Export from MISP Threat Report Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents (MISP Event #8) Threat Report Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents 8 2016-05-29T00:00:00+00:00 2016-11-08T16:56:19+00:00 Closed Attribution Attribution: Stealth Falcon (MISP Attribute #1354) Malware Artifacts Attribution: Stealth Falcon (MISP Attribute #1354) None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: simpleadbanners.com (MISP Attribute #1358) Malware Artifacts Domain Watchlist Network activity: simpleadbanners.com (MISP Attribute #1358) simpleadbanners.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: clickstatistic.com (MISP Attribute #1359) Malware Artifacts Domain Watchlist Network activity: clickstatistic.com (MISP Attribute #1359) clickstatistic.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: bestairlinepricetags.com (MISP Attribute #1360) Malware Artifacts Domain Watchlist Network activity: bestairlinepricetags.com (MISP Attribute #1360) bestairlinepricetags.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: fasttravelclearance.com (MISP Attribute #1361) Malware Artifacts Domain Watchlist Network activity: fasttravelclearance.com (MISP Attribute #1361) fasttravelclearance.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: airlineadverts.com (MISP Attribute #1362) Malware Artifacts Domain Watchlist Network activity: airlineadverts.com (MISP Attribute #1362) airlineadverts.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ministrynewschannel.com (MISP Attribute #1363) Malware Artifacts Domain Watchlist Network activity: ministrynewschannel.com (MISP Attribute #1363) ministrynewschannel.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ministrynewsinfo.com (MISP Attribute #1364) Malware Artifacts Domain Watchlist Network activity: ministrynewsinfo.com (MISP Attribute #1364) ministrynewsinfo.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: adhostingcache.com (MISP Attribute #425) Malware Artifacts Domain Watchlist Network activity: adhostingcache.com (MISP Attribute #425) adhostingcache.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: adhostingcaches.com (MISP Attribute #426) Malware Artifacts Domain Watchlist Network activity: adhostingcaches.com (MISP Attribute #426) adhostingcaches.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: optimizedimghosting.com (MISP Attribute #427) Malware Artifacts Domain Watchlist Network activity: optimizedimghosting.com (MISP Attribute #427) optimizedimghosting.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: edgecacheimagehosting.com (MISP Attribute #428) Malware Artifacts Domain Watchlist Network activity: edgecacheimagehosting.com (MISP Attribute #428) edgecacheimagehosting.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: incapsulawebcache.com (MISP Attribute #429) Malware Artifacts Domain Watchlist Network activity: incapsulawebcache.com (MISP Attribute #429) incapsulawebcache.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 95.215.44.37 (MISP Attribute #430) Malware Artifacts IP Watchlist Network activity: 95.215.44.37 (MISP Attribute #430) 95.215.44.37 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: http://adhostingcache.com/ehhe/eh4g4/adcache.txt (MISP Attribute #432) Malware Artifacts URL Watchlist Network activity: http://adhostingcache.com/ehhe/eh4g4/adcache.txt (MISP Attribute #432) http://adhostingcache.com/ehhe/eh4g4/adcache.txt None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: https://incapsulawebcache.com/cache/cache.nfo (MISP Attribute #433) Malware Artifacts URL Watchlist Network activity: https://incapsulawebcache.com/cache/cache.nfo (MISP Attribute #433) https://incapsulawebcache.com/cache/cache.nfo None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: http://aax.me/redirect.js (MISP Attribute #434) Malware Artifacts URL Watchlist Network activity: http://aax.me/redirect.js (MISP Attribute #434) http://aax.me/redirect.js None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: http://goo.gl/60HAqJ (MISP Attribute #435) Malware Artifacts URL Watchlist Network activity: http://goo.gl/60HAqJ (MISP Attribute #435) http://goo.gl/60HAqJ None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: http://aax.me/0b152 (MISP Attribute #436) Malware Artifacts URL Watchlist Network activity: http://aax.me/0b152 (MISP Attribute #436) http://aax.me/0b152 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: http://optimizedimghosting.com/wddf/hrrw/ggrr.txt (MISP Attribute #437) Malware Artifacts URL Watchlist Network activity: http://optimizedimghosting.com/wddf/hrrw/ggrr.txt (MISP Attribute #437) http://optimizedimghosting.com/wddf/hrrw/ggrr.txt None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: https://edgecacheimagehosting.com/images/image.nfo (MISP Attribute #438) Malware Artifacts URL Watchlist Network activity: https://edgecacheimagehosting.com/images/image.nfo (MISP Attribute #438) https://edgecacheimagehosting.com/images/image.nfo None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: aax.me (MISP Attribute #1355) Malware Artifacts Domain Watchlist Payload delivery: aax.me (MISP Attribute #1355) aax.me High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: the_right_to_fight@openmailbox.org (MISP Attribute #439) Malware Artifacts Malicious E-mail Payload delivery: the_right_to_fight@openmailbox.org (MISP Attribute #439) the_right_to_fight@openmailbox.org None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: andrew.dwight389@outlook.com (MISP Attribute #440) Malware Artifacts Malicious E-mail Payload delivery: andrew.dwight389@outlook.com (MISP Attribute #440) andrew.dwight389@outlook.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: 80e8ef78b9e28015cde4205aaa65da97 (MISP Attribute #441) Malware Artifacts File Hash Watchlist Payload delivery: 80e8ef78b9e28015cde4205aaa65da97 (MISP Attribute #441) MD5 80e8ef78b9e28015cde4205aaa65da97 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: 87e1df6f36b96b56186444e37e2a1ef5 (MISP Attribute #442) Malware Artifacts File Hash Watchlist Payload delivery: 87e1df6f36b96b56186444e37e2a1ef5 (MISP Attribute #442) MD5 87e1df6f36b96b56186444e37e2a1ef5 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: f25466e4820404c817eaf75818b7177891735886 (MISP Attribute #443) Malware Artifacts File Hash Watchlist Payload delivery: f25466e4820404c817eaf75818b7177891735886 (MISP Attribute #443) SHA1 f25466e4820404c817eaf75818b7177891735886 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: 1c3757006f972ca957d925accf8bbb3023550d1b (MISP Attribute #444) Malware Artifacts File Hash Watchlist Payload delivery: 1c3757006f972ca957d925accf8bbb3023550d1b (MISP Attribute #444) SHA1 1c3757006f972ca957d925accf8bbb3023550d1b None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: 5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f (MISP Attribute #445) Malware Artifacts File Hash Watchlist Payload delivery: 5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f (MISP Attribute #445) SHA256 5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: 4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be (MISP Attribute #446) Malware Artifacts File Hash Watchlist Payload delivery: 4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be (MISP Attribute #446) SHA256 4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://aax.me/a6faa (MISP Attribute #1356) Malware Artifacts URL Watchlist Payload delivery: http://aax.me/a6faa (MISP Attribute #1356) http://aax.me/a6faa High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate (MISP Attribute #1357) Malware Artifacts URL Watchlist Payload delivery: https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate (MISP Attribute #1357) https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://aax.me/d0dde (MISP Attribute #447) Malware Artifacts URL Watchlist Payload delivery: http://aax.me/d0dde (MISP Attribute #447) http://aax.me/d0dde None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Event Threat Level: Medium MISP Tag: TLP:GREEN MISP Tag: SOURCE:CITIZENLAB MISP Tag: DETECT MISP Tag: PUBLISHED citizenlab https://citizenlab.org/2016/05/stealth-falcon/ ../../../descendant-or-self::node()