity,domain,"exchangeserver2345.com","",1,20200608
5ede974b-5f40-4848-a111-7a498064ab0b,147,Network activity,domain,"hostusewithtech.com","",1,20200608
5ede974b-5f4c-49d8-b403-7a498064ab0b,147,Network activity,domain,"optionalblogginguk.com","",1,20200608
5ede974b-5fa0-4bc1-82c4-7a498064ab0b,147,Network activity,domain,"domainsforfreehosting.com","",1,20200608
5ede974b-6098-4415-bf1e-7a498064ab0b,147,Network activity,domain,"transferdomainhk.com","",1,20200608
5ede974b-61ac-49a6-8ce9-7a498064ab0b,147,Network activity,domain,"basicservicemy.com","",1,20200608
5ede974b-646c-46fa-b45a-7a498064ab0b,147,Network activity,domain,"onlineloginserviceeu.com","",1,20200608
5ede974b-6930-47e1-ad77-7a498064ab0b,147,Network activity,domain,"supportserviceeu.com","",1,20200608
5ede974b-693c-4ffc-97a6-7a498064ab0b,147,Network activity,domain,"blogserverlx.com","",1,20200608
5ede974b-69a0-414f-9baa-7a498064ab0b,147,Network activity,domain,"browserredirect.com","",1,20200608
5ede974b-6b04-446d-83a0-7a498064ab0b,147,Network activity,domain,"localserversa.com","",1,20200608
5ede974b-6b64-457f-86c4-7a498064ab0b,147,Network activity,domain,"tricktravelbooking.com","",1,20200608
5ede974b-6c6c-4931-8c5a-7a498064ab0b,147,Network activity,domain,"trackserviceonline.xyz","",1,20200608
5ede974b-6d20-4054-87fc-7a498064ab0b,147,Network activity,domain,"racksackserveruk.com","",1,20200608
5ede974b-6e00-4107-b39f-7a498064ab0b,147,Network activity,domain,"websecurehostings.com","",1,20200608
5ede974b-6ee8-4b70-acdc-7a498064ab0b,147,Network activity,domain,"onlineloginserviceuk.com","",1,20200608
5ede974b-6ee8-4c07-a877-7a498064ab0b,147,Network activity,domain,"strongwingtechnologies.com","",1,20200608
5ede974b-7154-4e65-8649-7a498064ab0b,147,Network activity,domain,"transferdomainlu.com","",1,20200608
5ede974b-7244-43e1-92cc-7a498064ab0b,147,Network activity,domain,"domainhostnetworkuk.com","",1,20200608
5ede974b-7348-4b92-8293-7a498064ab0b,147,Network activity,domain,"bitserverhk.com","",1,20200608
5ede974b-7354-4483-95e8-7a498064ab0b,147,Network activity,domain,"mailauthorizationservice.com","",1,20200608
5ede974b-73d8-4115-838f-7a498064ab0b,147,Network activity,domain,"tinyurlshortner.com","",1,20200608
5ede974b-748c-44c9-aef9-7a498064ab0b,147,Network activity,domain,"basicservicehk.com","",1,20200608
5ede974b-7674-4e17-9971-7a498064ab0b,147,Network activity,domain,"dotnetserverhk.com","",1,20200608
5ede974b-7680-4679-b122-7a498064ab0b,147,Network activity,domain,"serviceasneed.com","",1,20200608
5ede974b-792c-42eb-b93e-7a498064ab0b,147,Network activity,domain,"economyfeeds.com","",1,20200608
5ede974b-7b90-41ef-9af5-7a498064ab0b,147,Network activity,domain,"msgrdrg.com","",1,20200608
5ede974b-7d38-4846-9698-7a498064ab0b,147,Network activity,domain,"tineeurl.com","",1,20200608
5ede974b-7e20-49ed-aa14-7a498064ab0b,147,Network activity,domain,"buzzoffhk.com","",1,20200608
5ede974b-7edc-4057-baba-7a498064ab0b,147,Network activity,domain,"webserverdomainusa.com","",1,20200608
5ede974b-7edc-4931-a120-7a498064ab0b,147,Network activity,domain,"hongkongshippingcompany.com","",1,20200608
5ede974b-8008-4c91-a16b-7a498064ab0b,147,Network activity,domain,"localhostinguk.com","",1,20200608
5ede974b-806c-42c6-b2f9-7a498064ab0b,147,Network activity,domain,"serverasiasap.com","",1,20200608
5ede974b-829c-454d-bd75-7a498064ab0b,147,Network activity,domain,"shortenurlservices.com","",1,20200608
5ede974b-82f0-4cf1-aa52-7a498064ab0b,147,Network activity,domain,"basicservicelux.com","",1,20200608
5ede974b-83c0-4085-9855-7a498064ab0b,147,Network activity,domain,"mailserverdirect3994.com","",1,20200608
5ede974b-844c-45a5-8ab8-7a498064ab0b,147,Network activity,domain,"fastservereurope.com","",1,20200608
5ede974b-85c0-4aa0-9d28-7a498064ab0b,147,Network activity,domain,"serverforhelpru.com","",1,20200608
5ede974b-863c-4ea3-bc83-7a498064ab0b,147,Network activity,domain,"optionalblogginges.com","",1,20200608
5ede974b-8704-4ba7-b7b8-7a498064ab0b,147,Network activity,domain,"economyservicesil.com","",1,20200608
5ede974b-87e4-4558-a61a-7a498064ab0b,147,Network activity,domain,"basicservicerus.com","",1,20200608
5ede974b-8810-46a1-b086-7a498064ab0b,147,Network activity,domain,"russialinuxbasic.com","",1,20200608
5ede974b-885c-427b-9a04-7a498064ab0b,147,Network activity,domain,"hardcoretechnologiesllp.com","",1,20200608
5ede974b-886c-4f69-b4d5-7a498064ab0b,147,Network activity,domain,"homeremedytipntricks.com","",1,20200608
5ede974b-898c-4a02-9d5c-7a498064ab0b,147,Network activity,domain,"mailserver39.com","",1,20200608
5ede974b-8b3c-4a51-bc70-7a498064ab0b,147,Network activity,domain,"trusteventservices.com","",1,20200608
5ede974b-8bac-43ad-88c1-7a498064ab0b,147,Network activity,domain,"emailbaseserverhl.com","",1,20200608
5ede974b-8c64-4036-b55a-7a498064ab0b,147,Network activity,domain,"servicegoingfar.com","",1,20200608
5ede974b-8ccc-4d1c-96fd-7a498064ab0b,147,Network activity,domain,"selectedservicemy.com","",1,20200608
5ede974b-8d54-4966-b6ce-7a498064ab0b,147,Network activity,domain,"netserviceru.com","",1,20200608
5ede974b-90cc-4198-b987-7a498064ab0b,147,Network activity,domain,"sglinbas.com","",1,20200608
5ede974b-90ec-4a51-9cb1-7a498064ab0b,147,Network activity,domain,"blogforpranks.com","",1,20200608
5ede974b-91e4-441f-8e18-7a498064ab0b,147,Network activity,domain,"standardofficeil.com","",1,20200608
5ede974b-92f4-4263-aba5-7a498064ab0b,147,Network activity,domain,"webdomainexperts.com","",1,20200608
5ede974b-9504-4c77-90af-7a498064ab0b,147,Network activity,domain,"selectyourgroom.com","",1,20200608
5ede974b-98ac-4c09-a078-7a498064ab0b,147,Network activity,domain,"srvrgruk.com","",1,20200608
5ede974b-995c-4825-96e8-7a498064ab0b,147,Network activity,domain,"getsetgoforhealth.com","",1,20200608
5ede974b-9a00-4765-a6a3-7a498064ab0b,147,Network activity,domain,"emailserver4859.com","",1,20200608
5ede974b-9d20-47f0-ae1a-7a498064ab0b,147,Network activity,domain,"offshorecompanyllp.com","",1,20200608
5ede974b-9d70-42e3-99df-7a498064ab0b,147,Network activity,domain,"buzzoffbul.com","",1,20200608
5ede974b-a0dc-4952-b5e7-7a498064ab0b,147,Network activity,domain,"knowledgebaseonlineuk.com","",1,20200608
5ede974b-a1d4-4af1-b30e-7a498064ab0b,147,Network activity,domain,"promotespritialbelief.com","",1,20200608
5ede974b-a390-4424-8619-7a498064ab0b,147,Network activity,domain,"com-authmail.com","",1,20200608
5ede974b-a3b4-404d-aab6-7a498064ab0b,147,Network activity,domain,"linkfollowservice.com","",1,20200608
5ede974b-a520-446a-8154-7a498064ab0b,147,Network activity,domain,"maxlaboratories.com","",1,20200608
5ede974b-a7c8-492e-b0cc-7a498064ab0b,147,Network activity,domain,"xpertmaildomain.com","",1,20200608
5ede974b-a7e4-469f-a011-7a498064ab0b,147,Network activity,domain,"basicruoffshore.com","",1,20200608
5ede974b-ab10-4ab3-a06d-7a498064ab0b,147,Network activity,domain,"webserverdomainuk.com","",1,20200608
5ede974b-ab8c-41d3-86e4-7a498064ab0b,147,Network activity,domain,"onlineloginportalmy.com","",1,20200608
5ede974b-abc8-4549-93d6-7a498064ab0b,147,Network activity,domain,"logincontrolserver.com","",1,20200608
5ede974b-abfc-4f30-a75e-7a498064ab0b,147,Network activity,domain,"shoponlinefreesg.com","",1,20200608
5ede974b-ac34-420a-ada9-7a498064ab0b,147,Network activity,domain,"strongbolthostinghk.com","",1,20200608
5ede974b-ac3c-4cd0-852e-7a498064ab0b,147,Network activity,domain,"belowmargins.com","",1,20200608
5ede974b-acf4-4960-87bf-7a498064ab0b,147,Network activity,domain,"serverfornetworks.com","",1,20200608
5ede974b-ae2c-4309-a967-7a498064ab0b,147,Network activity,domain,"mailservereurope.com","",1,20200608
5ede974b-ae7c-4519-9607-7a498064ab0b,147,Network activity,domain,"hklinbas.com","",1,20200608
5ede974b-aeb0-4b09-9650-7a498064ab0b,147,Network activity,domain,"hostbasicmy.com","",1,20200608
5ede974b-af2c-4075-b385-7a498064ab0b,147,Network activity,domain,"domainforhostuk.com","",1,20200608
5ede974b-b028-4cd7-b4c3-7a498064ab0b,147,Network activity,domain,"bitserverlux.com","",1,20200608
5ede974b-b0f8-471a-a175-7a498064ab0b,147,Network activity,domain,"hostingservicesukit.com","",1,20200608
5ede974b-b218-498c-9aa8-7a498064ab0b,147,Network activity,domain,"frwrdrurl.com","",1,20200608
5ede974b-b444-4749-83d7-7a498064ab0b,147,Network activity,domain,"rulinuxbasic.com","",1,20200608
5ede974b-b44c-48af-9023-7a498064ab0b,147,Network activity,domain,"webredirect.click","",1,20200608
5ede974b-b4a4-4b8d-ae21-7a498064ab0b,147,Network activity,domain,"linuxserverfast.com","",1,20200608
5ede974b-b544-44bd-a17a-7a498064ab0b,147,Network activity,domain,"serverforhiretech.com","",1,20200608
5ede974b-b574-4200-beaa-7a498064ab0b,147,Network activity,domain,"serverfortechhelp.com","",1,20200608
5ede974b-b5e8-4554-98f1-7a498064ab0b,147,Network activity,domain,"domainserveractive.com","",1,20200608
5ede974b-bd48-4ac8-8a01-7a498064ab0b,147,Network activity,domain,"hostingservicesloyal.com","",1,20200608
5ede974b-bf8c-42fc-bc23-7a498064ab0b,147,Network activity,domain,"pageredirectservice.com","",1,20200608
5ede974b-bfac-49c8-9853-7a498064ab0b,147,Network activity,domain,"personaldoaminsg.com","",1,20200608
5ede974b-c100-45b4-81df-7a498064ab0b,147,Network activity,domain,"webserverdomainhk.com","",1,20200608
5ede974b-c338-4d27-8906-7a498064ab0b,147,Network activity,domain,"onlineloginserviceusa.com","",1,20200608
5ede974b-c358-49be-aa68-7a498064ab0b,147,Network activity,domain,"serverforzapper.com","",1,20200608
5ede974b-c498-4a47-ac99-7a498064ab0b,147,Network activity,domain,"serverformailings.com","",1,20200608
5ede974b-c58c-44a6-9981-7a498064ab0b,147,Network activity,domain,"cathostingservice.com","",1,20200608
5ede974b-ce3c-4b3d-a1cf-7a498064ab0b,147,Network activity,domain,"hostingserviceclean.com","",1,20200608
5ede974b-cf40-41d9-90fb-7a498064ab0b,147,Network activity,domain,"serverforhelphk.com","",1,20200608
5ede974b-d060-40eb-9e73-7a498064ab0b,147,Network activity,domain,"serverdemoservice.com","",1,20200608
5ede974b-d230-4215-839c-7a498064ab0b,147,Network activity,domain,"hostingserviceforall.com","",1,20200608
5ede974b-d254-42f4-8dce-7a498064ab0b,147,Network activity,domain,"anothershortnr.com","",1,20200608
5ede974b-d3ac-4247-822d-7a498064ab0b,147,Network activity,domain,"upgradetravelservice.com","",1,20200608
5ede974b-d554-4553-833a-7a498064ab0b,147,Network activity,domain,"portfoliofasinating.com","",1,20200608
5ede974b-d554-4f2f-a399-7a498064ab0b,147,Network activity,domain,"onlineloginportal.com","",1,20200608
5ede974b-d5b4-4852-907d-7a498064ab0b,147,Network activity,domain,"linuxbasichk1.com","",1,20200608
5ede974b-d620-4c77-b6c0-7a498064ab0b,147,Network activity,domain,"fastserveruk.com","",1,20200608
5ede974b-d710-4c41-89a9-7a498064ab0b,147,Network activity,domain,"serviceforneworder.com","",1,20200608
5ede974b-d768-4621-beeb-7a498064ab0b,147,Network activity,domain,"capitalinvestmentsllp.com","",1,20200608
5ede974b-d928-4ccf-9dfe-7a498064ab0b,147,Network activity,domain,"netsecuremailhosting.com","",1,20200608
5ede974b-da3c-4adb-904b-7a498064ab0b,147,Network activity,domain,"optionaldesigners.com","",1,20200608
5ede974b-dab8-4408-8afd-7a498064ab0b,147,Network activity,domain,"fastserverasia.com","",1,20200608
5ede974b-dc1c-4a27-9d22-7a498064ab0b,147,Network activity,domain,"optionalbloggingeu.com","",1,20200608
5ede974b-dc24-4f46-8aff-7a498064ab0b,147,Network activity,domain,"netgeoserversg.com","",1,20200608
5ede974b-dc28-4fac-bc85-7a498064ab0b,147,Network activity,domain,"baseserveremailbg.com","",1,20200608
5ede974b-dd14-499c-a5c8-7a498064ab0b,147,Network activity,domain,"basicmyoffshore.com","",1,20200608
5ede974b-ddec-496d-90fa-7a498064ab0b,147,Network activity,domain,"domainsfortechhelp.com","",1,20200608
5ede974b-e070-47f5-9941-7a498064ab0b,147,Network activity,domain,"linuxbasicmy.com","",1,20200608
5ede974b-e1a8-480a-85ca-7a498064ab0b,147,Network activity,domain,"readmytipsntricks.com","",1,20200608
5ede974b-e2cc-4736-9799-7a498064ab0b,147,Network activity,domain,"linuxbasichk.com","",1,20200608
5ede974b-e350-4f53-baba-7a498064ab0b,147,Network activity,domain,"assuredreturnplan.com","",1,20200608
5ede974b-e4d8-40c7-bb37-7a498064ab0b,147,Network activity,domain,"sapserverhike.com","",1,20200608
5ede974b-e7d8-4879-aa9c-7a498064ab0b,147,Network activity,domain,"post-manager.com","",1,20200608
5ede974b-e93c-400b-8a1d-7a498064ab0b,147,Network activity,domain,"shortenup.com","",1,20200608
5ede974b-ea70-40df-ab83-7a498064ab0b,147,Network activity,domain,"dnsserverprv.com","",1,20200608
5ede974b-eaf8-406b-ac11-7a498064ab0b,147,Network activity,domain,"secureservereurope.com","",1,20200608
5ede974b-eed4-4938-84d1-7a498064ab0b,147,Network activity,domain,"domainlocalhostingeu.com","",1,20200608
5ede974b-ef18-4011-a98e-7a498064ab0b,147,Network activity,domain,"mailauthservice.com","",1,20200608
5ede974b-efd8-4e35-b441-7a498064ab0b,147,Network activity,domain,"linuxbasicsg.com","",1,20200608
5ede974b-f004-43fc-91f8-7a498064ab0b,147,Network activity,domain,"linkforwrder.com","",1,20200608
5ede974b-f07c-459d-bbfd-7a498064ab0b,147,Network activity,domain,"prwebsiteuk.com","",1,20200608
5ede974b-f100-4344-9990-7a498064ab0b,147,Network activity,domain,"optionsothego.com","",1,20200608
5ede974b-f180-4a01-92f0-7a498064ab0b,147,Network activity,domain,"webserverdomaineu.com","",1,20200608
5ede974b-f24c-4033-934a-7a498064ab0b,147,Network activity,domain,"selectedserviceru.com","",1,20200608
5ede974b-f528-4693-9214-7a498064ab0b,147,Network activity,domain,"shorturlservice.com","",1,20200608
5ede974b-f8ac-4b06-b3e2-7a498064ab0b,147,Network activity,domain,"serverforhelpsg.com","",1,20200608
5ede974b-fc78-4632-bc67-7a498064ab0b,147,Network activity,domain,"transferdomainmy.com","",1,20200608
5ede974b-fdb8-4975-9ea4-7a498064ab0b,147,Network activity,domain,"linuxhostingplatformuk.com","",1,20200608
5ede974b-fe1c-4b88-a1f1-7a498064ab0b,147,Network activity,domain,"linuxbasicru1.com","",1,20200608
5ede974b-ffc0-44b9-8d8e-7a498064ab0b,147,Network activity,domain,"basicservicesg.com","",1,20200608
5ede974b-fff8-4ae5-946a-7a498064ab0b,147,Network activity,domain,"basicsgoffshore.com","",1,20200608
5ede974c-0254-48bb-8890-7a498064ab0b,147,Network activity,domain,"dsrvrer.com","",1,20200608
5ede974c-06e8-4cda-9533-7a498064ab0b,147,Network activity,domain,"ecoserveraus.com","",1,20200608
5ede974c-07ac-483b-97b8-7a498064ab0b,147,Network activity,domain,"minrsrvr.com","",1,20200608
5ede974c-0a28-4f20-a141-7a498064ab0b,147,Network activity,domain,"cyberserverusa.com","",1,20200608
5ede974c-0c50-4fca-ba3b-7a498064ab0b,147,Network activity,domain,"shortserver1.com","",1,20200608
5ede974c-0cfc-4388-816d-7a498064ab0b,147,Network activity,domain,"inrsrvrer.com","",1,20200608
5ede974c-11c4-44d6-8fb5-7a498064ab0b,147,Network activity,domain,"snaphosterservice.com","",1,20200608
5ede974c-15ec-4c50-8e7e-7a498064ab0b,147,Network activity,domain,"com-us-en-us.com","",1,20200608
5ede974c-18c0-4297-9099-7a498064ab0b,147,Network activity,domain,"msrdr.com","",1,20200608
5ede974c-199c-47f6-bb3d-7a498064ab0b,147,Network activity,domain,"sitebloginfo.com","",1,20200608
5ede974c-19e4-4a62-b752-7a498064ab0b,147,Network activity,domain,"transferserver33.com","",1,20200608
5ede974c-1da0-4549-96cc-7a498064ab0b,147,Network activity,domain,"affiliatedomainservice.com","",1,20200608
5ede974c-1f50-44e9-b3a6-7a498064ab0b,147,Network activity,domain,"nrgrsrvrer.com","",1,20200608
5ede974c-2214-4607-80a7-7a498064ab0b,147,Network activity,domain,"budgtoffmy.com","",1,20200608
5ede974c-2518-4f2b-a1c2-7a498064ab0b,147,Network activity,domain,"webmailmanageruk.com","",1,20200608
5ede974c-2e18-429a-be6d-7a498064ab0b,147,Network activity,domain,"com-er-en-us.com","",1,20200608
5ede974c-40e8-417c-892e-7a498064ab0b,147,Network activity,domain,"deferrer.website","",1,20200608
5ede974c-4364-4cc2-a094-7a498064ab0b,147,Network activity,domain,"siteadminhk.com","",1,20200608
5ede974c-450c-4d31-a992-7a498064ab0b,147,Network activity,domain,"zsrvrer.com","",1,20200608
5ede974c-4ac0-4551-a821-7a498064ab0b,147,Network activity,domain,"nigeriaoilleaks.com","",1,20200608
5ede974c-4f78-44e0-b1d4-7a498064ab0b,147,Network activity,domain,"com-biz.website","",1,20200608
5ede974c-571c-406b-835a-7a498064ab0b,147,Network activity,domain,"look-com.org","",1,20200608
5ede974c-5aa4-4e2b-82b2-7a498064ab0b,147,Network activity,domain,"serverforhelpmy.com","",1,20200608
5ede974c-5f3c-4034-8163-7a498064ab0b,147,Network activity,domain,"websitemanagerusa.com","",1,20200608
5ede974c-602c-4aa9-bbb0-7a498064ab0b,147,Network activity,domain,"ondemand.pushthisurl.com","",1,20200608
5ede974c-643c-42d9-bae7-7a498064ab0b,147,Network activity,domain,"ppleid.org","",1,20200608
5ede974c-6654-47da-adb0-7a498064ab0b,147,Network activity,domain,"mail-msrgr.info","",1,20200608
5ede974c-6964-4b95-96e4-7a498064ab0b,147,Network activity,domain,"com-mail-us.com","",1,20200608
5ede974c-6c8c-46e5-b610-7a498064ab0b,147,Network activity,domain,"com-io-en-us.com","",1,20200608
5ede974c-74c4-4434-a43a-7a498064ab0b,147,Network activity,domain,"mrgrhr.com","",1,20200608
5ede974c-7710-4657-9242-7a498064ab0b,147,Network activity,domain,"forumtechtopic.com","",1,20200608
5ede974c-7df4-4194-9704-7a498064ab0b,147,Network activity,domain,"com-oa-en-us.com","",1,20200608
5ede974c-8898-4c9a-8424-7a498064ab0b,147,Network activity,domain,"mgrsr.com","",1,20200608
5ede974c-899c-409f-b5d0-7a498064ab0b,147,Network activity,domain,"com-com-us.com","",1,20200608
5ede974c-8f54-43b7-83ef-7a498064ab0b,147,Network activity,domain,"csrvrer.com","",1,20200608
5ede974c-9774-4c94-9234-7a498064ab0b,147,Network activity,domain,"mnrsrvrer.com","",1,20200608
5ede974c-9ae8-4036-9084-7a498064ab0b,147,Network activity,domain,"serverforhelplux.com","",1,20200608
5ede974c-9d4c-4204-83e2-7a498064ab0b,147,Network activity,domain,"imgsrvrer.com","",1,20200608
5ede974c-9e88-4d0c-8afa-7a498064ab0b,147,Network activity,domain,"com-ar-en-us.com","",1,20200608
5ede974c-a220-4201-9852-7a498064ab0b,147,Network activity,domain,"saferedirect.pw","",1,20200608
5ede974c-a838-47c5-b462-7a498064ab0b,147,Network activity,domain,"interserver439.com","",1,20200608
5ede974c-b21c-4c11-afb7-7a498064ab0b,147,Network activity,domain,"com-hl-en-us.com","",1,20200608
5ede974c-b2f0-4a05-ba80-7a498064ab0b,147,Network activity,domain,"budgtoffru.com","",1,20200608
5ede974c-b35c-450a-93ba-7a498064ab0b,147,Network activity,domain,"chatserverrussia.com","",1,20200608
5ede974c-b700-4dd5-8f65-7a498064ab0b,147,Network activity,domain,"nameserver3476.com","",1,20200608
5ede974c-b734-45bc-ac73-7a498064ab0b,147,Network activity,domain,"secureemailserver65.com","",1,20200608
5ede974c-b878-4327-a297-7a498064ab0b,147,Network activity,domain,"aplsrvrer.com","",1,20200608
5ede974c-be08-4f6d-86b8-7a498064ab0b,147,Network activity,domain,"intrsrvrer.com","",1,20200608
5ede974c-c058-4beb-ba35-7a498064ab0b,147,Network activity,domain,"com-nh-en-us.com","",1,20200608
5ede974c-c684-4c87-9e52-7a498064ab0b,147,Network activity,domain,"mvrsrvrer.com","",1,20200608
5ede974c-c86c-4e8e-bb6f-7a498064ab0b,147,Network activity,domain,"bsrvrer.com","",1,20200608
5ede974c-ce54-4e66-a5fd-7a498064ab0b,147,Network activity,domain,"msrwr.com","",1,20200608
5ede974c-d024-4581-b7dc-7a498064ab0b,147,Network activity,domain,"mail-com.org","",1,20200608
5ede974c-d444-40a9-a6e0-7a498064ab0b,147,Network activity,domain,"xpertdomain.com","",1,20200608
5ede974c-d518-4de6-90a3-7a498064ab0b,147,Network activity,domain,"com-en-us.co.uk","",1,20200608
5ede974c-d6c4-4236-ad25-7a498064ab0b,147,Network activity,domain,"esrvrer.com","",1,20200608
5ede974c-d77c-4cf9-8adc-7a498064ab0b,147,Network activity,domain,"com-mail.net","",1,20200608
5ede974c-d9b0-45f0-892c-7a498064ab0b,147,Network activity,domain,"isrvrer.com","",1,20200608
5ede974c-db3c-441b-afc6-7a498064ab0b,147,Network activity,domain,"siteadmineurope.com","",1,20200608
5ede974c-df18-4891-b6a8-7a498064ab0b,147,Network activity,domain,"websiteadminuk.com","",1,20200608
5ede974c-e6e8-43d0-9760-7a498064ab0b,147,Network activity,domain,"com-com.website","",1,20200608
5ede974c-e82c-404a-9286-7a498064ab0b,147,Network activity,domain,"nameserverredirect.com","",1,20200608
5ede974c-ed3c-4f42-ba2f-7a498064ab0b,147,Network activity,domain,"onlinemusicstoreuk.com","",1,20200608
5ede974c-f224-46ff-b495-7a498064ab0b,147,Network activity,domain,"linuxbasicru3.com","",1,20200608
5ede974c-f404-4140-99d1-7a498064ab0b,147,Network activity,domain,"secureserver9898.com","",1,20200608
5ede97f5-1448-4d36-a35e-7e298064ab0b,147,Payload delivery,email-src,"noreply.mailingservice.3kdj9e9@gmail.com","",0,20200608
5ede97f5-2e0c-42e1-9cdb-7e298064ab0b,147,Payload delivery,email-src,"noreply.notifications.gkejkdgj@gmail.com","",0,20200608
5ede97f5-3820-4868-ad30-7e298064ab0b,147,Payload delivery,email-src,"scorpiobond4@gmail.com","",0,20200608
5ede97f5-409c-44b3-8207-7e298064ab0b,147,Payload delivery,email-src,"no.reply.n0tification.alsdkch@gmail.com","",0,20200608
5ede97f5-4efc-4e42-afa5-7e298064ab0b,147,Payload delivery,email-src,"n0replyupdatesnotificationskj9@gmail.com","",0,20200608
5ede97f5-681c-4f01-9706-7e298064ab0b,147,Payload delivery,email-src,"sophia.1johnson@mail.com","",0,20200608
5ede97f5-6950-4509-9af0-7e298064ab0b,147,Payload delivery,email-src,"n0replyn0tificati0nupdatemail@gmail.com","",0,20200608
5ede97f5-81f8-4221-8637-7e298064ab0b,147,Payload delivery,email-src,"noreplynotification.updates@gmail.com","",0,20200608
5ede97f5-89ec-4587-a2d4-7e298064ab0b,147,Payload delivery,email-src,"n0reply.notificationexsasuve@gmail.com","",0,20200608
5ede97f5-9808-43ba-8d46-7e298064ab0b,147,Payload delivery,email-src,"no.reply.updates.asdfaffgh78jg@gmail.com","",0,20200608
5ede97f5-e864-4084-a3bb-7e298064ab0b,147,Payload delivery,email-src,"noreply.535466586you6585tubadh@gmail.com","",0,20200608
5ede982e-23e4-4191-9863-7a498064ab0b,147,Attribution,whois-registrant-email,"amanda.lovers@mail.com","",0,20200608
5ede982e-3b90-4fc1-95fc-7a498064ab0b,147,Attribution,whois-registrant-email,"anurag.breja342@mail.com","",0,20200608
5ede982e-8298-4b08-9fd4-7a498064ab0b,147,Attribution,whois-registrant-email,"jacktanne@outlook.com","",0,20200608
5ede982e-9c50-4452-9aa5-7a498064ab0b,147,Attribution,whois-registrant-email,"flaviatales@mail.com","",0,20200608
5ede982e-bc48-4231-a1ed-7a498064ab0b,147,Attribution,whois-registrant-email,"amanda.kruetner@mail.com","",0,20200608
5ede982e-c9f4-490e-9afd-7a498064ab0b,147,Attribution,whois-registrant-email,"robert.klein@europe.com","",0,20200608
1 uuid event_id category type value comment to_ids date
2 5ede974a-00d8-4bb1-a02e-7a498064ab0b 147 Network activity domain com-website33.org 1 20200608
3 5ede974a-0118-48e1-8d89-7a498064ab0b 147 Network activity domain srtnr.co 1 20200608
4 5ede974a-014c-453e-b000-7a498064ab0b 147 Network activity domain ecom-servicelogin.com 1 20200608
5 5ede974a-0284-4135-adbb-7a498064ab0b 147 Network activity domain emailserver499.com 1 20200608
6 5ede974a-03f8-4089-9ec3-7a498064ab0b 147 Network activity domain mailhostingsecurenet.com 1 20200608
7 5ede974a-0440-45bf-af15-7a498064ab0b 147 Network activity domain domainblacklistcheck.com 1 20200608
8 5ede974a-0644-4281-87ba-7a498064ab0b 147 Network activity domain corn-en-us.com 1 20200608
9 5ede974a-06d8-4dfd-899b-7a498064ab0b 147 Network activity domain lnkshrtnr.com 1 20200608
10 5ede974a-0968-4995-8b4b-7a498064ab0b 147 Network activity domain 2mblk.com 1 20200608
11 5ede974a-0a08-4a29-a4a3-7a498064ab0b 147 Network activity domain mailtickr.com 1 20200608
12 5ede974a-0ac4-408b-b5e4-7a498064ab0b 147 Network activity domain corn-loginservicesverified.com 1 20200608
13 5ede974a-0c88-45e2-8ab3-7a498064ab0b 147 Network activity domain domainmanager33.website 1 20200608
14 5ede974a-0d58-42d4-8444-7a498064ab0b 147 Network activity domain mailserverenterprise.com 1 20200608
15 5ede974a-0d88-4041-bb35-7a498064ab0b 147 Network activity domain emailseverrus23.com 1 20200608
16 5ede974a-0d88-4db6-8d5d-7a498064ab0b 147 Network activity domain msrvrgh.com 1 20200608
17 5ede974a-0e30-4512-be41-7a498064ab0b 147 Network activity domain mailserver89.org 1 20200608
18 5ede974a-0f94-4924-8a79-7a498064ab0b 147 Network activity domain webserverhollandservice.com 1 20200608
19 5ede974a-124c-417d-a74e-7a498064ab0b 147 Network activity domain webnetonlineservice.com 1 20200608
20 5ede974a-1394-4cd7-b32d-7a498064ab0b 147 Network activity domain ablyazovangels.com 1 20200608
21 5ede974a-1408-409d-98b3-7a498064ab0b 147 Network activity domain mailauthenticatorservice.com 1 20200608
22 5ede974a-155c-49d2-b611-7a498064ab0b 147 Network activity domain redirectonline.xyz 1 20200608
23 5ede974a-15c4-4f56-9c76-7a498064ab0b 147 Network activity domain srtnr.com 1 20200608
24 5ede974a-1770-4e23-b405-7a498064ab0b 147 Network activity domain webmasterserver39.com 1 20200608
25 5ede974a-1bd0-42d0-bdd1-7a498064ab0b 147 Network activity domain webserver91.website 1 20200608
26 5ede974a-1c10-41e3-a906-7a498064ab0b 147 Network activity domain mailserverru2099.com 1 20200608
27 5ede974a-1e90-4e26-9a90-7a498064ab0b 147 Network activity domain phpwebserver34.tech 1 20200608
28 5ede974a-1eb8-428d-b36b-7a498064ab0b 147 Network activity domain short-ner.com 1 20200608
29 5ede974a-1f64-4635-a8e9-7a498064ab0b 147 Network activity domain comservicelogin.com 1 20200608
30 5ede974a-1fac-46a2-9be7-7a498064ab0b 147 Network activity domain corn-lang-eng.com 1 20200608
31 5ede974a-2038-46e4-9331-7a498064ab0b 147 Network activity domain mailserveruk.com 1 20200608
32 5ede974a-2178-458e-a517-7a498064ab0b 147 Network activity domain hostmailsecureserver.com 1 20200608
33 5ede974a-2198-4e07-b618-7a498064ab0b 147 Network activity domain netcomserviceonline.com 1 20200608
34 5ede974a-26c0-48ae-be69-7a498064ab0b 147 Network activity domain strurl.click 1 20200608
35 5ede974a-28b0-4f26-b8ed-7a498064ab0b 147 Network activity domain extranetserviceonline.com 1 20200608
36 5ede974a-2b90-4d94-aa1a-7a498064ab0b 147 Network activity domain domainserver322.com 1 20200608
37 5ede974a-31a0-49cb-b011-7a498064ab0b 147 Network activity domain allaboutiot.website 1 20200608
38 5ede974a-322c-450d-ad4a-7a498064ab0b 147 Network activity domain serverforshort.com 1 20200608
39 5ede974a-33a0-4ca5-8ef5-7a498064ab0b 147 Network activity domain mailcommunicationservice.com 1 20200608
40 5ede974a-3484-42bd-ad35-7a498064ab0b 147 Network activity domain hostemailserver.com 1 20200608
41 5ede974a-376c-4b9f-92c5-7a498064ab0b 147 Network activity domain servergateway56.com 1 20200608
42 5ede974a-3a84-4dc8-9919-7a498064ab0b 147 Network activity domain msrvrgeh.com 1 20200608
43 5ede974a-3aa4-42eb-9d3d-7a498064ab0b 147 Network activity domain shrtnerlnk.com 1 20200608
44 5ede974a-3bf4-44f6-b012-7a498064ab0b 147 Network activity domain com-website33.com 1 20200608
45 5ede974a-3f64-4f6e-849d-7a498064ab0b 147 Network activity domain nodeserver50.com 1 20200608
46 5ede974a-40d0-4407-8e21-7a498064ab0b 147 Network activity domain mailserver89.com 1 20200608
47 5ede974a-4134-4408-bffb-7a498064ab0b 147 Network activity domain ablyazovcog.com 1 20200608
48 5ede974a-4514-446e-b980-7a498064ab0b 147 Network activity domain servermain43.com 1 20200608
49 5ede974a-4744-4707-8722-7a498064ab0b 147 Network activity domain servermailing34.com 1 20200608
50 5ede974a-4a18-483e-889b-7a498064ab0b 147 Network activity domain newserver39.com 1 20200608
51 5ede974a-4a5c-467a-93ee-7a498064ab0b 147 Network activity domain serversap54.com 1 20200608
52 5ede974a-4c68-4da6-9f19-7a498064ab0b 147 Network activity domain emailvalidateservice.com 1 20200608
53 5ede974a-4eb0-4f7b-acd7-7a498064ab0b 147 Network activity domain corn-servicelogin.com 1 20200608
54 5ede974a-50e0-4cc7-8527-7a498064ab0b 147 Network activity domain mailserveruk89.org 1 20200608
55 5ede974a-515c-4ed2-b281-7a498064ab0b 147 Network activity domain domainmanager33.com 1 20200608
56 5ede974a-51b4-470b-8bc8-7a498064ab0b 147 Network activity domain rockerhostings.com 1 20200608
57 5ede974a-525c-4396-ba4d-7a498064ab0b 147 Network activity domain servermappingserviceonline.com 1 20200608
58 5ede974a-54c4-40da-ab7f-7a498064ab0b 147 Network activity domain mailservershare.com 1 20200608
59 5ede974a-5594-49f9-9ea6-7a498064ab0b 147 Network activity domain euanticorruption.com 1 20200608
60 5ede974a-55b4-4f05-bb4a-7a498064ab0b 147 Network activity domain mailmarknotes.com 1 20200608
61 5ede974a-563c-4c15-ba60-7a498064ab0b 147 Network activity domain corn-msrvrgr.com 1 20200608
62 5ede974a-5ab4-4cec-8481-7a498064ab0b 147 Network activity domain netsecureemailservice.com 1 20200608
63 5ede974a-5dd8-4f6b-831e-7a498064ab0b 147 Network activity domain emailhostsecurehk.com 1 20200608
64 5ede974a-5f68-40d7-83ee-7a498064ab0b 147 Network activity domain corn-en-gb.com 1 20200608
65 5ede974a-6238-4970-a66e-7a498064ab0b 147 Network activity domain hostsecuremail544.com 1 20200608
66 5ede974a-624c-4728-b4e2-7a498064ab0b 147 Network activity domain shadymario.com 1 20200608
67 5ede974a-6360-4a3a-ada0-7a498064ab0b 147 Network activity domain ablyazovmafia.com 1 20200608
68 5ede974a-63d0-44ec-8fa7-7a498064ab0b 147 Network activity domain maildeliveryagent.com 1 20200608
69 5ede974a-63fc-491f-b39b-7a498064ab0b 147 Network activity domain getemailopens.com 1 20200608
70 5ede974a-650c-4b2f-9da1-7a498064ab0b 147 Network activity domain netsecureserver399.com 1 20200608
71 5ede974a-6764-490c-b5a6-7a498064ab0b 147 Network activity domain linkshortnr.com 1 20200608
72 5ede974a-6918-4c89-bc38-7a498064ab0b 147 Network activity domain pageserverru.com 1 20200608
73 5ede974a-6b38-4858-9427-7a498064ab0b 147 Network activity domain domainmanager33.site 1 20200608
74 5ede974a-6b68-4e98-ac7d-7a498064ab0b 147 Network activity domain mailerdomain56.com 1 20200608
75 5ede974a-6d40-4201-8e7b-7a498064ab0b 147 Network activity domain emailhostholland.com 1 20200608
76 5ede974a-6ff4-4891-9efc-7a498064ab0b 147 Network activity domain domainserver399.com 1 20200608
77 5ede974a-72fc-4068-b954-7a498064ab0b 147 Network activity domain sapserverhipe.com 1 20200608
78 5ede974a-7358-473b-9cfd-7a498064ab0b 147 Network activity domain imapserverholland.com 1 20200608
79 5ede974a-74cc-423f-a7af-7a498064ab0b 147 Network activity domain cyberanalyticals.com 1 20200608
80 5ede974a-7628-40c5-86c9-7a498064ab0b 147 Network activity domain santanaservice.com 1 20200608
81 5ede974a-7680-41d3-bc19-7a498064ab0b 147 Network activity domain softnetworksolutions.com 1 20200608
82 5ede974a-77a8-419e-8feb-7a498064ab0b 147 Network activity domain mailcollectorservice.com 1 20200608
83 5ede974a-7aa0-48bf-ad8b-7a498064ab0b 147 Network activity domain mailrockservice.com 1 20200608
84 5ede974a-7b58-47aa-9a92-7a498064ab0b 147 Network activity domain mblk1.com 1 20200608
85 5ede974a-7ca0-4ba3-8d25-7a498064ab0b 147 Network activity domain mailmarkservice.com 1 20200608
86 5ede974a-7cc8-4a6d-ac95-7a498064ab0b 147 Network activity domain phpwebserver34.xyz 1 20200608
87 5ede974a-7ff4-4f69-890c-7a498064ab0b 147 Network activity domain basemailservice.com 1 20200608
88 5ede974a-8024-4293-b1ec-7a498064ab0b 147 Network activity domain domainsserver4f.com 1 20200608
89 5ede974a-81ec-4128-9036-7a498064ab0b 147 Network activity domain ablyazovgang.com 1 20200608
90 5ede974a-8504-4659-bfd7-7a498064ab0b 147 Network activity domain webserverredirect99.com 1 20200608
91 5ede974a-8b1c-4ee5-94be-7a498064ab0b 147 Network activity domain smtpserver389.com 1 20200608
92 5ede974a-8c14-48ff-aa3c-7a498064ab0b 147 Network activity domain pageserver77.com 1 20200608
93 5ede974a-8e70-479d-9aab-7a498064ab0b 147 Network activity domain com-website33.biz 1 20200608
94 5ede974a-8ec4-4b0a-9792-7a498064ab0b 147 Network activity domain corn-fr-fr.com 1 20200608
95 5ede974a-8ed4-4367-9b88-7a498064ab0b 147 Network activity domain corn-ukr.com 1 20200608
96 5ede974a-8fb8-4691-9e50-7a498064ab0b 147 Network activity domain shortformurl.com 1 20200608
97 5ede974a-90dc-40ea-9a33-7a498064ab0b 147 Network activity domain checkmailserverhk.com 1 20200608
98 5ede974a-90f0-4667-8747-7a498064ab0b 147 Network activity domain securemailhost46.com 1 20200608
99 5ede974a-91e4-4488-bb36-7a498064ab0b 147 Network activity domain linksrtnr.com 1 20200608
100 5ede974a-92e4-4d8e-a145-7a498064ab0b 147 Network activity domain domainemailhostings.com 1 20200608
101 5ede974a-930c-472e-a915-7a498064ab0b 147 Network activity domain ablyazovorganisedcrime.com 1 20200608
102 5ede974a-9570-481d-b627-7a498064ab0b 147 Network activity domain hostemailsecureserver.com 1 20200608
103 5ede974a-9658-41ca-8e4e-7a498064ab0b 147 Network activity domain hostmailsecure.com 1 20200608
104 5ede974a-969c-4f41-9b29-7a498064ab0b 147 Network activity domain ablyazovcrimestory.com 1 20200608
105 5ede974a-96bc-4de2-9a3f-7a498064ab0b 147 Network activity domain maillinkservice.com 1 20200608
106 5ede974a-9798-4cb1-ade2-7a498064ab0b 147 Network activity domain hbh-europe-ripoff-report.com 1 20200608
107 5ede974a-9900-4bde-bd24-7a498064ab0b 147 Network activity domain onlinenetworkinghelp.com 1 20200608
108 5ede974a-9908-4265-9d9c-7a498064ab0b 147 Network activity domain hostsecuremail.com 1 20200608
109 5ede974a-9de4-416e-82c6-7a498064ab0b 147 Network activity domain emaildeliverysuccess.com 1 20200608
110 5ede974a-a360-40c5-bf27-7a498064ab0b 147 Network activity domain serverhello54.com 1 20200608
111 5ede974a-a3b4-4400-8ce4-7a498064ab0b 147 Network activity domain postserviceemaildomain.com 1 20200608
112 5ede974a-a3b8-455c-ab4c-7a498064ab0b 147 Network activity domain mailapiservice.com 1 20200608
113 5ede974a-a478-4713-a96a-7a498064ab0b 147 Network activity domain shortlinkcut.com 1 20200608
114 5ede974a-a4a0-4395-876d-7a498064ab0b 147 Network activity domain smtpserver466.com 1 20200608
115 5ede974a-a4f8-4564-83d2-7a498064ab0b 147 Network activity domain webredirect39.com 1 20200608
116 5ede974a-abc4-47f7-8141-7a498064ab0b 147 Network activity domain emailsecurenode.com 1 20200608
117 5ede974a-af7c-4f6b-9404-7a498064ab0b 147 Network activity domain websociofiles.com 1 20200608
118 5ede974a-afd0-4e7b-a76d-7a498064ab0b 147 Network activity domain hkdrillonline.com 1 20200608
119 5ede974a-affc-4a69-ba79-7a498064ab0b 147 Network activity domain searchsimple.net 1 20200608
120 5ede974a-b078-4d6f-b0ba-7a498064ab0b 147 Network activity domain emailservername299.com 1 20200608
121 5ede974a-b100-401e-bc99-7a498064ab0b 147 Network activity domain shortformurl.xyz 1 20200608
122 5ede974a-b18c-4072-87f0-7a498064ab0b 147 Network activity domain loginauths-service.com 1 20200608
123 5ede974a-b358-4799-b811-7a498064ab0b 147 Network activity domain webserveronline9.com 1 20200608
124 5ede974a-b478-4eef-87bf-7a498064ab0b 147 Network activity domain hathwaynetwork.com 1 20200608
125 5ede974a-b634-4bd2-964f-7a498064ab0b 147 Network activity domain ablyazovcriminals.com 1 20200608
126 5ede974a-b64c-41fd-8fed-7a498064ab0b 147 Network activity domain com-website33.info 1 20200608
127 5ede974a-b704-4f9a-bac6-7a498064ab0b 147 Network activity domain mailserver89.net 1 20200608
128 5ede974a-b778-4722-af3a-7a498064ab0b 147 Network activity domain softredirect.info 1 20200608
129 5ede974a-b984-4338-b5aa-7a498064ab0b 147 Network activity domain emailmappingservice.com 1 20200608
130 5ede974a-ba64-44ff-aa99-7a498064ab0b 147 Network activity domain logserver39.com 1 20200608
131 5ede974a-ba84-4d86-8998-7a498064ab0b 147 Network activity domain networkshareserver.com 1 20200608
132 5ede974a-bc48-433f-ba2f-7a498064ab0b 147 Network activity domain loginservercheck.com 1 20200608
133 5ede974a-c1d4-4fb9-9ac9-7a498064ab0b 147 Network activity domain ultronnetworksolution.com 1 20200608
134 5ede974a-c230-41f6-9a49-7a498064ab0b 147 Network activity domain mail-logger.com 1 20200608
135 5ede974a-c258-4537-9381-7a498064ab0b 147 Network activity domain loginserviceunified.com 1 20200608
136 5ede974a-c3e8-4f50-863c-7a498064ab0b 147 Network activity domain homeserver87.com 1 20200608
137 5ede974a-c774-403d-88f0-7a498064ab0b 147 Network activity domain mailannounceservice.com 1 20200608
138 5ede974a-c7dc-42df-859a-7a498064ab0b 147 Network activity domain linkshrtnr22.com 1 20200608
139 5ede974a-caac-4790-9459-7a498064ab0b 147 Network activity domain emailserverholland.com 1 20200608
140 5ede974a-cdf8-44a2-948a-7a498064ab0b 147 Network activity domain mailsecurehost.com 1 20200608
141 5ede974a-d034-4204-95bd-7a498064ab0b 147 Network activity domain phpwebserver34.best 1 20200608
142 5ede974a-d2a4-4362-80d4-7a498064ab0b 147 Network activity domain mailserveruk89.net 1 20200608
143 5ede974a-d2e0-4497-ba46-7a498064ab0b 147 Network activity domain msrfrgr.com 1 20200608
144 5ede974a-d330-4e5c-a1e1-7a498064ab0b 147 Network activity domain webserver39.com 1 20200608
145 5ede974a-d6fc-4d48-8374-7a498064ab0b 147 Network activity domain mailtransferserver.com 1 20200608
146 5ede974a-d980-4714-a8f9-7a498064ab0b 147 Network activity domain com-website33.net 1 20200608
147 5ede974a-dabc-4879-9bd0-7a498064ab0b 147 Network activity domain mailer-domain.com 1 20200608
148 5ede974a-dac8-48f3-b108-7a498064ab0b 147 Network activity domain servergateway33.com 1 20200608
149 5ede974a-dae4-45a9-9694-7a498064ab0b 147 Network activity domain browserextensions.info 1 20200608
150 5ede974a-dcdc-4da8-a2f7-7a498064ab0b 147 Network activity domain goomail.ml 1 20200608
151 5ede974a-ddd8-474a-bf5e-7a498064ab0b 147 Network activity domain mailserveruk89.com 1 20200608
152 5ede974a-deb8-4412-95d1-7a498064ab0b 147 Network activity domain postmarkapiservice.com 1 20200608
153 5ede974a-df3c-4741-afa8-7a498064ab0b 147 Network activity domain mailauthservice399.com 1 20200608
154 5ede974a-e18c-467e-a40b-7a498064ab0b 147 Network activity domain phpwebserver34.site 1 20200608
155 5ede974a-e3dc-4e89-afab-7a498064ab0b 147 Network activity domain mailchimpservice.com 1 20200608
156 5ede974a-e538-4957-a77a-7a498064ab0b 147 Network activity domain pageserver299.com 1 20200608
157 5ede974a-e694-4282-9f6a-7a498064ab0b 147 Network activity domain webhostwebcare.com 1 20200608
158 5ede974a-e7e8-4cc0-ba44-7a498064ab0b 147 Network activity domain netmapservice.com 1 20200608
159 5ede974a-e8f0-402b-8d49-7a498064ab0b 147 Network activity domain mywebredirect.info 1 20200608
160 5ede974a-e8f0-4210-a5a8-7a498064ab0b 147 Network activity domain sapserver39j.com 1 20200608
161 5ede974a-eb54-4f98-8f5d-7a498064ab0b 147 Network activity domain mailgatorservice.com 1 20200608
162 5ede974a-ec28-413e-ac2c-7a498064ab0b 147 Network activity domain 4mblk.com 1 20200608
163 5ede974a-eccc-432c-9ad7-7a498064ab0b 147 Network activity domain myfacetik.cf 1 20200608
164 5ede974a-ed04-4563-b839-7a498064ab0b 147 Network activity domain ablyazovcriminalgang.com 1 20200608
165 5ede974a-ed18-48ee-a223-7a498064ab0b 147 Network activity domain mailingserver938.com 1 20200608
166 5ede974a-f0c4-4628-a01d-7a498064ab0b 147 Network activity domain openserverholland.com 1 20200608
167 5ede974a-f210-4037-8741-7a498064ab0b 147 Network activity domain emailserverhk48.com 1 20200608
168 5ede974a-f598-4c2e-b774-7a498064ab0b 147 Network activity domain emailauthservice.com 1 20200608
169 5ede974a-f87c-402a-9b1a-7a498064ab0b 147 Network activity domain rackserver39.com 1 20200608
170 5ede974a-f934-4a99-9c8f-7a498064ab0b 147 Network activity domain un-told.net 1 20200608
171 5ede974a-fb04-40f9-aeff-7a498064ab0b 147 Network activity domain ablyazovcrimesyndicate.com 1 20200608
172 5ede974a-fb80-49d4-912d-7a498064ab0b 147 Network activity domain searchsimple.info 1 20200608
173 5ede974a-fc84-4a5c-a9b1-7a498064ab0b 147 Network activity domain mailpostsecure.com 1 20200608
174 5ede974a-fdd8-48f5-aede-7a498064ab0b 147 Network activity domain emailserver399.com 1 20200608
175 5ede974a-ffa4-4456-8d11-7a498064ab0b 147 Network activity domain mailpostsecureservice.com 1 20200608
176 5ede974b-0010-4ce9-aede-7a498064ab0b 147 Network activity domain ultimateresponseservice.com 1 20200608
177 5ede974b-0180-4724-9fc2-7a498064ab0b 147 Network activity domain shortnerserviceonline.com 1 20200608
178 5ede974b-0394-493e-92cc-7a498064ab0b 147 Network activity domain hostbasicsg.com 1 20200608
179 5ede974b-0394-4fcb-ab1d-7a498064ab0b 147 Network activity domain loginservicesmailsonlinesaccounts.com 1 20200608
180 5ede974b-048c-4ae5-900c-7a498064ab0b 147 Network activity domain sapserverhg.com 1 20200608
181 5ede974b-076c-40b4-acd9-7a498064ab0b 147 Network activity domain demoprojectsuk.com 1 20200608
182 5ede974b-1050-4a49-a531-7a498064ab0b 147 Network activity domain selectedservicesg.com 1 20200608
183 5ede974b-1060-4d92-a2c9-7a498064ab0b 147 Network activity domain mailsecureservers.com 1 20200608
184 5ede974b-1134-4ece-8e78-7a498064ab0b 147 Network activity domain javaservermy.com 1 20200608
185 5ede974b-11b8-463d-8aee-7a498064ab0b 147 Network activity domain selectedmaxstores.com 1 20200608
186 5ede974b-12b8-478f-9a4a-7a498064ab0b 147 Network activity domain browserdirectservice.com 1 20200608
187 5ede974b-133c-435b-a17d-7a498064ab0b 147 Network activity domain trustedserviceonline.com 1 20200608
188 5ede974b-138c-440a-9b4f-7a498064ab0b 147 Network activity domain affliatedomainservice.com 1 20200608
189 5ede974b-1390-41f2-9eef-7a498064ab0b 147 Network activity domain registrationonlineeurope.com 1 20200608
190 5ede974b-1518-4800-9a25-7a498064ab0b 147 Network activity domain mylinbas.com 1 20200608
191 5ede974b-1584-4172-9242-7a498064ab0b 147 Network activity domain anitmationworldnews.com 1 20200608
192 5ede974b-15f0-4ebc-818d-7a498064ab0b 147 Network activity domain backwaterreservoir.com 1 20200608
193 5ede974b-1900-4c7a-9a95-7a498064ab0b 147 Network activity domain serverloadbalance.com 1 20200608
194 5ede974b-1bf8-4a3a-a1a1-7a498064ab0b 147 Network activity domain hiretechservicehg.com 1 20200608
195 5ede974b-1d98-411f-854f-7a498064ab0b 147 Network activity domain mailserveroutlook.com 1 20200608
196 5ede974b-1e04-4f54-9d73-7a498064ab0b 147 Network activity domain hostfeasta.com 1 20200608
197 5ede974b-1fd0-4c51-aaa5-7a498064ab0b 147 Network activity domain postserverem.com 1 20200608
198 5ede974b-214c-4a18-84c3-7a498064ab0b 147 Network activity domain selectiveservicemax.com 1 20200608
199 5ede974b-226c-4b68-9093-7a498064ab0b 147 Network activity domain linuxbasicsg1.com 1 20200608
200 5ede974b-22b8-40e6-afe3-7a498064ab0b 147 Network activity domain mailcommute.com 1 20200608
201 5ede974b-25e4-459a-9744-7a498064ab0b 147 Network activity domain onlineloginportalsg.com 1 20200608
202 5ede974b-26c8-401d-afe0-7a498064ab0b 147 Network activity domain basichostingrussia.com 1 20200608
203 5ede974b-27cc-4146-b861-7a498064ab0b 147 Network activity domain optionalblogging.com 1 20200608
204 5ede974b-292c-4c75-9e27-7a498064ab0b 147 Network activity domain mailserviceloginonline.com 1 20200608
205 5ede974b-2930-48c9-b7ec-7a498064ab0b 147 Network activity domain internetmarketingservicehg.com 1 20200608
206 5ede974b-2a10-40d2-ad2d-7a498064ab0b 147 Network activity domain hostbasicru.com 1 20200608
207 5ede974b-2c70-49dc-9b5e-7a498064ab0b 147 Network activity domain bellsouthnetwork.com 1 20200608
208 5ede974b-2d00-4dc6-8bb2-7a498064ab0b 147 Network activity domain domainhostworkeu.com 1 20200608
209 5ede974b-2e14-46ca-84d1-7a498064ab0b 147 Network activity domain onlineloginportalhk.com 1 20200608
210 5ede974b-3010-4cee-95ae-7a498064ab0b 147 Network activity domain secureserverasia.com 1 20200608
211 5ede974b-3028-4600-82af-7a498064ab0b 147 Network activity domain fastserverusa.com 1 20200608
212 5ede974b-3108-4ce1-b76a-7a498064ab0b 147 Network activity domain usewithcareathome.com 1 20200608
213 5ede974b-3340-45f1-915d-7a498064ab0b 147 Network activity domain buzzoffru.com 1 20200608
214 5ede974b-3340-4c3f-bf88-7a498064ab0b 147 Network activity domain webserver39490.com 1 20200608
215 5ede974b-34c0-47a6-9887-7a498064ab0b 147 Network activity domain buzzoffsg.com 1 20200608
216 5ede974b-3538-441f-8489-7a498064ab0b 147 Network activity domain shipnyatchholland.com 1 20200608
217 5ede974b-3584-4b12-925f-7a498064ab0b 147 Network activity domain standardofficeholland.com 1 20200608
218 5ede974b-3594-4998-b9e1-7a498064ab0b 147 Network activity domain domainlocalhostinghk.com 1 20200608
219 5ede974b-3634-4a5f-b63d-7a498064ab0b 147 Network activity domain watchmanservice.com 1 20200608
220 5ede974b-3690-4c15-99b4-7a498064ab0b 147 Network activity domain linuxbasicru.com 1 20200608
221 5ede974b-3794-4593-8994-7a498064ab0b 147 Network activity domain domainsforsupport.com 1 20200608
222 5ede974b-3930-4de3-8ded-7a498064ab0b 147 Network activity domain offshoretoursntravels.com 1 20200608
223 5ede974b-3b48-441b-9258-7a498064ab0b 147 Network activity domain chromeperfection.com 1 20200608
224 5ede974b-3b88-4b23-9f2f-7a498064ab0b 147 Network activity domain hostserverrus.com 1 20200608
225 5ede974b-3bf0-48e4-b015-7a498064ab0b 147 Network activity domain loginservicebasic.com 1 20200608
226 5ede974b-3c58-49a5-91d9-7a498064ab0b 147 Network activity domain frwrdrwr.com 1 20200608
227 5ede974b-3fd0-4d16-94f7-7a498064ab0b 147 Network activity domain hostbasicholl.com 1 20200608
228 5ede974b-4078-4c94-97f9-7a498064ab0b 147 Network activity domain planyourexoticvacation.com 1 20200608
229 5ede974b-40c4-4a93-96e4-7a498064ab0b 147 Network activity domain shrinkthisurl.com 1 20200608
230 5ede974b-4178-428d-9a89-7a498064ab0b 147 Network activity domain basichostnetservice.com 1 20200608
231 5ede974b-44dc-476e-999f-7a498064ab0b 147 Network activity domain domainlocalhostinguk.com 1 20200608
232 5ede974b-4578-4f21-b8e0-7a498064ab0b 147 Network activity domain ruslinbas.com 1 20200608
233 5ede974b-4690-4211-b94f-7a498064ab0b 147 Network activity domain updatenameserver45.com 1 20200608
234 5ede974b-4868-4ba6-9d46-7a498064ab0b 147 Network activity domain buzzoffmy.com 1 20200608
235 5ede974b-48ac-49f7-aa25-7a498064ab0b 147 Network activity domain webserveroginusa.com 1 20200608
236 5ede974b-4918-4acf-8bc2-7a498064ab0b 147 Network activity domain getreadytorunhalfmarathon.com 1 20200608
237 5ede974b-49a4-4739-aceb-7a498064ab0b 147 Network activity domain domainexpertswebuk.com 1 20200608
238 5ede974b-4aac-4dc1-874c-7a498064ab0b 147 Network activity domain luxlinbas.com 1 20200608
239 5ede974b-4c1c-4135-96a3-7a498064ab0b 147 Network activity domain auditionregistrationonline.com 1 20200608
240 5ede974b-4c7c-4ff7-84df-7a498064ab0b 147 Network activity domain strngbltru.com 1 20200608
241 5ede974b-4cfc-4fb4-8b9b-7a498064ab0b 147 Network activity domain hollandtourandtravel.com 1 20200608
242 5ede974b-4de0-4c57-9268-7a498064ab0b 147 Network activity domain domainhostnetworkusa.com 1 20200608
243 5ede974b-4e40-4bc5-8730-7a498064ab0b 147 Network activity domain homeforallorphans.com 1 20200608
244 5ede974b-51d4-4035-8752-7a498064ab0b 147 Network activity domain serverforhome.com 1 20200608
245 5ede974b-51e8-4732-bf38-7a498064ab0b 147 Network activity domain productdemoservice.com 1 20200608
246 5ede974b-5228-4bc7-ac4a-7a498064ab0b 147 Network activity domain exchangeserverformailing.com 1 20200608
247 5ede974b-53d4-4528-b91f-7a498064ab0b 147 Network activity domain dotnerserversg.com 1 20200608
248 5ede974b-5454-4b4d-aa33-7a498064ab0b 147 Network activity domain hostbasichk.com 1 20200608
249 5ede974b-54c4-4074-9a98-7a498064ab0b 147 Network activity domain redirectserviceonline.com 1 20200608
250 5ede974b-56b4-4798-85da-7a498064ab0b 147 Network activity domain standardofficeuk.com 1 20200608
251 5ede974b-56c4-4a2a-8774-7a498064ab0b 147 Network activity domain shoponlinefreeuk.com 1 20200608
252 5ede974b-5740-4f87-978e-7a498064ab0b 147 Network activity domain tnyurlservice.com 1 20200608
253 5ede974b-583c-4616-a682-7a498064ab0b 147 Network activity domain netsecurehostingmy.com 1 20200608
254 5ede974b-5af4-43e2-afa4-7a498064ab0b 147 Network activity domain personaldoaminru.com 1 20200608
255 5ede974b-5cec-4d36-9d48-7a498064ab0b 147 Network activity domain loginservicehelp.com 1 20200608
256 5ede974b-5cf0-4e14-9200-7a498064ab0b 147 Network activity domain youranotherserver.com 1 20200608
257 5ede974b-5cf4-43bc-9d02-7a498064ab0b 147 Network activity domain shrinkandshareurl.com 1 20200608
258 5ede974b-5e04-4a75-8dde-7a498064ab0b 147 Network activity domain domainformailinguk.com 1 20200608
259 5ede974b-5ebc-4cef-b91d-7a498064ab0b 147 Network activity domain serverfortechies.com 1 20200608
260 5ede974b-5ebc-4d75-a571-7a498064ab0b 147 Network activity domain exchangeserver2345.com 1 20200608
261 5ede974b-5f40-4848-a111-7a498064ab0b 147 Network activity domain hostusewithtech.com 1 20200608
262 5ede974b-5f4c-49d8-b403-7a498064ab0b 147 Network activity domain optionalblogginguk.com 1 20200608
263 5ede974b-5fa0-4bc1-82c4-7a498064ab0b 147 Network activity domain domainsforfreehosting.com 1 20200608
264 5ede974b-6098-4415-bf1e-7a498064ab0b 147 Network activity domain transferdomainhk.com 1 20200608
265 5ede974b-61ac-49a6-8ce9-7a498064ab0b 147 Network activity domain basicservicemy.com 1 20200608
266 5ede974b-646c-46fa-b45a-7a498064ab0b 147 Network activity domain onlineloginserviceeu.com 1 20200608
267 5ede974b-6930-47e1-ad77-7a498064ab0b 147 Network activity domain supportserviceeu.com 1 20200608
268 5ede974b-693c-4ffc-97a6-7a498064ab0b 147 Network activity domain blogserverlx.com 1 20200608
269 5ede974b-69a0-414f-9baa-7a498064ab0b 147 Network activity domain browserredirect.com 1 20200608
270 5ede974b-6b04-446d-83a0-7a498064ab0b 147 Network activity domain localserversa.com 1 20200608
271 5ede974b-6b64-457f-86c4-7a498064ab0b 147 Network activity domain tricktravelbooking.com 1 20200608
272 5ede974b-6c6c-4931-8c5a-7a498064ab0b 147 Network activity domain trackserviceonline.xyz 1 20200608
273 5ede974b-6d20-4054-87fc-7a498064ab0b 147 Network activity domain racksackserveruk.com 1 20200608
274 5ede974b-6e00-4107-b39f-7a498064ab0b 147 Network activity domain websecurehostings.com 1 20200608
275 5ede974b-6ee8-4b70-acdc-7a498064ab0b 147 Network activity domain onlineloginserviceuk.com 1 20200608
276 5ede974b-6ee8-4c07-a877-7a498064ab0b 147 Network activity domain strongwingtechnologies.com 1 20200608
277 5ede974b-7154-4e65-8649-7a498064ab0b 147 Network activity domain transferdomainlu.com 1 20200608
278 5ede974b-7244-43e1-92cc-7a498064ab0b 147 Network activity domain domainhostnetworkuk.com 1 20200608
279 5ede974b-7348-4b92-8293-7a498064ab0b 147 Network activity domain bitserverhk.com 1 20200608
280 5ede974b-7354-4483-95e8-7a498064ab0b 147 Network activity domain mailauthorizationservice.com 1 20200608
281 5ede974b-73d8-4115-838f-7a498064ab0b 147 Network activity domain tinyurlshortner.com 1 20200608
282 5ede974b-748c-44c9-aef9-7a498064ab0b 147 Network activity domain basicservicehk.com 1 20200608
283 5ede974b-7674-4e17-9971-7a498064ab0b 147 Network activity domain dotnetserverhk.com 1 20200608
284 5ede974b-7680-4679-b122-7a498064ab0b 147 Network activity domain serviceasneed.com 1 20200608
285 5ede974b-792c-42eb-b93e-7a498064ab0b 147 Network activity domain economyfeeds.com 1 20200608
286 5ede974b-7b90-41ef-9af5-7a498064ab0b 147 Network activity domain msgrdrg.com 1 20200608
287 5ede974b-7d38-4846-9698-7a498064ab0b 147 Network activity domain tineeurl.com 1 20200608
288 5ede974b-7e20-49ed-aa14-7a498064ab0b 147 Network activity domain buzzoffhk.com 1 20200608
289 5ede974b-7edc-4057-baba-7a498064ab0b 147 Network activity domain webserverdomainusa.com 1 20200608
290 5ede974b-7edc-4931-a120-7a498064ab0b 147 Network activity domain hongkongshippingcompany.com 1 20200608
291 5ede974b-8008-4c91-a16b-7a498064ab0b 147 Network activity domain localhostinguk.com 1 20200608
292 5ede974b-806c-42c6-b2f9-7a498064ab0b 147 Network activity domain serverasiasap.com 1 20200608
293 5ede974b-829c-454d-bd75-7a498064ab0b 147 Network activity domain shortenurlservices.com 1 20200608
294 5ede974b-82f0-4cf1-aa52-7a498064ab0b 147 Network activity domain basicservicelux.com 1 20200608
295 5ede974b-83c0-4085-9855-7a498064ab0b 147 Network activity domain mailserverdirect3994.com 1 20200608
296 5ede974b-844c-45a5-8ab8-7a498064ab0b 147 Network activity domain fastservereurope.com 1 20200608
297 5ede974b-85c0-4aa0-9d28-7a498064ab0b 147 Network activity domain serverforhelpru.com 1 20200608
298 5ede974b-863c-4ea3-bc83-7a498064ab0b 147 Network activity domain optionalblogginges.com 1 20200608
299 5ede974b-8704-4ba7-b7b8-7a498064ab0b 147 Network activity domain economyservicesil.com 1 20200608
300 5ede974b-87e4-4558-a61a-7a498064ab0b 147 Network activity domain basicservicerus.com 1 20200608
301 5ede974b-8810-46a1-b086-7a498064ab0b 147 Network activity domain russialinuxbasic.com 1 20200608
302 5ede974b-885c-427b-9a04-7a498064ab0b 147 Network activity domain hardcoretechnologiesllp.com 1 20200608
303 5ede974b-886c-4f69-b4d5-7a498064ab0b 147 Network activity domain homeremedytipntricks.com 1 20200608
304 5ede974b-898c-4a02-9d5c-7a498064ab0b 147 Network activity domain mailserver39.com 1 20200608
305 5ede974b-8b3c-4a51-bc70-7a498064ab0b 147 Network activity domain trusteventservices.com 1 20200608
306 5ede974b-8bac-43ad-88c1-7a498064ab0b 147 Network activity domain emailbaseserverhl.com 1 20200608
307 5ede974b-8c64-4036-b55a-7a498064ab0b 147 Network activity domain servicegoingfar.com 1 20200608
308 5ede974b-8ccc-4d1c-96fd-7a498064ab0b 147 Network activity domain selectedservicemy.com 1 20200608
309 5ede974b-8d54-4966-b6ce-7a498064ab0b 147 Network activity domain netserviceru.com 1 20200608
310 5ede974b-90cc-4198-b987-7a498064ab0b 147 Network activity domain sglinbas.com 1 20200608
311 5ede974b-90ec-4a51-9cb1-7a498064ab0b 147 Network activity domain blogforpranks.com 1 20200608
312 5ede974b-91e4-441f-8e18-7a498064ab0b 147 Network activity domain standardofficeil.com 1 20200608
313 5ede974b-92f4-4263-aba5-7a498064ab0b 147 Network activity domain webdomainexperts.com 1 20200608
314 5ede974b-9504-4c77-90af-7a498064ab0b 147 Network activity domain selectyourgroom.com 1 20200608
315 5ede974b-98ac-4c09-a078-7a498064ab0b 147 Network activity domain srvrgruk.com 1 20200608
316 5ede974b-995c-4825-96e8-7a498064ab0b 147 Network activity domain getsetgoforhealth.com 1 20200608
317 5ede974b-9a00-4765-a6a3-7a498064ab0b 147 Network activity domain emailserver4859.com 1 20200608
318 5ede974b-9d20-47f0-ae1a-7a498064ab0b 147 Network activity domain offshorecompanyllp.com 1 20200608
319 5ede974b-9d70-42e3-99df-7a498064ab0b 147 Network activity domain buzzoffbul.com 1 20200608
320 5ede974b-a0dc-4952-b5e7-7a498064ab0b 147 Network activity domain knowledgebaseonlineuk.com 1 20200608
321 5ede974b-a1d4-4af1-b30e-7a498064ab0b 147 Network activity domain promotespritialbelief.com 1 20200608
322 5ede974b-a390-4424-8619-7a498064ab0b 147 Network activity domain com-authmail.com 1 20200608
323 5ede974b-a3b4-404d-aab6-7a498064ab0b 147 Network activity domain linkfollowservice.com 1 20200608
324 5ede974b-a520-446a-8154-7a498064ab0b 147 Network activity domain maxlaboratories.com 1 20200608
325 5ede974b-a7c8-492e-b0cc-7a498064ab0b 147 Network activity domain xpertmaildomain.com 1 20200608
326 5ede974b-a7e4-469f-a011-7a498064ab0b 147 Network activity domain basicruoffshore.com 1 20200608
327 5ede974b-ab10-4ab3-a06d-7a498064ab0b 147 Network activity domain webserverdomainuk.com 1 20200608
328 5ede974b-ab8c-41d3-86e4-7a498064ab0b 147 Network activity domain onlineloginportalmy.com 1 20200608
329 5ede974b-abc8-4549-93d6-7a498064ab0b 147 Network activity domain logincontrolserver.com 1 20200608
330 5ede974b-abfc-4f30-a75e-7a498064ab0b 147 Network activity domain shoponlinefreesg.com 1 20200608
331 5ede974b-ac34-420a-ada9-7a498064ab0b 147 Network activity domain strongbolthostinghk.com 1 20200608
332 5ede974b-ac3c-4cd0-852e-7a498064ab0b 147 Network activity domain belowmargins.com 1 20200608
333 5ede974b-acf4-4960-87bf-7a498064ab0b 147 Network activity domain serverfornetworks.com 1 20200608
334 5ede974b-ae2c-4309-a967-7a498064ab0b 147 Network activity domain mailservereurope.com 1 20200608
335 5ede974b-ae7c-4519-9607-7a498064ab0b 147 Network activity domain hklinbas.com 1 20200608
336 5ede974b-aeb0-4b09-9650-7a498064ab0b 147 Network activity domain hostbasicmy.com 1 20200608
337 5ede974b-af2c-4075-b385-7a498064ab0b 147 Network activity domain domainforhostuk.com 1 20200608
338 5ede974b-b028-4cd7-b4c3-7a498064ab0b 147 Network activity domain bitserverlux.com 1 20200608
339 5ede974b-b0f8-471a-a175-7a498064ab0b 147 Network activity domain hostingservicesukit.com 1 20200608
340 5ede974b-b218-498c-9aa8-7a498064ab0b 147 Network activity domain frwrdrurl.com 1 20200608
341 5ede974b-b444-4749-83d7-7a498064ab0b 147 Network activity domain rulinuxbasic.com 1 20200608
342 5ede974b-b44c-48af-9023-7a498064ab0b 147 Network activity domain webredirect.click 1 20200608
343 5ede974b-b4a4-4b8d-ae21-7a498064ab0b 147 Network activity domain linuxserverfast.com 1 20200608
344 5ede974b-b544-44bd-a17a-7a498064ab0b 147 Network activity domain serverforhiretech.com 1 20200608
345 5ede974b-b574-4200-beaa-7a498064ab0b 147 Network activity domain serverfortechhelp.com 1 20200608
346 5ede974b-b5e8-4554-98f1-7a498064ab0b 147 Network activity domain domainserveractive.com 1 20200608
347 5ede974b-bd48-4ac8-8a01-7a498064ab0b 147 Network activity domain hostingservicesloyal.com 1 20200608
348 5ede974b-bf8c-42fc-bc23-7a498064ab0b 147 Network activity domain pageredirectservice.com 1 20200608
349 5ede974b-bfac-49c8-9853-7a498064ab0b 147 Network activity domain personaldoaminsg.com 1 20200608
350 5ede974b-c100-45b4-81df-7a498064ab0b 147 Network activity domain webserverdomainhk.com 1 20200608
351 5ede974b-c338-4d27-8906-7a498064ab0b 147 Network activity domain onlineloginserviceusa.com 1 20200608
352 5ede974b-c358-49be-aa68-7a498064ab0b 147 Network activity domain serverforzapper.com 1 20200608
353 5ede974b-c498-4a47-ac99-7a498064ab0b 147 Network activity domain serverformailings.com 1 20200608
354 5ede974b-c58c-44a6-9981-7a498064ab0b 147 Network activity domain cathostingservice.com 1 20200608
355 5ede974b-ce3c-4b3d-a1cf-7a498064ab0b 147 Network activity domain hostingserviceclean.com 1 20200608
356 5ede974b-cf40-41d9-90fb-7a498064ab0b 147 Network activity domain serverforhelphk.com 1 20200608
357 5ede974b-d060-40eb-9e73-7a498064ab0b 147 Network activity domain serverdemoservice.com 1 20200608
358 5ede974b-d230-4215-839c-7a498064ab0b 147 Network activity domain hostingserviceforall.com 1 20200608
359 5ede974b-d254-42f4-8dce-7a498064ab0b 147 Network activity domain anothershortnr.com 1 20200608
360 5ede974b-d3ac-4247-822d-7a498064ab0b 147 Network activity domain upgradetravelservice.com 1 20200608
361 5ede974b-d554-4553-833a-7a498064ab0b 147 Network activity domain portfoliofasinating.com 1 20200608
362 5ede974b-d554-4f2f-a399-7a498064ab0b 147 Network activity domain onlineloginportal.com 1 20200608
363 5ede974b-d5b4-4852-907d-7a498064ab0b 147 Network activity domain linuxbasichk1.com 1 20200608
364 5ede974b-d620-4c77-b6c0-7a498064ab0b 147 Network activity domain fastserveruk.com 1 20200608
365 5ede974b-d710-4c41-89a9-7a498064ab0b 147 Network activity domain serviceforneworder.com 1 20200608
366 5ede974b-d768-4621-beeb-7a498064ab0b 147 Network activity domain capitalinvestmentsllp.com 1 20200608
367 5ede974b-d928-4ccf-9dfe-7a498064ab0b 147 Network activity domain netsecuremailhosting.com 1 20200608
368 5ede974b-da3c-4adb-904b-7a498064ab0b 147 Network activity domain optionaldesigners.com 1 20200608
369 5ede974b-dab8-4408-8afd-7a498064ab0b 147 Network activity domain fastserverasia.com 1 20200608
370 5ede974b-dc1c-4a27-9d22-7a498064ab0b 147 Network activity domain optionalbloggingeu.com 1 20200608
371 5ede974b-dc24-4f46-8aff-7a498064ab0b 147 Network activity domain netgeoserversg.com 1 20200608
372 5ede974b-dc28-4fac-bc85-7a498064ab0b 147 Network activity domain baseserveremailbg.com 1 20200608
373 5ede974b-dd14-499c-a5c8-7a498064ab0b 147 Network activity domain basicmyoffshore.com 1 20200608
374 5ede974b-ddec-496d-90fa-7a498064ab0b 147 Network activity domain domainsfortechhelp.com 1 20200608
375 5ede974b-e070-47f5-9941-7a498064ab0b 147 Network activity domain linuxbasicmy.com 1 20200608
376 5ede974b-e1a8-480a-85ca-7a498064ab0b 147 Network activity domain readmytipsntricks.com 1 20200608
377 5ede974b-e2cc-4736-9799-7a498064ab0b 147 Network activity domain linuxbasichk.com 1 20200608
378 5ede974b-e350-4f53-baba-7a498064ab0b 147 Network activity domain assuredreturnplan.com 1 20200608
379 5ede974b-e4d8-40c7-bb37-7a498064ab0b 147 Network activity domain sapserverhike.com 1 20200608
380 5ede974b-e7d8-4879-aa9c-7a498064ab0b 147 Network activity domain post-manager.com 1 20200608
381 5ede974b-e93c-400b-8a1d-7a498064ab0b 147 Network activity domain shortenup.com 1 20200608
382 5ede974b-ea70-40df-ab83-7a498064ab0b 147 Network activity domain dnsserverprv.com 1 20200608
383 5ede974b-eaf8-406b-ac11-7a498064ab0b 147 Network activity domain secureservereurope.com 1 20200608
384 5ede974b-eed4-4938-84d1-7a498064ab0b 147 Network activity domain domainlocalhostingeu.com 1 20200608
385 5ede974b-ef18-4011-a98e-7a498064ab0b 147 Network activity domain mailauthservice.com 1 20200608
386 5ede974b-efd8-4e35-b441-7a498064ab0b 147 Network activity domain linuxbasicsg.com 1 20200608
387 5ede974b-f004-43fc-91f8-7a498064ab0b 147 Network activity domain linkforwrder.com 1 20200608
388 5ede974b-f07c-459d-bbfd-7a498064ab0b 147 Network activity domain prwebsiteuk.com 1 20200608
389 5ede974b-f100-4344-9990-7a498064ab0b 147 Network activity domain optionsothego.com 1 20200608
390 5ede974b-f180-4a01-92f0-7a498064ab0b 147 Network activity domain webserverdomaineu.com 1 20200608
391 5ede974b-f24c-4033-934a-7a498064ab0b 147 Network activity domain selectedserviceru.com 1 20200608
392 5ede974b-f528-4693-9214-7a498064ab0b 147 Network activity domain shorturlservice.com 1 20200608
393 5ede974b-f8ac-4b06-b3e2-7a498064ab0b 147 Network activity domain serverforhelpsg.com 1 20200608
394 5ede974b-fc78-4632-bc67-7a498064ab0b 147 Network activity domain transferdomainmy.com 1 20200608
395 5ede974b-fdb8-4975-9ea4-7a498064ab0b 147 Network activity domain linuxhostingplatformuk.com 1 20200608
396 5ede974b-fe1c-4b88-a1f1-7a498064ab0b 147 Network activity domain linuxbasicru1.com 1 20200608
397 5ede974b-ffc0-44b9-8d8e-7a498064ab0b 147 Network activity domain basicservicesg.com 1 20200608
398 5ede974b-fff8-4ae5-946a-7a498064ab0b 147 Network activity domain basicsgoffshore.com 1 20200608
399 5ede974c-0254-48bb-8890-7a498064ab0b 147 Network activity domain dsrvrer.com 1 20200608
400 5ede974c-06e8-4cda-9533-7a498064ab0b 147 Network activity domain ecoserveraus.com 1 20200608
401 5ede974c-07ac-483b-97b8-7a498064ab0b 147 Network activity domain minrsrvr.com 1 20200608
402 5ede974c-0a28-4f20-a141-7a498064ab0b 147 Network activity domain cyberserverusa.com 1 20200608
403 5ede974c-0c50-4fca-ba3b-7a498064ab0b 147 Network activity domain shortserver1.com 1 20200608
404 5ede974c-0cfc-4388-816d-7a498064ab0b 147 Network activity domain inrsrvrer.com 1 20200608
405 5ede974c-11c4-44d6-8fb5-7a498064ab0b 147 Network activity domain snaphosterservice.com 1 20200608
406 5ede974c-15ec-4c50-8e7e-7a498064ab0b 147 Network activity domain com-us-en-us.com 1 20200608
407 5ede974c-18c0-4297-9099-7a498064ab0b 147 Network activity domain msrdr.com 1 20200608
408 5ede974c-199c-47f6-bb3d-7a498064ab0b 147 Network activity domain sitebloginfo.com 1 20200608
409 5ede974c-19e4-4a62-b752-7a498064ab0b 147 Network activity domain transferserver33.com 1 20200608
410 5ede974c-1da0-4549-96cc-7a498064ab0b 147 Network activity domain affiliatedomainservice.com 1 20200608
411 5ede974c-1f50-44e9-b3a6-7a498064ab0b 147 Network activity domain nrgrsrvrer.com 1 20200608
412 5ede974c-2214-4607-80a7-7a498064ab0b 147 Network activity domain budgtoffmy.com 1 20200608
413 5ede974c-2518-4f2b-a1c2-7a498064ab0b 147 Network activity domain webmailmanageruk.com 1 20200608
414 5ede974c-2e18-429a-be6d-7a498064ab0b 147 Network activity domain com-er-en-us.com 1 20200608
415 5ede974c-40e8-417c-892e-7a498064ab0b 147 Network activity domain deferrer.website 1 20200608
416 5ede974c-4364-4cc2-a094-7a498064ab0b 147 Network activity domain siteadminhk.com 1 20200608
417 5ede974c-450c-4d31-a992-7a498064ab0b 147 Network activity domain zsrvrer.com 1 20200608
418 5ede974c-4ac0-4551-a821-7a498064ab0b 147 Network activity domain nigeriaoilleaks.com 1 20200608
419 5ede974c-4f78-44e0-b1d4-7a498064ab0b 147 Network activity domain com-biz.website 1 20200608
420 5ede974c-571c-406b-835a-7a498064ab0b 147 Network activity domain look-com.org 1 20200608
421 5ede974c-5aa4-4e2b-82b2-7a498064ab0b 147 Network activity domain serverforhelpmy.com 1 20200608
422 5ede974c-5f3c-4034-8163-7a498064ab0b 147 Network activity domain websitemanagerusa.com 1 20200608
423 5ede974c-602c-4aa9-bbb0-7a498064ab0b 147 Network activity domain ondemand.pushthisurl.com 1 20200608
424 5ede974c-643c-42d9-bae7-7a498064ab0b 147 Network activity domain ppleid.org 1 20200608
425 5ede974c-6654-47da-adb0-7a498064ab0b 147 Network activity domain mail-msrgr.info 1 20200608
426 5ede974c-6964-4b95-96e4-7a498064ab0b 147 Network activity domain com-mail-us.com 1 20200608
427 5ede974c-6c8c-46e5-b610-7a498064ab0b 147 Network activity domain com-io-en-us.com 1 20200608
428 5ede974c-74c4-4434-a43a-7a498064ab0b 147 Network activity domain mrgrhr.com 1 20200608
429 5ede974c-7710-4657-9242-7a498064ab0b 147 Network activity domain forumtechtopic.com 1 20200608
430 5ede974c-7df4-4194-9704-7a498064ab0b 147 Network activity domain com-oa-en-us.com 1 20200608
431 5ede974c-8898-4c9a-8424-7a498064ab0b 147 Network activity domain mgrsr.com 1 20200608
432 5ede974c-899c-409f-b5d0-7a498064ab0b 147 Network activity domain com-com-us.com 1 20200608
433 5ede974c-8f54-43b7-83ef-7a498064ab0b 147 Network activity domain csrvrer.com 1 20200608
434 5ede974c-9774-4c94-9234-7a498064ab0b 147 Network activity domain mnrsrvrer.com 1 20200608
435 5ede974c-9ae8-4036-9084-7a498064ab0b 147 Network activity domain serverforhelplux.com 1 20200608
436 5ede974c-9d4c-4204-83e2-7a498064ab0b 147 Network activity domain imgsrvrer.com 1 20200608
437 5ede974c-9e88-4d0c-8afa-7a498064ab0b 147 Network activity domain com-ar-en-us.com 1 20200608
438 5ede974c-a220-4201-9852-7a498064ab0b 147 Network activity domain saferedirect.pw 1 20200608
439 5ede974c-a838-47c5-b462-7a498064ab0b 147 Network activity domain interserver439.com 1 20200608
440 5ede974c-b21c-4c11-afb7-7a498064ab0b 147 Network activity domain com-hl-en-us.com 1 20200608
441 5ede974c-b2f0-4a05-ba80-7a498064ab0b 147 Network activity domain budgtoffru.com 1 20200608
442 5ede974c-b35c-450a-93ba-7a498064ab0b 147 Network activity domain chatserverrussia.com 1 20200608
443 5ede974c-b700-4dd5-8f65-7a498064ab0b 147 Network activity domain nameserver3476.com 1 20200608
444 5ede974c-b734-45bc-ac73-7a498064ab0b 147 Network activity domain secureemailserver65.com 1 20200608
445 5ede974c-b878-4327-a297-7a498064ab0b 147 Network activity domain aplsrvrer.com 1 20200608
446 5ede974c-be08-4f6d-86b8-7a498064ab0b 147 Network activity domain intrsrvrer.com 1 20200608
447 5ede974c-c058-4beb-ba35-7a498064ab0b 147 Network activity domain com-nh-en-us.com 1 20200608
448 5ede974c-c684-4c87-9e52-7a498064ab0b 147 Network activity domain mvrsrvrer.com 1 20200608
449 5ede974c-c86c-4e8e-bb6f-7a498064ab0b 147 Network activity domain bsrvrer.com 1 20200608
450 5ede974c-ce54-4e66-a5fd-7a498064ab0b 147 Network activity domain msrwr.com 1 20200608
451 5ede974c-d024-4581-b7dc-7a498064ab0b 147 Network activity domain mail-com.org 1 20200608
452 5ede974c-d444-40a9-a6e0-7a498064ab0b 147 Network activity domain xpertdomain.com 1 20200608
453 5ede974c-d518-4de6-90a3-7a498064ab0b 147 Network activity domain com-en-us.co.uk 1 20200608
454 5ede974c-d6c4-4236-ad25-7a498064ab0b 147 Network activity domain esrvrer.com 1 20200608
455 5ede974c-d77c-4cf9-8adc-7a498064ab0b 147 Network activity domain com-mail.net 1 20200608
456 5ede974c-d9b0-45f0-892c-7a498064ab0b 147 Network activity domain isrvrer.com 1 20200608
457 5ede974c-db3c-441b-afc6-7a498064ab0b 147 Network activity domain siteadmineurope.com 1 20200608
458 5ede974c-df18-4891-b6a8-7a498064ab0b 147 Network activity domain websiteadminuk.com 1 20200608
459 5ede974c-e6e8-43d0-9760-7a498064ab0b 147 Network activity domain com-com.website 1 20200608
460 5ede974c-e82c-404a-9286-7a498064ab0b 147 Network activity domain nameserverredirect.com 1 20200608
461 5ede974c-ed3c-4f42-ba2f-7a498064ab0b 147 Network activity domain onlinemusicstoreuk.com 1 20200608
462 5ede974c-f224-46ff-b495-7a498064ab0b 147 Network activity domain linuxbasicru3.com 1 20200608
463 5ede974c-f404-4140-99d1-7a498064ab0b 147 Network activity domain secureserver9898.com 1 20200608
464 5ede97f5-1448-4d36-a35e-7e298064ab0b 147 Payload delivery email-src noreply.mailingservice.3kdj9e9@gmail.com 0 20200608
465 5ede97f5-2e0c-42e1-9cdb-7e298064ab0b 147 Payload delivery email-src noreply.notifications.gkejkdgj@gmail.com 0 20200608
466 5ede97f5-3820-4868-ad30-7e298064ab0b 147 Payload delivery email-src scorpiobond4@gmail.com 0 20200608
467 5ede97f5-409c-44b3-8207-7e298064ab0b 147 Payload delivery email-src no.reply.n0tification.alsdkch@gmail.com 0 20200608
468 5ede97f5-4efc-4e42-afa5-7e298064ab0b 147 Payload delivery email-src n0replyupdatesnotificationskj9@gmail.com 0 20200608
469 5ede97f5-681c-4f01-9706-7e298064ab0b 147 Payload delivery email-src sophia.1johnson@mail.com 0 20200608
470 5ede97f5-6950-4509-9af0-7e298064ab0b 147 Payload delivery email-src n0replyn0tificati0nupdatemail@gmail.com 0 20200608
471 5ede97f5-81f8-4221-8637-7e298064ab0b 147 Payload delivery email-src noreplynotification.updates@gmail.com 0 20200608
472 5ede97f5-89ec-4587-a2d4-7e298064ab0b 147 Payload delivery email-src n0reply.notificationexsasuve@gmail.com 0 20200608
473 5ede97f5-9808-43ba-8d46-7e298064ab0b 147 Payload delivery email-src no.reply.updates.asdfaffgh78jg@gmail.com 0 20200608
474 5ede97f5-e864-4084-a3bb-7e298064ab0b 147 Payload delivery email-src noreply.535466586you6585tubadh@gmail.com 0 20200608
475 5ede982e-23e4-4191-9863-7a498064ab0b 147 Attribution whois-registrant-email amanda.lovers@mail.com 0 20200608
476 5ede982e-3b90-4fc1-95fc-7a498064ab0b 147 Attribution whois-registrant-email anurag.breja342@mail.com 0 20200608
477 5ede982e-8298-4b08-9fd4-7a498064ab0b 147 Attribution whois-registrant-email jacktanne@outlook.com 0 20200608
478 5ede982e-9c50-4452-9aa5-7a498064ab0b 147 Attribution whois-registrant-email flaviatales@mail.com 0 20200608
479 5ede982e-bc48-4231-a1ed-7a498064ab0b 147 Attribution whois-registrant-email amanda.kruetner@mail.com 0 20200608
480 5ede982e-c9f4-490e-9afd-7a498064ab0b 147 Attribution whois-registrant-email robert.klein@europe.com 0 20200608

8700
data/ioc/spyware/citizen_lab/202006_DarkBasin/misp.json Normal file
View File

File diff suppressed because it is too large Load Diff

Some files were not shown because too many files have changed in this diff Show More