Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/citizen_lab/201512_PackRAT/README.md

@@ -0,0 +1,11 @@
+## Packrat IOCs
+
+This directory contains IOC from the Citizen Lab report ["Packrat: Seven Years of a South American Threat Actor"](https://citizenlab.org/2015/12/packrat-report/) published the 8th of December 2015.
+
+Files included in this directory:
+* openioc.ioc : IOCs in OpenIOC format
+* stix.xml : IOCs in STIX XML format
+* iocs.csv : IOCs in csv format
+* domains.csv - list of domain, ip resolution at time of investigation and relevant date
+* md5-c2.csv - list of MD5 hashes and their associated malware family and command and control server domains
+* assorted.csv - additional miscellaneous indicators of compromise.

data/ioc/spyware/citizen_lab/201512_PackRAT/assorted.csv

@@ -0,0 +1,65 @@
+android-flash.com
+apaezb@tutanota.com
+autorizacion-gmail.com
+bit.ly/1wl3YE2
+blackboxmusic.co
+boletin@no-creo.info
+carlosuurbina@gmail.com
+confirmation-blackberry.com
+confirmation-facebook.com
+confirmation-icloud.com
+confirmation-outlook.com
+confirmation-twitter.com
+confirmation-yahoo.com
+deyrep.com
+ecuadorenvivo.co
+emilio.palacio35@gmail.com
+focusecuador.tk
+focusedtior1@gmail
+guillermolasso@tutanota.com
+idapaez@outlook.com
+info@no-creo.info
+inyurl.com/q4kaf68
+janethehinostroza@hotmail.com
+justicia-desvinculados.com
+lavozamericana.info
+lavozamericana.info
+login-office365.com
+login-office365.com
+login-outlook.com
+logon-outlook.com
+main-local-latam-soporte-widget.cu9.co
+main-local-latam-widget-soporte.cu9.co
+mgoogle.us
+movimiento.anti.correista@gmail.com
+movimientoanticorreista.com
+no-creo.info
+no.response.delivery.es@gmail.com
+no.response.delivery.us@gmail.com
+noticias@ecuadorenvivo.co
+oficinacarlosvera@hotmail.com
+Pancaliente.info
+periodistasnarcos@gmail.com
+soporte-gmail.com
+soporte-login-account-gmail.tk
+soporte-login-account-yahoo.tk
+soporte-main-local-latam-es.cu9.co
+soporte-main-local-latam-us.cu9.co
+soporte-yahoo.com
+soporte@gm-2013.twomini.com
+suport-team@us-gooogle.ws
+support-gmail.com
+support-java.com
+support-login-validate-outlook.tk
+support-whatsapp.com
+support-whatsapp.com
+tinyurl.com/ol6qzec
+tinyurl.com/pl843ws
+tinyurl.com/px28gsa
+tinyurl.com/q3zdyk8
+tinyurl.com/q4kaf68
+tinyurl.com/qxzz6ky
+update-outlook.info
+us-main-local-latam-soporte-widget.cu9.co
+verify-gmail-support-secure.tk
+web-google.cu9.co

data/ioc/spyware/citizen_lab/201512_PackRAT/domains.csv

@@ -0,0 +1,23 @@
+Domain,Relevant resolution,Relevant date
+deyrep24.ddns.net,50.62.133.49,"November 7th, 2014"
+deyrep24.ddns.net,192.169.243.65,"March 3rd, 2015"
+daynews.sytes.net,192.169.243.65,"March 3rd, 2015"
+daynews.sytes.net,190.20.180.181,"March 1st, 2015"
+taskmgr.serveftp.com,190.210.180.181,"August 11th, 2014"
+taskmgr.serveftp.com,201.52.24.126,"July 23rd, 2014"
+taskmgr.serveftp.com,186.220.1.84,July 11th 2014
+taskmgr.servehttp.com,186.220.1.84,"June 24th, 2014"
+taskmgr.servehttp.com,201.52.24.126,"July 23rd, 2014"
+taskmgr.servehttp.com,186.220.1.84,July 11th 2014
+taskmgr.servehttp.com,186.220.11.67,"August 15th, 2014"
+taskmgr.redirectme.com,201.52.24.126,"July 23rd, 2014"
+taskmgr.redirectme.com,186.220.1.84,July 11th 2014
+ruley.no-ip.org,186.220.1.84,July 11th 2014
+ruley.no-ip.org,189.100.148.188,"September 6th, 2012"
+lolinha.no-ip.org,189.100.148.188,"September 6th, 2012"
+wjwj.no-ip.org,189.100.148.188,"September 6th, 2012"
+conhost.servehttp.com,186.220.11.67,"August 15th, 2014"
+dllhost.servehttp.com,186.220.11.67,"August 15th, 2014"
+wjwjwj.no-ip.org,179.208.187.216,"March 25th, 2014"
+wjwjwj.no-ip.org,186.220.1.84,"June 24th, 2014"
+wjwjwjwj.no-ip.org,179.208.187.216,"March 25th, 2014"

data/ioc/spyware/citizen_lab/201512_PackRAT/iocs.csv

@@ -0,0 +1,137 @@
+uuid,event_id,category,type,value,comment,to_ids,date
+035cef0c-ab5b-4870-8a2d-3fffb2002a86,12,Network activity,domain,"www.blackboxmusic.co","",1,20161104
+04da6270-0f60-44e0-a68c-bb6d0eb89d84,12,Artifacts dropped,md5,"695db7dd3b1daf89f2c56d59faecc088","CyberGate",1,20161108
+075b1d0f-b7b2-4571-bd0c-9a2ad1c98663,12,Artifacts dropped,md5,"93b630891db21a4a2350280a360c713d","CyberGate",1,20161108
+078ea337-c004-430a-87d7-982e517f81c4,12,Artifacts dropped,md5,"4a23a1d6779d199aaa582cf0a5868ad1","Adzok",1,20161108
+080d5bfb-0924-48a0-8b75-37104a301e1c,12,Network activity,ip-dst,"201.52.24.126","",1,20161104
+09e60b2e-a849-4dc3-9910-59cd78bc3f82,12,Artifacts dropped,md5,"5a8975873f52436377d8fb0b5ab0d87a","CyberGate",1,20161108
+0a4ead27-a700-45f4-bcd0-b469d002b231,12,Network activity,ip-dst,"189.100.148.188","",1,20161104
+0c0abe15-22aa-433f-9a15-0b8196c3a99a,12,Network activity,domain,"venezuela365.com","",1,20161104
+0e4cc2f6-8b32-489a-8f86-6279b96ff313,12,Network activity,url,"http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html","",1,20161104
+0fabddd8-3837-4d33-bb62-efc4edfe67a5,12,Network activity,domain,"supportgmai1.com","",1,20161104
+1013af0f-98ea-44cf-8c57-d5dfcc2a9398,12,Network activity,domain,"conhost.servehttp.com","",1,20161104
+102812f0-1515-475b-85c9-fe3b9f298322,12,Network activity,domain,"mail-account-update.com","",1,20161104
+11c2de46-6ded-4948-914e-a8acff9ff027,12,Artifacts dropped,md5,"ce6065346a918a813eeb58bbb0814a23","CyberGate",1,20161108
+1242c1d0-3d53-48f2-a30f-f6566a46b262,12,Artifacts dropped,md5,"efc0009d76a2057f86c5f00030378c72","AlienSpy",1,20161108
+17548c65-6dd6-473f-b79c-9ad3095fb9b2,12,Artifacts dropped,md5,"a73351623577f44a2b578fed1e78e37e","CyberGate",1,20161108
+19da57bf-1c40-4472-a9e1-696a56ff0d12,12,Network activity,domain,"update-outlook.info","",1,20161104
+1b9f7074-c66c-472d-8917-0592bd07202e,12,Network activity,domain,"verify-gmail-support-secure.tk","",1,20161104
+1c9844bb-53a7-4c6d-859a-864d802fb755,12,Network activity,ip-dst,"198.12.150.249","",1,20161104
+1d17b791-20fd-4a0b-b074-36282e6fe9b9,12,Network activity,domain,"support-java.com","",1,20161104
+1f129d35-b9b2-42b4-81f6-8903c25c7080,12,Network activity,domain,"taskmgr.serveftp.com","",1,20161108
+1fcd075d-0b8f-42d9-852d-31813ae49879,12,Network activity,domain,"chavistas24.com","",1,20161104
+2034aaac-cd1a-4f24-9c9e-a622763cc35a,12,Artifacts dropped,md5,"15ebe16cd9500de534d5bfd5eeceaf73","CyberGate",1,20161108
+22c32e7b-f0a5-4e57-8821-a080cb880cdb,12,Network activity,domain,"mesvr.com","",1,20161104
+2738530c-979b-43ef-a7a3-6e509d38d073,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig","",1,20161104
+29d3b93f-a8c7-46f0-8aaa-d5b1d3a7efa6,12,Network activity,domain,"dllhost.servehttp.com","",1,20161104
+2b8e7578-2b1b-4ee4-b690-812825551490,12,Network activity,domain,"deyrep24.ddns.net","C2 server",1,20161108
+2bcfdd38-8a5d-4512-b575-9b06096bed81,12,Network activity,domain,"ns1.ukraine.com.ua","",1,20161104
+2cd0f135-c88d-4a89-8cd4-bbc6cd3efa0f,12,Artifacts dropped,md5,"01dec1b1d0760d5a1a562edcfeb478d1","CyberGate",1,20161108
+2de6d004-f85c-4967-9aaf-f6a2bd9f4349,12,Network activity,ip-dst,"46.246.89.246","",1,20161104
+32c1f9d8-b15a-4f28-a91d-1d781b28aaa0,12,Network activity,domain,"n1.login-office365.com","",1,20161104
+33a05e11-fe8c-47e0-b8a2-55b568df6adf,12,Network activity,domain,"focusecuador.tk","",1,20161104
+341b2a91-d835-4766-8a27-d0a04cf9af90,12,Artifacts dropped,md5,"a74ef893b1bf21c9df6d8e31285db981","CyberGate",1,20161108
+378b1659-18cc-484d-aa90-df1a36849693,12,Artifacts dropped,md5,"1e6d0b59d4fb7650453c207688385f3a","CyberGate",1,20161108
+395f1ba8-c107-4622-a845-f2a2e2660b64,12,Network activity,domain,"movimientoanticorreista.com","",1,20161104
+3a638a7b-6cc4-4cfe-940c-921fb417e79c,12,Artifacts dropped,md5,"c2237e9d415f542ce6e73adb260af123","Xtreme RAT",1,20161108
+3b6d91fc-6693-453e-b8d0-9a0955b12a9c,12,Network activity,url,"http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html","",1,20161104
+3cd6d0dd-13e7-40b1-adaf-957bedfc212b,12,Artifacts dropped,md5,"7b2cb5249d704cb1df8d4210e7c3d553","CyberGate",1,20161108
+438fd35d-28ff-4669-a2c6-d3606ad95501,12,Payload delivery,email-src,"enripintos123@outlook.es","",1,20161104
+440b7b2b-7d18-4a95-a95c-f4d80412535c,12,Artifacts dropped,md5,"e03be1849ad7cecba1e20923074cd22f","CyberGate",1,20161108
+475c2ee5-d819-4a55-bb4d-1d909905c039,12,Artifacts dropped,md5,"d2adecc6287dd4d559fe6ce2ce7a7e31","Cybergate",1,20161108
+491292ff-d9e0-481e-aed8-575ac817cff9,12,Network activity,domain,"asambleanacional-gob-ec.cu9.co","",1,20161104
+4982d975-2425-4c0e-8709-8ea8c3743372,12,Payload delivery,email-src,"no-responder@supportgmai1.com","",1,20161104
+4e2e0b4c-8e54-40bc-9432-152d34b9980b,12,Network activity,domain,"24.com","",0,20161104
+4e37e013-f1ce-4df9-ae83-f04eb6b18ba9,12,Network activity,domain,"taskmgr.redirectme.com","",1,20161104
+50dd1978-ed90-48a0-8fae-f841d7d26c0e,12,Network activity,domain,"cu9.co","",1,20161104
+521771b2-16c0-44e8-b1c6-0dedfe52a93f,12,Network activity,url,"http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado","",1,20161104
+53063744-8009-4309-823f-44ac089a9f4d,12,Network activity,domain,"formmail.com","",1,20161104
+53d09cce-3d68-4a76-bddb-118176b5eda6,12,Artifacts dropped,md5,"2de51e74fd571319bbf763ec62781096","AlienSpy",1,20161108
+55ab0c50-6ba9-44f0-bbf5-e30f13396fba,12,Artifacts dropped,md5,"1e4265a0c37773c2372b97bb6630ae57","Adzok",1,20161108
+55bc7d1d-b8c1-404a-ba53-0e81f893bf4f,12,Payload delivery,email-src,"movimiento.anti.correista@gmail.com","",1,20161104
+568339a3-cddf-4539-8e40-f2d726a5341b,12,Network activity,domain,"ecuadorenvivo.com","",1,20161104
+56e407af-b034-469f-833e-4261d12f4e3f,12,Network activity,ip-dst,"179.208.187.216","",1,20161104
+576bf524-78bd-47b8-9ae0-54ecea1bb4af,12,Network activity,domain,"ns1.deyrep.com","",1,20161104
+581c127f-fca8-4148-9a35-497a8e96ca05,12,External analysis,link,"https://citizenlab.org/2015/12/packrat-report/","",0,20161108
+582243bb-0f34-4775-9d56-49798e96ca05,12,Payload type,text,"CyberGate","",0,20161108
+582243bb-28a4-4ba0-bb04-49798e96ca05,12,Payload type,text,"Adzok","",0,20161108
+582243bb-c8d8-4986-a6f6-49798e96ca05,12,Payload type,text,"Xtreme RAT","",0,20161108
+582243bb-f194-4e73-8e86-49798e96ca05,12,Payload type,text,"AlienSpy","",0,20161108
+5f6ed532-7034-4529-8f1f-eca4f3ead06a,12,Network activity,domain,"soporte-login-account-yahoo.tk","",1,20161104
+613fc81a-9472-402a-864f-ba796bd820f9,12,Network activity,domain,"n4.pancaliente.info","",1,20161104
+63f47613-ca7a-4a85-859b-55acf0440a1a,12,Network activity,ip-dst,"50.63.202.57","",1,20161104
+64c9eefd-aabd-47be-8a66-56a3f777fca0,12,Network activity,domain,"taskmgr.redirectme.net","",1,20161104
+65be605b-ce44-483a-9398-c9b6c1d2584f,12,Network activity,domain,"s1.mgoogle.us","",1,20161104
+665a391e-0346-477b-8062-0e093fba3333,12,Artifacts dropped,md5,"a09f100ddc7cf29f8a93a3d7a79c58b9","CyberGate",1,20161108
+668f1383-b9db-44fb-ab01-49537c77ad1e,12,Network activity,domain,"blackboxmusic.co","",1,20161104
+694b6503-2ef8-4da9-8adf-1eaf5b0393c8,12,Artifacts dropped,md5,"2d722592a4e3c8030410dccccb221ce4","CyberGate",1,20161108
+69d8d573-3f23-493b-97f4-8fa6b4cf9f1b,12,Artifacts dropped,md5,"2827450763b55c5e71fda3caaf8e75f9","Xtreme RAT",1,20161108
+6cb4f4a0-1cf6-4cf4-98c2-5b9b93ff9867,12,Artifacts dropped,md5,"8fb96dfab7e4c0acb1eb9f4e950ba4b9","AlienSpy",1,20161108
+74bc6c34-77bb-4328-9edc-75059585e539,12,Network activity,domain,"mgoogle.us","",1,20161104
+77cc5d54-a422-4f1b-ab2f-167cdfde8bef,12,Network activity,domain,"focusecuador.net","",1,20161104
+7908fe7c-4346-4810-9f79-3ad2a8b93fd6,12,Network activity,domain,"n2.login-office365.com","",1,20161104
+7a7a2e9e-8e1e-45c7-ba5d-c6d6ce59465a,12,Network activity,domain,"ns1.hostinger.ru","",1,20161104
+7a948702-dd5c-46da-93e6-37d7bc088693,12,Network activity,ip-dst,"190.20.180.181","",1,20161104
+7b018a95-eb5d-4226-a5ca-9e32f4b288e4,12,Network activity,domain,"deyrep.com","",1,20161104
+7ca51a3d-b093-497f-accf-00bca0964287,12,Network activity,domain,"ns2.deyrep.com","",1,20161104
+809f7cd8-5a6f-4e4e-baca-d148180828b7,12,Network activity,url,"http://mail.asambleanacional.gob.ec","",1,20161104
+8149df18-d5b8-4b8f-9ebf-48676f586058,12,Network activity,ip-dst,"193.105.134.27","",1,20161104
+823b71a4-5bcc-4c16-bd79-816b1b6e70d9,12,Network activity,domain,"justicia-desvinculados.com","",1,20161104
+83aa404a-cb12-407c-993c-1ff9b7fa1947,12,Network activity,domain,"ftp.server.com","",1,20161104
+83bc4a8a-fe39-48d7-b26c-f4e4bfe08cde,12,Network activity,domain,"lolinha.no-ip.org","",1,20161104
+85d91d34-8222-4b2e-b154-0b394ec75fe3,12,Artifacts dropped,md5,"3a61d64986ee6529cee271ab6754faa5","CyberGate",1,20161108
+887aba05-4662-4967-8d93-09cb8b3d7685,12,Network activity,domain,"n1.support-java.com","",1,20161104
+88a1c5b7-d445-49fc-aa75-7ee28b069510,12,Payload delivery,email-src,"focusedtior1@gmail.com","",1,20161104
+89db0f38-a183-45b8-9503-69828bf29412,12,Network activity,ip-dst,"192.169.243.65","IP address linked to deyrep24.ddns.net",1,20161108
+8ae2e6c9-806a-4a57-aa17-aed767339990,12,Artifacts dropped,md5,"d7f34168b1a7dd7cbd8e62a5ab1ebc0e","Xtreme RAT",1,20161108
+8d8d0ac6-1cbe-4d9c-9b3c-8b7dbd1a1ce4,12,Artifacts dropped,md5,"779a79c11f581b84e7c81f321fd8d743","CyberGate",1,20161108
+8ea723f1-5e6d-4984-80a1-c844988006d9,12,Network activity,url,"http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg","",1,20161104
+8eecda70-e625-413f-b7fc-8451d76f4765,12,Network activity,domain,"ec.cu9.co","",1,20161104
+8f38d4c7-dff5-484f-be90-3aaa3fba6753,12,Artifacts dropped,md5,"d2f151312f7dee2483ddcab9766b56db","AlienSpy",1,20161108
+9096fec9-6b26-4c94-a9a1-8bfe16caf1b5,12,Artifacts dropped,md5,"8e0f021dcbbfa586a1c6780e77ac0fb6","CyberGate",1,20161108
+93541388-7cc4-436a-bf73-1e1584776a59,12,Network activity,domain,"www.movimientoanticorreista.com","",1,20161104
+9e0ea90e-1dae-4fd3-9fe2-a95bf8ff29c7,12,Network activity,ip-dst,"190.210.180.181","",1,20161104
+9f3c0a52-cf4e-434c-852b-a93df8a857e1,12,Payload delivery,email-src,"claudiobonadio88@gmail.com","",1,20161108
+9fbc655c-1010-4057-8af4-d29425574e3e,12,Artifacts dropped,md5,"13d939b2412c6adbab3cc1b539166671","CyberGate",1,20161108
+a0787877-1f51-45a2-a268-99585abd3753,12,Network activity,domain,"android-flash.com","",1,20161104
+a179e1f8-66e4-4055-a762-ed5d9166afa2,12,Artifacts dropped,md5,"74613eae84347183b4ca61b912a4573f","AlienSpy",1,20161108
+a38d5330-38f4-4016-a6a5-82fefed9aacd,12,Network activity,domain,"wjwjwjwj.no-ip.org","",1,20161104
+a391d94a-2311-4420-a315-067f450915c2,12,Network activity,domain,"ftp.ftpserver.com","",1,20161104
+a723650f-2306-48f3-a588-e57822f92448,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies","",1,20161104
+a8d6eb71-318f-4516-b319-5e50d6996770,12,Artifacts dropped,md5,"dd1101adc86fd282f5f183942cc2f3b7","CyberGate",1,20161108
+ab318121-5622-4ea7-aca3-59e972601644,12,Network activity,domain,"n3.pancaliente.info","",1,20161104
+abb6b95e-2364-4aad-b826-7c925b587d0a,12,Network activity,domain,"lavozmericana.info","",1,20161104
+abc292cf-5485-4189-8c0a-b18d830cc7f2,12,Network activity,domain,"pancaliente.info","",1,20161104
+ac5dde92-e97e-4b57-9305-5e439f9bbb40,12,Artifacts dropped,md5,"ea50bf8abcf9c0c40c4490dc15fb0a2a","CyberGate",1,20161108
+aea5a3f5-d174-47c1-81a0-c97a5a478e00,12,Network activity,domain,"n1.lavozamericana.info","",1,20161104
+b0bd3917-ba04-4d95-a5d3-928993f331a9,12,Artifacts dropped,md5,"a988235ad7d47acbeca5ccb4ea5a1ed5","CyberGate",1,20161108
+b0df1407-9653-4f07-8f2e-5cd7f1c1a212,12,Network activity,domain,"n1.update-outlook.info","",1,20161104
+b373771f-54f4-4559-8297-52779ee94c28,12,Network activity,domain,"soporte-login-account-gmail.tk","",1,20161104
+b5b19817-6112-4eeb-b3d1-666f92b33ee7,12,Network activity,domain,"no.response.delivery.es","",1,20161104
+b66ec73a-4faf-4873-bdd8-8fdde6207ca4,12,Network activity,domain,"ecuadorenvivo.co","",1,20161104
+b812855c-8fdc-41f2-8857-8966aa84ea89,12,Network activity,domain,"ruley.no-ip.org","",1,20161104
+bc40a9ee-df43-4ba3-ad9d-529dc845d04b,12,Network activity,domain,"s2.mgoogle.us","",1,20161104
+bd9e3887-abea-465a-9f42-4ca38ea31d17,12,Artifacts dropped,md5,"0ae0038ffe8cf5c3170734a71ff2213d","AlienSpy",1,20161108
+c00a3cd4-3530-4a3d-a0b2-4231aad495ad,12,Network activity,domain,"login-office365.com","",1,20161104
+c103e0dc-7fb4-4e6d-a3d1-d6dfadc90045,12,Artifacts dropped,md5,"08a3bb5b220eb1e0dc2ecccbbc6859f5","Adzok",1,20161108
+c67572b2-b7f4-4f32-9e4d-a8892079fec4,12,Network activity,domain,"wjwjwj.no-ip.org","",1,20161104
+c6f40987-2e22-495f-9fcf-ce681c67e901,12,Network activity,domain,"daynews.sytes.net","domain linked to deyrep24.ddns.net",1,20161108
+c7d3ba98-9951-45a1-864f-ad1c6c000aad,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Active","",1,20161104
+c891c678-1cf0-4842-bcec-fe93b9479a28,12,Network activity,ip-dst,"50.62.133.49","IP address linked to deyrep24.ddns.net",1,20161108
+cbdf99c3-ac02-49e1-bd44-aa95c5e2acac,12,Network activity,domain,"wjwj.no-ip.org","",1,20161104
+ced4acdc-8a7e-4766-b6c6-431b37b0e332,12,Payload delivery,email-src,"cfed.bonadio@gmail.com","Phishing source pretending to be Claudio Bonadio",1,20161108
+cf896608-add9-45a1-8a66-8a04096b70f1,12,Network activity,domain,"mail.asambleanacional.gob.ec","",1,20161104
+cfd9e067-855e-4c38-af7b-b1ec7b9c5e0f,12,Network activity,domain,"support-whatsapp.com","",1,20161104
+d036cf1a-59fb-4c11-9da9-cbf99f5733a7,12,Artifacts dropped,md5,"ed8d7ed45b64890b8901b735018318f3","CyberGate",1,20161108
+d605e928-93ec-4aec-897e-0de476fe3f0e,12,Network activity,domain,"s1.support","",1,20161104
+d736d788-19c3-47d3-85ba-6f1b8a3f0897,12,Network activity,ip-dst,"186.220.1.84","",1,20161104
+d79f9f17-548f-4712-afdf-a8dc5dc43be1,12,Network activity,domain,"taskmgr.servehttp.com","",1,20161104
+da13fa70-4007-4c44-b611-a890dd8b1f31,12,Artifacts dropped,md5,"ea7bcf58a4ccdecb0c64e56b9998a4ac","Adzok",1,20161108
+dad67427-90fd-429f-94cc-15aab9efefc7,12,Artifacts dropped,md5,"bc97437fec7e7e8634c2eabae3cc4832","CyberGate",1,20161108
+e4567864-ed20-4a52-8ebc-280bb84bc259,12,Payload delivery,email-src,"no.response.delivery.es@gmail.com","",1,20161104
+ec9d62d6-4906-45a7-a781-a4b3939e77bc,12,Network activity,domain,"gmail.com.msg07.xyz","",1,20161104
+f4ce5713-8486-4eff-be64-f04899ad0e63,12,Network activity,ip-dst,"186.220.11.67","",1,20161104
+f5818138-37c1-412a-8cf7-2d7bcb538367,12,Network activity,domain,"lavozamericana.info","",1,20161104
+f7508074-3443-4ceb-a1b6-08e87bc65b44,12,Network activity,domain,"support-login-validate-outlook.tk","",1,20161104
+f7dbcb2a-96c1-48d9-8bda-785348f8d91b,12,Artifacts dropped,md5,"6c34d4296126679d9c6a0bc2660dc453","CyberGate",1,20161108
+fd6b3ff2-e441-4bc1-ba2d-d3d9dd50ab24,12,Network activity,domain,"ns.update-outlook.info","",1,20161104

data/ioc/spyware/citizen_lab/201512_PackRAT/md5-c2.csv

@@ -0,0 +1,51 @@
+MD5,,C2,Malware Family
+dd1101adc86fd282f5f183942cc2f3b7,,wjwj.no-ip.org,CyberGate
+dd1101adc86fd282f5f183942cc2f3b7,,ruley.no-ip.org,CyberGate
+dd1101adc86fd282f5f183942cc2f3b7,,lolinha.no-ip.org,CyberGate
+2d722592a4e3c8030410dccccb221ce4,,wjwj.no-ip.org,CyberGate
+d2adecc6287dd4d559fe6ce2ce7a7e31,,wjwj.no-ip.org,Cybergate
+d2adecc6287dd4d559fe6ce2ce7a7e31,,ruley.no-ip.org,Cybergate
+d2adecc6287dd4d559fe6ce2ce7a7e31,,lolinha.no-ip.org,Cybergate
+93b630891db21a4a2350280a360c713d,,wjwj.no-ip.org,CyberGate
+93b630891db21a4a2350280a360c713d,,ruley.no-ip.org,CyberGate
+93b630891db21a4a2350280a360c713d,,lolinha.no-ip.org,CyberGate
+a73351623577f44a2b578fed1e78e37e,,ruley.no-ip.org,CyberGate
+a73351623577f44a2b578fed1e78e37e,,wjwj.no-ip.org,CyberGate
+5a8975873f52436377d8fb0b5ab0d87a,,ruley.no-ip.org,CyberGate
+ed8d7ed45b64890b8901b735018318f3,,ruley.no-ip.org,CyberGate
+ed8d7ed45b64890b8901b735018318f3,,wjwj.no-ip.org,CyberGate
+c2237e9d415f542ce6e73adb260af123,,wjwj.no-ip.org,Xtreme RAT
+2827450763b55c5e71fda3caaf8e75f9,,wjwj.no-ip.org,Xtreme RAT
+bc97437fec7e7e8634c2eabae3cc4832,,ruley.no-ip.org,CyberGate
+bc97437fec7e7e8634c2eabae3cc4832,,taskmgr.serveftp.com,CyberGate
+d7f34168b1a7dd7cbd8e62a5ab1ebc0e,,taskmgr.serveftp.com,Xtreme RAT
+d7f34168b1a7dd7cbd8e62a5ab1ebc0e,,taskmgr.servehttp.com,Xtreme RAT
+6c34d4296126679d9c6a0bc2660dc453,,taskmgr.servehttp.com,CyberGate
+6c34d4296126679d9c6a0bc2660dc453,,taskmgr.serveftp.com,CyberGate
+efc0009d76a2057f86c5f00030378c72,,daynews.sytes.net,AlienSpy
+74613eae84347183b4ca61b912a4573f,,daynews.sytes.net,AlienSpy
+d2f151312f7dee2483ddcab9766b56db,,daynews.sytes.net,AlienSpy
+ea7bcf58a4ccdecb0c64e56b9998a4ac,,daynews.sytes.net,Adzok
+1e4265a0c37773c2372b97bb6630ae57,,daynews.sytes.net,Adzok
+08a3bb5b220eb1e0dc2ecccbbc6859f5,,daynews.sytes.net,Adzok
+2de51e74fd571319bbf763ec62781096,,deyrep24.ddns.net,AlienSpy
+8fb96dfab7e4c0acb1eb9f4e950ba4b9,,deyrep24.ddns.net,AlienSpy
+4a23a1d6779d199aaa582cf0a5868ad1,,deyrep24.ddns.net,Adzok
+0ae0038ffe8cf5c3170734a71ff2213d,,deyrep24.ddns.net,AlienSpy
+8e0f021dcbbfa586a1c6780e77ac0fb6,,taskmgr.servehttp.com,CyberGate
+a74ef893b1bf21c9df6d8e31285db981,,taskmgr.servehttp.com,CyberGate
+a988235ad7d47acbeca5ccb4ea5a1ed5,,taskmgr.servehttp.com,CyberGate
+15ebe16cd9500de534d5bfd5eeceaf73,,taskmgr.servehttp.com,CyberGate
+01dec1b1d0760d5a1a562edcfeb478d1,,taskmgr.servehttp.com,CyberGate
+1e6d0b59d4fb7650453c207688385f3a,,taskmgr.servehttp.com,CyberGate
+e03be1849ad7cecba1e20923074cd22f,,taskmgr.servehttp.com,CyberGate
+779a79c11f581b84e7c81f321fd8d743,,conhost.servehttp.com,CyberGate
+13d939b2412c6adbab3cc1b539166671,,conhost.servehttp.com,CyberGate
+13d939b2412c6adbab3cc1b539166671,,dllhost.servehttp.com,CyberGate
+7b2cb5249d704cb1df8d4210e7c3d553,,dllhost.servehttp.com,CyberGate
+7b2cb5249d704cb1df8d4210e7c3d553,,conhost.servehttp.com,CyberGate
+a09f100ddc7cf29f8a93a3d7a79c58b9,,taskmgr.servehttp.com,CyberGate
+ce6065346a918a813eeb58bbb0814a23,,taskmgr.servehttp.com,CyberGate
+ea50bf8abcf9c0c40c4490dc15fb0a2a,,taskmgr.servehttp.com,CyberGate
+3a61d64986ee6529cee271ab6754faa5,,taskmgr.servehttp.com,CyberGate
+695db7dd3b1daf89f2c56d59faecc088,,taskmgr.servehttp.com,CyberGate

data/ioc/spyware/citizen_lab/201512_PackRAT/openioc.ioc

@@ -0,0 +1,533 @@
+<?xml version="1.0" encoding="utf-8"?>
+<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581c11ef-a8c4-4c26-a4ea-49798e96ca05" last-modified="2015-12-08T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
+  <short_description>Event #12</short_description>
+  <description>Packrat: Seven Years of a South American Threat Actor</description>
+  <keywords />
+  <authored_by>citizenlab</authored_by>
+  <authored_date>2015-12-08T00:00:00</authored_date>
+  <links />
+  <definition>
+    <Indicator operator="OR" id="581c11ef-a8c4-4c26-a4ea-49798e96ca05">
+      <IndicatorItem id="a988235ad7d47acbeca5ccb4ea5a1ed5" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="15ebe16cd9500de534d5bfd5eeceaf73" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="01dec1b1d0760d5a1a562edcfeb478d1" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="1e6d0b59d4fb7650453c207688385f3a" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="e03be1849ad7cecba1e20923074cd22f" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="779a79c11f581b84e7c81f321fd8d743" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="13d939b2412c6adbab3cc1b539166671" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="7b2cb5249d704cb1df8d4210e7c3d553" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="a09f100ddc7cf29f8a93a3d7a79c58b9" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ce6065346a918a813eeb58bbb0814a23" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ea50bf8abcf9c0c40c4490dc15fb0a2a" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="3a61d64986ee6529cee271ab6754faa5" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="695db7dd3b1daf89f2c56d59faecc088" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ea7bcf58a4ccdecb0c64e56b9998a4ac" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="efc0009d76a2057f86c5f00030378c72" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="74613eae84347183b4ca61b912a4573f" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="bc97437fec7e7e8634c2eabae3cc4832" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="dd1101adc86fd282f5f183942cc2f3b7" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="2d722592a4e3c8030410dccccb221ce4" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="d2adecc6287dd4d559fe6ce2ce7a7e31" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="93b630891db21a4a2350280a360c713d" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="a73351623577f44a2b578fed1e78e37e" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="5a8975873f52436377d8fb0b5ab0d87a" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ed8d7ed45b64890b8901b735018318f3" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="c2237e9d415f542ce6e73adb260af123" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="2827450763b55c5e71fda3caaf8e75f9" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="d7f34168b1a7dd7cbd8e62a5ab1ebc0e" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="6c34d4296126679d9c6a0bc2660dc453" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="d2f151312f7dee2483ddcab9766b56db" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="1e4265a0c37773c2372b97bb6630ae57" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="08a3bb5b220eb1e0dc2ecccbbc6859f5" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="2de51e74fd571319bbf763ec62781096" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="8fb96dfab7e4c0acb1eb9f4e950ba4b9" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="4a23a1d6779d199aaa582cf0a5868ad1" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="0ae0038ffe8cf5c3170734a71ff2213d" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="8e0f021dcbbfa586a1c6780e77ac0fb6" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="a74ef893b1bf21c9df6d8e31285db981" condition="is">
+        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
+        <Content type="md5"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="HKLM\SOFTWARE\Microsoft\Active" condition="is">
+        <Context document="Network" search="RegistryItem/KeyPath" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies" condition="is">
+        <Context document="Network" search="RegistryItem/KeyPath" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig" condition="is">
+        <Context document="Network" search="RegistryItem/KeyPath" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="taskmgr.redirectme.net" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ftp.server.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="update-outlook.info" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="deyrep.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="support-whatsapp.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="blackboxmusic.co" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="www.blackboxmusic.co" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="mail-account-update.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="lavozmericana.info" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="support-java.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="n3.pancaliente.info" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="n4.pancaliente.info" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ns1.deyrep.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ns2.deyrep.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="n1.login-office365.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="n2.login-office365.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="n1.update-outlook.info" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ns.update-outlook.info" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="s1.mgoogle.us" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="s2.mgoogle.us" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="support-login-validate-outlook.tk" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="verify-gmail-support-secure.tk" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="soporte-login-account-gmail.tk" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="soporte-login-account-yahoo.tk" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="n1.support-java.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="n1.lavozamericana.info" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="s1.support" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ns1.ukraine.com.ua" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="android-flash.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="deyrep24.ddns.net" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="daynews.sytes.net" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="taskmgr.serveftp.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="taskmgr.servehttp.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="taskmgr.redirectme.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ruley.no-ip.org" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="lolinha.no-ip.org" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="wjwj.no-ip.org" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="conhost.servehttp.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="dllhost.servehttp.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="wjwjwj.no-ip.org" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="wjwjwjwj.no-ip.org" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ecuadorenvivo.co" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ecuadorenvivo.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="www.movimientoanticorreista.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="focusecuador.tk" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="mesvr.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ftp.ftpserver.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="lavozamericana.info" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ec.cu9.co" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="movimientoanticorreista.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="mgoogle.us" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="no.response.delivery.es" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="cu9.co" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="asambleanacional-gob-ec.cu9.co" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="mail.asambleanacional.gob.ec" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="formmail.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="login-office365.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="pancaliente.info" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="focusecuador.net" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="gmail.com.msg07.xyz" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="supportgmai1.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="chavistas24.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ns1.hostinger.ru" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="venezuela365.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="justicia-desvinculados.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="50.62.133.49" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="192.169.243.65" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="190.210.180.181" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="201.52.24.126" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="190.20.180.181" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="186.220.1.84" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="186.220.11.67" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="189.100.148.188" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="179.208.187.216" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="46.246.89.246" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="198.12.150.249" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="50.63.202.57" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="193.105.134.27" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://mail.asambleanacional.gob.ec" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg" condition="is">
+        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="claudiobonadio88@gmail.com" condition="is">
+        <Context document="Email" search="Email/From" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="cfed.bonadio@gmail.com" condition="is">
+        <Context document="Email" search="Email/From" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="focusedtior1@gmail.com" condition="is">
+        <Context document="Email" search="Email/From" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="no.response.delivery.es@gmail.com" condition="is">
+        <Context document="Email" search="Email/From" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="enripintos123@outlook.es" condition="is">
+        <Context document="Email" search="Email/From" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="movimiento.anti.correista@gmail.com" condition="is">
+        <Context document="Email" search="Email/From" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="no-responder@supportgmai1.com" condition="is">
+        <Context document="Email" search="Email/From" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+    </Indicator>
+  </definition>
+</ioc>