Export from MISP Threat Report Bad Traffic (MISP Event #134) Threat Report Bad Traffic 134 2018-02-14T00:00:00+00:00 2018-03-07T14:23:18+00:00 New Artifacts dropped Artifacts dropped: a070fd2cce434a6f0b0d0fa6d3278d22 (MISP Attribute #18176) Malware Artifacts File Hash Watchlist Artifacts dropped: a070fd2cce434a6f0b0d0fa6d3278d22 (MISP Attribute #18176) MD5 a070fd2cce434a6f0b0d0fa6d3278d22 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: be6f2a03dfddbaf1166854730961d13c (MISP Attribute #18177) Malware Artifacts File Hash Watchlist Artifacts dropped: be6f2a03dfddbaf1166854730961d13c (MISP Attribute #18177) MD5 be6f2a03dfddbaf1166854730961d13c None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: d7ec065cc3f563928504f80692578d2f (MISP Attribute #18178) Malware Artifacts File Hash Watchlist Artifacts dropped: d7ec065cc3f563928504f80692578d2f (MISP Attribute #18178) MD5 d7ec065cc3f563928504f80692578d2f None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: f344da38958dbc730ddebc10660cd451 (MISP Attribute #18179) Malware Artifacts File Hash Watchlist Artifacts dropped: f344da38958dbc730ddebc10660cd451 (MISP Attribute #18179) MD5 f344da38958dbc730ddebc10660cd451 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: fa90508007b94a4dbfeb8b48d5443ec8 (MISP Attribute #18180) Malware Artifacts File Hash Watchlist Artifacts dropped: fa90508007b94a4dbfeb8b48d5443ec8 (MISP Attribute #18180) MD5 fa90508007b94a4dbfeb8b48d5443ec8 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 001316808aa7108b467e8ecc06139c2e (MISP Attribute #18181) Malware Artifacts File Hash Watchlist Artifacts dropped: 001316808aa7108b467e8ecc06139c2e (MISP Attribute #18181) MD5 001316808aa7108b467e8ecc06139c2e None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 5c3f0dcf4aaa699b50154aa245923c86 (MISP Attribute #18182) Malware Artifacts File Hash Watchlist Artifacts dropped: 5c3f0dcf4aaa699b50154aa245923c86 (MISP Attribute #18182) MD5 5c3f0dcf4aaa699b50154aa245923c86 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 7fd98d6bb1e9d6bcf2e1984e812c1e46 (MISP Attribute #18183) Malware Artifacts File Hash Watchlist Artifacts dropped: 7fd98d6bb1e9d6bcf2e1984e812c1e46 (MISP Attribute #18183) MD5 7fd98d6bb1e9d6bcf2e1984e812c1e46 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 89180820b47bb11ccf0c8505371e98d1 (MISP Attribute #18184) Malware Artifacts File Hash Watchlist Artifacts dropped: 89180820b47bb11ccf0c8505371e98d1 (MISP Attribute #18184) MD5 89180820b47bb11ccf0c8505371e98d1 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 8bb2ba6f1cfa3bd99146688cd1e76bb0 (MISP Attribute #18185) Malware Artifacts File Hash Watchlist Artifacts dropped: 8bb2ba6f1cfa3bd99146688cd1e76bb0 (MISP Attribute #18185) MD5 8bb2ba6f1cfa3bd99146688cd1e76bb0 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 8c8eb5cfc5642a773c5f2b5f59148aa3 (MISP Attribute #18186) Malware Artifacts File Hash Watchlist Artifacts dropped: 8c8eb5cfc5642a773c5f2b5f59148aa3 (MISP Attribute #18186) MD5 8c8eb5cfc5642a773c5f2b5f59148aa3 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 8fea3de31a58415c3fec2e6dd4095575 (MISP Attribute #18187) Malware Artifacts File Hash Watchlist Artifacts dropped: 8fea3de31a58415c3fec2e6dd4095575 (MISP Attribute #18187) MD5 8fea3de31a58415c3fec2e6dd4095575 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 9b0de56f7f862db73e223f41099fc74c (MISP Attribute #18188) Malware Artifacts File Hash Watchlist Artifacts dropped: 9b0de56f7f862db73e223f41099fc74c (MISP Attribute #18188) MD5 9b0de56f7f862db73e223f41099fc74c None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: be8a344487bcfea66de8e0f0f14d869e (MISP Attribute #18189) Malware Artifacts File Hash Watchlist Artifacts dropped: be8a344487bcfea66de8e0f0f14d869e (MISP Attribute #18189) MD5 be8a344487bcfea66de8e0f0f14d869e None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: df0045bd4168893922480f7ccb29860a (MISP Attribute #18190) Malware Artifacts File Hash Watchlist Artifacts dropped: df0045bd4168893922480f7ccb29860a (MISP Attribute #18190) MD5 df0045bd4168893922480f7ccb29860a None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: e436e849d9496ef3f651c1904786c78f (MISP Attribute #18191) Malware Artifacts File Hash Watchlist Artifacts dropped: e436e849d9496ef3f651c1904786c78f (MISP Attribute #18191) MD5 e436e849d9496ef3f651c1904786c78f None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: e80d8a0c35133f7485d8e87ade903919 (MISP Attribute #18192) Malware Artifacts File Hash Watchlist Artifacts dropped: e80d8a0c35133f7485d8e87ade903919 (MISP Attribute #18192) MD5 e80d8a0c35133f7485d8e87ade903919 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: f36e67109ae368c9db109d0a41b5817c (MISP Attribute #18193) Malware Artifacts File Hash Watchlist Artifacts dropped: f36e67109ae368c9db109d0a41b5817c (MISP Attribute #18193) MD5 f36e67109ae368c9db109d0a41b5817c None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 08b8b4787f3ce90c6c1483cc127b1cdc (MISP Attribute #18194) Malware Artifacts File Hash Watchlist Artifacts dropped: 08b8b4787f3ce90c6c1483cc127b1cdc (MISP Attribute #18194) MD5 08b8b4787f3ce90c6c1483cc127b1cdc None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 205a5502ff0da4a471c4dad0e06c6c57 (MISP Attribute #18195) Malware Artifacts File Hash Watchlist Artifacts dropped: 205a5502ff0da4a471c4dad0e06c6c57 (MISP Attribute #18195) MD5 205a5502ff0da4a471c4dad0e06c6c57 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 32bc51088953377d601c6b27ca7484a9 (MISP Attribute #18196) Malware Artifacts File Hash Watchlist Artifacts dropped: 32bc51088953377d601c6b27ca7484a9 (MISP Attribute #18196) MD5 32bc51088953377d601c6b27ca7484a9 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 3729531c71163cddcded7e70c02a3004 (MISP Attribute #18197) Malware Artifacts File Hash Watchlist Artifacts dropped: 3729531c71163cddcded7e70c02a3004 (MISP Attribute #18197) MD5 3729531c71163cddcded7e70c02a3004 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 43b39fd4ddc386092372da19f6278c25 (MISP Attribute #18198) Malware Artifacts File Hash Watchlist Artifacts dropped: 43b39fd4ddc386092372da19f6278c25 (MISP Attribute #18198) MD5 43b39fd4ddc386092372da19f6278c25 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 4fe4094302c26e7ea2c58f5ca9f7f993 (MISP Attribute #18199) Malware Artifacts File Hash Watchlist Artifacts dropped: 4fe4094302c26e7ea2c58f5ca9f7f993 (MISP Attribute #18199) MD5 4fe4094302c26e7ea2c58f5ca9f7f993 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 58239ea5747d3375278ce7c04db22c1b (MISP Attribute #18200) Malware Artifacts File Hash Watchlist Artifacts dropped: 58239ea5747d3375278ce7c04db22c1b (MISP Attribute #18200) MD5 58239ea5747d3375278ce7c04db22c1b None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 6491df10c766be9c487fb9495d04df6e (MISP Attribute #18201) Malware Artifacts File Hash Watchlist Artifacts dropped: 6491df10c766be9c487fb9495d04df6e (MISP Attribute #18201) MD5 6491df10c766be9c487fb9495d04df6e None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 6a442a610c047a7a306a12f423978bfb (MISP Attribute #18202) Malware Artifacts File Hash Watchlist Artifacts dropped: 6a442a610c047a7a306a12f423978bfb (MISP Attribute #18202) MD5 6a442a610c047a7a306a12f423978bfb None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 6ce947913231bd968c86a2737bae7bba (MISP Attribute #18203) Malware Artifacts File Hash Watchlist Artifacts dropped: 6ce947913231bd968c86a2737bae7bba (MISP Attribute #18203) MD5 6ce947913231bd968c86a2737bae7bba None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 7ad8ad340c084f8185e2bb18cbfde891 (MISP Attribute #18204) Malware Artifacts File Hash Watchlist Artifacts dropped: 7ad8ad340c084f8185e2bb18cbfde891 (MISP Attribute #18204) MD5 7ad8ad340c084f8185e2bb18cbfde891 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 90373539c60529153d0d6b0cc857e845 (MISP Attribute #18205) Malware Artifacts File Hash Watchlist Artifacts dropped: 90373539c60529153d0d6b0cc857e845 (MISP Attribute #18205) MD5 90373539c60529153d0d6b0cc857e845 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: a5ae6e0d74052d4f889f2538fdd7cb9b (MISP Attribute #18206) Malware Artifacts File Hash Watchlist Artifacts dropped: a5ae6e0d74052d4f889f2538fdd7cb9b (MISP Attribute #18206) MD5 a5ae6e0d74052d4f889f2538fdd7cb9b None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 08d971f5f4707ae6ea56ed2f243c38b7 (MISP Attribute #18169) Malware Artifacts File Hash Watchlist Artifacts dropped: 08d971f5f4707ae6ea56ed2f243c38b7 (MISP Attribute #18169) MD5 08d971f5f4707ae6ea56ed2f243c38b7 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 20755b98d7c094747b75b157413e3422 (MISP Attribute #18170) Malware Artifacts File Hash Watchlist Artifacts dropped: 20755b98d7c094747b75b157413e3422 (MISP Attribute #18170) MD5 20755b98d7c094747b75b157413e3422 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 3632fb080545d3518d57320466f96cb3 (MISP Attribute #18171) Malware Artifacts File Hash Watchlist Artifacts dropped: 3632fb080545d3518d57320466f96cb3 (MISP Attribute #18171) MD5 3632fb080545d3518d57320466f96cb3 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 40383bee9846ecbd78581402e3379051 (MISP Attribute #18172) Malware Artifacts File Hash Watchlist Artifacts dropped: 40383bee9846ecbd78581402e3379051 (MISP Attribute #18172) MD5 40383bee9846ecbd78581402e3379051 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 449ba12127133ecd0440a558b083468c (MISP Attribute #18173) Malware Artifacts File Hash Watchlist Artifacts dropped: 449ba12127133ecd0440a558b083468c (MISP Attribute #18173) MD5 449ba12127133ecd0440a558b083468c None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 461446151be0033a668782c2d7ba58cb (MISP Attribute #18174) Malware Artifacts File Hash Watchlist Artifacts dropped: 461446151be0033a668782c2d7ba58cb (MISP Attribute #18174) MD5 461446151be0033a668782c2d7ba58cb None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 56bc314bc0d4a0a230a4de2bf978b5ae (MISP Attribute #18175) Malware Artifacts File Hash Watchlist Artifacts dropped: 56bc314bc0d4a0a230a4de2bf978b5ae (MISP Attribute #18175) MD5 56bc314bc0d4a0a230a4de2bf978b5ae None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: document.downloadingsystem.com (MISP Attribute #18208) Malware Artifacts Domain Watchlist Network activity: document.downloadingsystem.com (MISP Attribute #18208) document.downloadingsystem.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: epoch.englishdownloaders.today (MISP Attribute #18209) Malware Artifacts Domain Watchlist Network activity: epoch.englishdownloaders.today (MISP Attribute #18209) epoch.englishdownloaders.today High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: internet.downloadingdocuments.com (MISP Attribute #18210) Malware Artifacts Domain Watchlist Network activity: internet.downloadingdocuments.com (MISP Attribute #18210) internet.downloadingdocuments.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: system.filedownloaders.com (MISP Attribute #18211) Malware Artifacts Domain Watchlist Network activity: system.filedownloaders.com (MISP Attribute #18211) system.filedownloaders.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: upd-ms3-app-state.com (MISP Attribute #18212) Malware Artifacts Domain Watchlist Network activity: upd-ms3-app-state.com (MISP Attribute #18212) upd-ms3-app-state.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: bombinate.winload.info (MISP Attribute #18213) Malware Artifacts Domain Watchlist Network activity: bombinate.winload.info (MISP Attribute #18213) bombinate.winload.info High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: epoch.uploaders.online (MISP Attribute #18214) Malware Artifacts Domain Watchlist Network activity: epoch.uploaders.online (MISP Attribute #18214) epoch.uploaders.online High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: solitude.filedownloads.online (MISP Attribute #18215) Malware Artifacts Domain Watchlist Network activity: solitude.filedownloads.online (MISP Attribute #18215) solitude.filedownloads.online High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: download.downloading.shop (MISP Attribute #18152) Malware Artifacts Domain Watchlist Network activity: download.downloading.shop (MISP Attribute #18152) download.downloading.shop High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: downloading.syriantelecom.co (MISP Attribute #18153) Malware Artifacts Domain Watchlist Network activity: downloading.syriantelecom.co (MISP Attribute #18153) downloading.syriantelecom.co High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: download.syriantelecommunications.co (MISP Attribute #18154) Malware Artifacts Domain Watchlist Network activity: download.syriantelecommunications.co (MISP Attribute #18154) download.syriantelecommunications.co High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: redirection.bid (MISP Attribute #18155) Malware Artifacts Domain Watchlist Network activity: redirection.bid (MISP Attribute #18155) redirection.bid High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: downloading.internetdownloading.co (MISP Attribute #18156) Malware Artifacts Domain Watchlist Network activity: downloading.internetdownloading.co (MISP Attribute #18156) downloading.internetdownloading.co High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: download.downloadering.co (MISP Attribute #18157) Malware Artifacts Domain Watchlist Network activity: download.downloadering.co (MISP Attribute #18157) download.downloadering.co High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: updserv-east-cdn3.com (MISP Attribute #18158) Malware Artifacts Domain Watchlist Network activity: updserv-east-cdn3.com (MISP Attribute #18158) updserv-east-cdn3.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: computing.downloaders.today (MISP Attribute #18159) Malware Artifacts Domain Watchlist Network activity: computing.downloaders.today (MISP Attribute #18159) computing.downloaders.today High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: storage.computingdownloads.life (MISP Attribute #18160) Malware Artifacts Domain Watchlist Network activity: storage.computingdownloads.life (MISP Attribute #18160) storage.computingdownloads.life High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: window.processingdownloads.today (MISP Attribute #18161) Malware Artifacts Domain Watchlist Network activity: window.processingdownloads.today (MISP Attribute #18161) window.processingdownloads.today High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ms-cdn-88.com (MISP Attribute #18162) Malware Artifacts Domain Watchlist Network activity: ms-cdn-88.com (MISP Attribute #18162) ms-cdn-88.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: solitude.file-download.today (MISP Attribute #18163) Malware Artifacts Domain Watchlist Network activity: solitude.file-download.today (MISP Attribute #18163) solitude.file-download.today High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: system.documentations.live (MISP Attribute #18164) Malware Artifacts Domain Watchlist Network activity: system.documentations.live (MISP Attribute #18164) system.documentations.live High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: epiphany.download-document.world (MISP Attribute #18165) Malware Artifacts Domain Watchlist Network activity: epiphany.download-document.world (MISP Attribute #18165) epiphany.download-document.world High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: epoch.wind-files.today (MISP Attribute #18166) Malware Artifacts Domain Watchlist Network activity: epoch.wind-files.today (MISP Attribute #18166) epoch.wind-files.today High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: internet.document-management.today (MISP Attribute #18167) Malware Artifacts Domain Watchlist Network activity: internet.document-management.today (MISP Attribute #18167) internet.document-management.today High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: cdn-upd-ms6.com (MISP Attribute #18168) Malware Artifacts Domain Watchlist Network activity: cdn-upd-ms6.com (MISP Attribute #18168) cdn-upd-ms6.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Event Threat Level: High MISP Tag: SOURCE:CITIZENLAB MISP Tag: DETECT MISP Tag: TARGET:SYRIA MISP Tag: TARGET:EGYPT MISP Tag: TARGET:TURKEY citizenlab ../../../descendant-or-self::node()