Export from MISP Threat Report Packrat: Seven Years of a South American Threat Actor (MISP Event #12) Threat Report Payload type: CyberGate (MISP Attribute #1350) CyberGate Payload type: Xtreme RAT (MISP Attribute #1351) Xtreme RAT Payload type: AlienSpy (MISP Attribute #1352) AlienSpy Payload type: Adzok (MISP Attribute #1353) Adzok Packrat: Seven Years of a South American Threat Actor 12 2015-12-08T00:00:00+00:00 2016-11-08T16:38:11+00:00 Closed Artifacts dropped Artifacts dropped: a988235ad7d47acbeca5ccb4ea5a1ed5 (MISP Attribute #539) Malware Artifacts File Hash Watchlist Artifacts dropped: a988235ad7d47acbeca5ccb4ea5a1ed5 (MISP Attribute #539) MD5 a988235ad7d47acbeca5ccb4ea5a1ed5 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 15ebe16cd9500de534d5bfd5eeceaf73 (MISP Attribute #540) Malware Artifacts File Hash Watchlist Artifacts dropped: 15ebe16cd9500de534d5bfd5eeceaf73 (MISP Attribute #540) MD5 15ebe16cd9500de534d5bfd5eeceaf73 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 01dec1b1d0760d5a1a562edcfeb478d1 (MISP Attribute #541) Malware Artifacts File Hash Watchlist Artifacts dropped: 01dec1b1d0760d5a1a562edcfeb478d1 (MISP Attribute #541) MD5 01dec1b1d0760d5a1a562edcfeb478d1 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 1e6d0b59d4fb7650453c207688385f3a (MISP Attribute #542) Malware Artifacts File Hash Watchlist Artifacts dropped: 1e6d0b59d4fb7650453c207688385f3a (MISP Attribute #542) MD5 1e6d0b59d4fb7650453c207688385f3a High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: e03be1849ad7cecba1e20923074cd22f (MISP Attribute #543) Malware Artifacts File Hash Watchlist Artifacts dropped: e03be1849ad7cecba1e20923074cd22f (MISP Attribute #543) MD5 e03be1849ad7cecba1e20923074cd22f High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 779a79c11f581b84e7c81f321fd8d743 (MISP Attribute #544) Malware Artifacts File Hash Watchlist Artifacts dropped: 779a79c11f581b84e7c81f321fd8d743 (MISP Attribute #544) MD5 779a79c11f581b84e7c81f321fd8d743 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 13d939b2412c6adbab3cc1b539166671 (MISP Attribute #545) Malware Artifacts File Hash Watchlist Artifacts dropped: 13d939b2412c6adbab3cc1b539166671 (MISP Attribute #545) MD5 13d939b2412c6adbab3cc1b539166671 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 7b2cb5249d704cb1df8d4210e7c3d553 (MISP Attribute #546) Malware Artifacts File Hash Watchlist Artifacts dropped: 7b2cb5249d704cb1df8d4210e7c3d553 (MISP Attribute #546) MD5 7b2cb5249d704cb1df8d4210e7c3d553 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: a09f100ddc7cf29f8a93a3d7a79c58b9 (MISP Attribute #547) Malware Artifacts File Hash Watchlist Artifacts dropped: a09f100ddc7cf29f8a93a3d7a79c58b9 (MISP Attribute #547) MD5 a09f100ddc7cf29f8a93a3d7a79c58b9 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: ce6065346a918a813eeb58bbb0814a23 (MISP Attribute #548) Malware Artifacts File Hash Watchlist Artifacts dropped: ce6065346a918a813eeb58bbb0814a23 (MISP Attribute #548) MD5 ce6065346a918a813eeb58bbb0814a23 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: ea50bf8abcf9c0c40c4490dc15fb0a2a (MISP Attribute #549) Malware Artifacts File Hash Watchlist Artifacts dropped: ea50bf8abcf9c0c40c4490dc15fb0a2a (MISP Attribute #549) MD5 ea50bf8abcf9c0c40c4490dc15fb0a2a High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 3a61d64986ee6529cee271ab6754faa5 (MISP Attribute #550) Malware Artifacts File Hash Watchlist Artifacts dropped: 3a61d64986ee6529cee271ab6754faa5 (MISP Attribute #550) MD5 3a61d64986ee6529cee271ab6754faa5 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 695db7dd3b1daf89f2c56d59faecc088 (MISP Attribute #551) Malware Artifacts File Hash Watchlist Artifacts dropped: 695db7dd3b1daf89f2c56d59faecc088 (MISP Attribute #551) MD5 695db7dd3b1daf89f2c56d59faecc088 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: ea7bcf58a4ccdecb0c64e56b9998a4ac (MISP Attribute #552) Malware Artifacts File Hash Watchlist Artifacts dropped: ea7bcf58a4ccdecb0c64e56b9998a4ac (MISP Attribute #552) MD5 ea7bcf58a4ccdecb0c64e56b9998a4ac High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: efc0009d76a2057f86c5f00030378c72 (MISP Attribute #553) Malware Artifacts File Hash Watchlist Artifacts dropped: efc0009d76a2057f86c5f00030378c72 (MISP Attribute #553) MD5 efc0009d76a2057f86c5f00030378c72 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 74613eae84347183b4ca61b912a4573f (MISP Attribute #554) Malware Artifacts File Hash Watchlist Artifacts dropped: 74613eae84347183b4ca61b912a4573f (MISP Attribute #554) MD5 74613eae84347183b4ca61b912a4573f High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: bc97437fec7e7e8634c2eabae3cc4832 (MISP Attribute #555) Malware Artifacts File Hash Watchlist Artifacts dropped: bc97437fec7e7e8634c2eabae3cc4832 (MISP Attribute #555) MD5 bc97437fec7e7e8634c2eabae3cc4832 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: dd1101adc86fd282f5f183942cc2f3b7 (MISP Attribute #556) Malware Artifacts File Hash Watchlist Artifacts dropped: dd1101adc86fd282f5f183942cc2f3b7 (MISP Attribute #556) MD5 dd1101adc86fd282f5f183942cc2f3b7 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 2d722592a4e3c8030410dccccb221ce4 (MISP Attribute #557) Malware Artifacts File Hash Watchlist Artifacts dropped: 2d722592a4e3c8030410dccccb221ce4 (MISP Attribute #557) MD5 2d722592a4e3c8030410dccccb221ce4 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: d2adecc6287dd4d559fe6ce2ce7a7e31 (MISP Attribute #558) Malware Artifacts File Hash Watchlist Artifacts dropped: d2adecc6287dd4d559fe6ce2ce7a7e31 (MISP Attribute #558) MD5 d2adecc6287dd4d559fe6ce2ce7a7e31 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 93b630891db21a4a2350280a360c713d (MISP Attribute #559) Malware Artifacts File Hash Watchlist Artifacts dropped: 93b630891db21a4a2350280a360c713d (MISP Attribute #559) MD5 93b630891db21a4a2350280a360c713d High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: a73351623577f44a2b578fed1e78e37e (MISP Attribute #560) Malware Artifacts File Hash Watchlist Artifacts dropped: a73351623577f44a2b578fed1e78e37e (MISP Attribute #560) MD5 a73351623577f44a2b578fed1e78e37e High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 5a8975873f52436377d8fb0b5ab0d87a (MISP Attribute #561) Malware Artifacts File Hash Watchlist Artifacts dropped: 5a8975873f52436377d8fb0b5ab0d87a (MISP Attribute #561) MD5 5a8975873f52436377d8fb0b5ab0d87a High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: ed8d7ed45b64890b8901b735018318f3 (MISP Attribute #562) Malware Artifacts File Hash Watchlist Artifacts dropped: ed8d7ed45b64890b8901b735018318f3 (MISP Attribute #562) MD5 ed8d7ed45b64890b8901b735018318f3 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: c2237e9d415f542ce6e73adb260af123 (MISP Attribute #563) Malware Artifacts File Hash Watchlist Artifacts dropped: c2237e9d415f542ce6e73adb260af123 (MISP Attribute #563) MD5 c2237e9d415f542ce6e73adb260af123 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 2827450763b55c5e71fda3caaf8e75f9 (MISP Attribute #564) Malware Artifacts File Hash Watchlist Artifacts dropped: 2827450763b55c5e71fda3caaf8e75f9 (MISP Attribute #564) MD5 2827450763b55c5e71fda3caaf8e75f9 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: d7f34168b1a7dd7cbd8e62a5ab1ebc0e (MISP Attribute #565) Malware Artifacts File Hash Watchlist Artifacts dropped: d7f34168b1a7dd7cbd8e62a5ab1ebc0e (MISP Attribute #565) MD5 d7f34168b1a7dd7cbd8e62a5ab1ebc0e High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 6c34d4296126679d9c6a0bc2660dc453 (MISP Attribute #566) Malware Artifacts File Hash Watchlist Artifacts dropped: 6c34d4296126679d9c6a0bc2660dc453 (MISP Attribute #566) MD5 6c34d4296126679d9c6a0bc2660dc453 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: d2f151312f7dee2483ddcab9766b56db (MISP Attribute #567) Malware Artifacts File Hash Watchlist Artifacts dropped: d2f151312f7dee2483ddcab9766b56db (MISP Attribute #567) MD5 d2f151312f7dee2483ddcab9766b56db High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 1e4265a0c37773c2372b97bb6630ae57 (MISP Attribute #568) Malware Artifacts File Hash Watchlist Artifacts dropped: 1e4265a0c37773c2372b97bb6630ae57 (MISP Attribute #568) MD5 1e4265a0c37773c2372b97bb6630ae57 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 08a3bb5b220eb1e0dc2ecccbbc6859f5 (MISP Attribute #569) Malware Artifacts File Hash Watchlist Artifacts dropped: 08a3bb5b220eb1e0dc2ecccbbc6859f5 (MISP Attribute #569) MD5 08a3bb5b220eb1e0dc2ecccbbc6859f5 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 2de51e74fd571319bbf763ec62781096 (MISP Attribute #570) Malware Artifacts File Hash Watchlist Artifacts dropped: 2de51e74fd571319bbf763ec62781096 (MISP Attribute #570) MD5 2de51e74fd571319bbf763ec62781096 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 8fb96dfab7e4c0acb1eb9f4e950ba4b9 (MISP Attribute #571) Malware Artifacts File Hash Watchlist Artifacts dropped: 8fb96dfab7e4c0acb1eb9f4e950ba4b9 (MISP Attribute #571) MD5 8fb96dfab7e4c0acb1eb9f4e950ba4b9 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 4a23a1d6779d199aaa582cf0a5868ad1 (MISP Attribute #572) Malware Artifacts File Hash Watchlist Artifacts dropped: 4a23a1d6779d199aaa582cf0a5868ad1 (MISP Attribute #572) MD5 4a23a1d6779d199aaa582cf0a5868ad1 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 0ae0038ffe8cf5c3170734a71ff2213d (MISP Attribute #573) Malware Artifacts File Hash Watchlist Artifacts dropped: 0ae0038ffe8cf5c3170734a71ff2213d (MISP Attribute #573) MD5 0ae0038ffe8cf5c3170734a71ff2213d High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 8e0f021dcbbfa586a1c6780e77ac0fb6 (MISP Attribute #574) Malware Artifacts File Hash Watchlist Artifacts dropped: 8e0f021dcbbfa586a1c6780e77ac0fb6 (MISP Attribute #574) MD5 8e0f021dcbbfa586a1c6780e77ac0fb6 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: a74ef893b1bf21c9df6d8e31285db981 (MISP Attribute #575) Malware Artifacts File Hash Watchlist Artifacts dropped: a74ef893b1bf21c9df6d8e31285db981 (MISP Attribute #575) MD5 a74ef893b1bf21c9df6d8e31285db981 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: HKLM\SOFTWARE\Microsoft\Active (MISP Attribute #576) Malware Artifacts Host Characteristics Artifacts dropped: HKLM\SOFTWARE\Microsoft\Active (MISP Attribute #576) SOFTWARE\Microsoft\Active HKEY_LOCAL_MACHINE ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies (MISP Attribute #577) Malware Artifacts Host Characteristics Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies (MISP Attribute #577) SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies HKEY_LOCAL_MACHINE ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig (MISP Attribute #578) Malware Artifacts Host Characteristics Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig (MISP Attribute #578) SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig HKEY_LOCAL_MACHINE ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: taskmgr.redirectme.net (MISP Attribute #580) Malware Artifacts Domain Watchlist Network activity: taskmgr.redirectme.net (MISP Attribute #580) taskmgr.redirectme.net ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ftp.server.com (MISP Attribute #581) Malware Artifacts Domain Watchlist Network activity: ftp.server.com (MISP Attribute #581) ftp.server.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: update-outlook.info (MISP Attribute #582) Malware Artifacts Domain Watchlist Network activity: update-outlook.info (MISP Attribute #582) update-outlook.info ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: deyrep.com (MISP Attribute #583) Malware Artifacts Domain Watchlist Network activity: deyrep.com (MISP Attribute #583) deyrep.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: support-whatsapp.com (MISP Attribute #584) Malware Artifacts Domain Watchlist Network activity: support-whatsapp.com (MISP Attribute #584) support-whatsapp.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: blackboxmusic.co (MISP Attribute #585) Malware Artifacts Domain Watchlist Network activity: blackboxmusic.co (MISP Attribute #585) blackboxmusic.co ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: www.blackboxmusic.co (MISP Attribute #586) Malware Artifacts Domain Watchlist Network activity: www.blackboxmusic.co (MISP Attribute #586) www.blackboxmusic.co ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: mail-account-update.com (MISP Attribute #587) Malware Artifacts Domain Watchlist Network activity: mail-account-update.com (MISP Attribute #587) mail-account-update.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: lavozmericana.info (MISP Attribute #588) Malware Artifacts Domain Watchlist Network activity: lavozmericana.info (MISP Attribute #588) lavozmericana.info ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: support-java.com (MISP Attribute #589) Malware Artifacts Domain Watchlist Network activity: support-java.com (MISP Attribute #589) support-java.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: n3.pancaliente.info (MISP Attribute #590) Malware Artifacts Domain Watchlist Network activity: n3.pancaliente.info (MISP Attribute #590) n3.pancaliente.info ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: n4.pancaliente.info (MISP Attribute #591) Malware Artifacts Domain Watchlist Network activity: n4.pancaliente.info (MISP Attribute #591) n4.pancaliente.info ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ns1.deyrep.com (MISP Attribute #592) Malware Artifacts Domain Watchlist Network activity: ns1.deyrep.com (MISP Attribute #592) ns1.deyrep.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ns2.deyrep.com (MISP Attribute #593) Malware Artifacts Domain Watchlist Network activity: ns2.deyrep.com (MISP Attribute #593) ns2.deyrep.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: n1.login-office365.com (MISP Attribute #594) Malware Artifacts Domain Watchlist Network activity: n1.login-office365.com (MISP Attribute #594) n1.login-office365.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: n2.login-office365.com (MISP Attribute #595) Malware Artifacts Domain Watchlist Network activity: n2.login-office365.com (MISP Attribute #595) n2.login-office365.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: n1.update-outlook.info (MISP Attribute #596) Malware Artifacts Domain Watchlist Network activity: n1.update-outlook.info (MISP Attribute #596) n1.update-outlook.info ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ns.update-outlook.info (MISP Attribute #597) Malware Artifacts Domain Watchlist Network activity: ns.update-outlook.info (MISP Attribute #597) ns.update-outlook.info ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: s1.mgoogle.us (MISP Attribute #598) Malware Artifacts Domain Watchlist Network activity: s1.mgoogle.us (MISP Attribute #598) s1.mgoogle.us ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: s2.mgoogle.us (MISP Attribute #599) Malware Artifacts Domain Watchlist Network activity: s2.mgoogle.us (MISP Attribute #599) s2.mgoogle.us ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: support-login-validate-outlook.tk (MISP Attribute #600) Malware Artifacts Domain Watchlist Network activity: support-login-validate-outlook.tk (MISP Attribute #600) support-login-validate-outlook.tk ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: verify-gmail-support-secure.tk (MISP Attribute #601) Malware Artifacts Domain Watchlist Network activity: verify-gmail-support-secure.tk (MISP Attribute #601) verify-gmail-support-secure.tk ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: soporte-login-account-gmail.tk (MISP Attribute #602) Malware Artifacts Domain Watchlist Network activity: soporte-login-account-gmail.tk (MISP Attribute #602) soporte-login-account-gmail.tk ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: soporte-login-account-yahoo.tk (MISP Attribute #603) Malware Artifacts Domain Watchlist Network activity: soporte-login-account-yahoo.tk (MISP Attribute #603) soporte-login-account-yahoo.tk ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: n1.support-java.com (MISP Attribute #604) Malware Artifacts Domain Watchlist Network activity: n1.support-java.com (MISP Attribute #604) n1.support-java.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: n1.lavozamericana.info (MISP Attribute #605) Malware Artifacts Domain Watchlist Network activity: n1.lavozamericana.info (MISP Attribute #605) n1.lavozamericana.info ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: s1.support (MISP Attribute #606) Malware Artifacts Domain Watchlist Network activity: s1.support (MISP Attribute #606) s1.support ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ns1.ukraine.com.ua (MISP Attribute #607) Malware Artifacts Domain Watchlist Network activity: ns1.ukraine.com.ua (MISP Attribute #607) ns1.ukraine.com.ua ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: android-flash.com (MISP Attribute #608) Malware Artifacts Domain Watchlist Network activity: android-flash.com (MISP Attribute #608) android-flash.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: deyrep24.ddns.net (MISP Attribute #609) Malware Artifacts Domain Watchlist Network activity: deyrep24.ddns.net (MISP Attribute #609) deyrep24.ddns.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: daynews.sytes.net (MISP Attribute #610) Malware Artifacts Domain Watchlist Network activity: daynews.sytes.net (MISP Attribute #610) daynews.sytes.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: taskmgr.serveftp.com (MISP Attribute #611) Malware Artifacts Domain Watchlist Network activity: taskmgr.serveftp.com (MISP Attribute #611) taskmgr.serveftp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: taskmgr.servehttp.com (MISP Attribute #612) Malware Artifacts Domain Watchlist Network activity: taskmgr.servehttp.com (MISP Attribute #612) taskmgr.servehttp.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: taskmgr.redirectme.com (MISP Attribute #613) Malware Artifacts Domain Watchlist Network activity: taskmgr.redirectme.com (MISP Attribute #613) taskmgr.redirectme.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ruley.no-ip.org (MISP Attribute #614) Malware Artifacts Domain Watchlist Network activity: ruley.no-ip.org (MISP Attribute #614) ruley.no-ip.org ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: lolinha.no-ip.org (MISP Attribute #615) Malware Artifacts Domain Watchlist Network activity: lolinha.no-ip.org (MISP Attribute #615) lolinha.no-ip.org ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: wjwj.no-ip.org (MISP Attribute #616) Malware Artifacts Domain Watchlist Network activity: wjwj.no-ip.org (MISP Attribute #616) wjwj.no-ip.org ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: conhost.servehttp.com (MISP Attribute #617) Malware Artifacts Domain Watchlist Network activity: conhost.servehttp.com (MISP Attribute #617) conhost.servehttp.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: dllhost.servehttp.com (MISP Attribute #618) Malware Artifacts Domain Watchlist Network activity: dllhost.servehttp.com (MISP Attribute #618) dllhost.servehttp.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: wjwjwj.no-ip.org (MISP Attribute #619) Malware Artifacts Domain Watchlist Network activity: wjwjwj.no-ip.org (MISP Attribute #619) wjwjwj.no-ip.org ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: wjwjwjwj.no-ip.org (MISP Attribute #620) Malware Artifacts Domain Watchlist Network activity: wjwjwjwj.no-ip.org (MISP Attribute #620) wjwjwjwj.no-ip.org ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ecuadorenvivo.co (MISP Attribute #621) Malware Artifacts Domain Watchlist Network activity: ecuadorenvivo.co (MISP Attribute #621) ecuadorenvivo.co ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ecuadorenvivo.com (MISP Attribute #622) Malware Artifacts Domain Watchlist Network activity: ecuadorenvivo.com (MISP Attribute #622) ecuadorenvivo.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: www.movimientoanticorreista.com (MISP Attribute #623) Malware Artifacts Domain Watchlist Network activity: www.movimientoanticorreista.com (MISP Attribute #623) www.movimientoanticorreista.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: focusecuador.tk (MISP Attribute #624) Malware Artifacts Domain Watchlist Network activity: focusecuador.tk (MISP Attribute #624) focusecuador.tk ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: mesvr.com (MISP Attribute #625) Malware Artifacts Domain Watchlist Network activity: mesvr.com (MISP Attribute #625) mesvr.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ftp.ftpserver.com (MISP Attribute #626) Malware Artifacts Domain Watchlist Network activity: ftp.ftpserver.com (MISP Attribute #626) ftp.ftpserver.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: lavozamericana.info (MISP Attribute #627) Malware Artifacts Domain Watchlist Network activity: lavozamericana.info (MISP Attribute #627) lavozamericana.info ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ec.cu9.co (MISP Attribute #628) Malware Artifacts Domain Watchlist Network activity: ec.cu9.co (MISP Attribute #628) ec.cu9.co ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: movimientoanticorreista.com (MISP Attribute #629) Malware Artifacts Domain Watchlist Network activity: movimientoanticorreista.com (MISP Attribute #629) movimientoanticorreista.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: mgoogle.us (MISP Attribute #630) Malware Artifacts Domain Watchlist Network activity: mgoogle.us (MISP Attribute #630) mgoogle.us ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: no.response.delivery.es (MISP Attribute #631) Malware Artifacts Domain Watchlist Network activity: no.response.delivery.es (MISP Attribute #631) no.response.delivery.es ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: cu9.co (MISP Attribute #632) Malware Artifacts Domain Watchlist Network activity: cu9.co (MISP Attribute #632) cu9.co ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: asambleanacional-gob-ec.cu9.co (MISP Attribute #634) Malware Artifacts Domain Watchlist Network activity: asambleanacional-gob-ec.cu9.co (MISP Attribute #634) asambleanacional-gob-ec.cu9.co ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: mail.asambleanacional.gob.ec (MISP Attribute #635) Malware Artifacts Domain Watchlist Network activity: mail.asambleanacional.gob.ec (MISP Attribute #635) mail.asambleanacional.gob.ec ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: formmail.com (MISP Attribute #636) Malware Artifacts Domain Watchlist Network activity: formmail.com (MISP Attribute #636) formmail.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: login-office365.com (MISP Attribute #637) Malware Artifacts Domain Watchlist Network activity: login-office365.com (MISP Attribute #637) login-office365.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: pancaliente.info (MISP Attribute #638) Malware Artifacts Domain Watchlist Network activity: pancaliente.info (MISP Attribute #638) pancaliente.info ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: focusecuador.net (MISP Attribute #639) Malware Artifacts Domain Watchlist Network activity: focusecuador.net (MISP Attribute #639) focusecuador.net ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: gmail.com.msg07.xyz (MISP Attribute #641) Malware Artifacts Domain Watchlist Network activity: gmail.com.msg07.xyz (MISP Attribute #641) gmail.com.msg07.xyz ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: supportgmai1.com (MISP Attribute #642) Malware Artifacts Domain Watchlist Network activity: supportgmai1.com (MISP Attribute #642) supportgmai1.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: chavistas24.com (MISP Attribute #643) Malware Artifacts Domain Watchlist Network activity: chavistas24.com (MISP Attribute #643) chavistas24.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ns1.hostinger.ru (MISP Attribute #644) Malware Artifacts Domain Watchlist Network activity: ns1.hostinger.ru (MISP Attribute #644) ns1.hostinger.ru ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: venezuela365.com (MISP Attribute #645) Malware Artifacts Domain Watchlist Network activity: venezuela365.com (MISP Attribute #645) venezuela365.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 24.com (MISP Attribute #646) Malware Artifacts Domain Watchlist Network activity: 24.com (MISP Attribute #646) 24.com ../../../descendant-or-self::node() None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: justicia-desvinculados.com (MISP Attribute #647) Malware Artifacts Domain Watchlist Network activity: justicia-desvinculados.com (MISP Attribute #647) justicia-desvinculados.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 50.62.133.49 (MISP Attribute #648) Malware Artifacts IP Watchlist Network activity: 50.62.133.49 (MISP Attribute #648) 50.62.133.49 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 192.169.243.65 (MISP Attribute #649) Malware Artifacts IP Watchlist Network activity: 192.169.243.65 (MISP Attribute #649) 192.169.243.65 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 190.210.180.181 (MISP Attribute #650) Malware Artifacts IP Watchlist Network activity: 190.210.180.181 (MISP Attribute #650) 190.210.180.181 ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 201.52.24.126 (MISP Attribute #651) Malware Artifacts IP Watchlist Network activity: 201.52.24.126 (MISP Attribute #651) 201.52.24.126 ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 190.20.180.181 (MISP Attribute #652) Malware Artifacts IP Watchlist Network activity: 190.20.180.181 (MISP Attribute #652) 190.20.180.181 ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 186.220.1.84 (MISP Attribute #653) Malware Artifacts IP Watchlist Network activity: 186.220.1.84 (MISP Attribute #653) 186.220.1.84 ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 186.220.11.67 (MISP Attribute #654) Malware Artifacts IP Watchlist Network activity: 186.220.11.67 (MISP Attribute #654) 186.220.11.67 ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 189.100.148.188 (MISP Attribute #655) Malware Artifacts IP Watchlist Network activity: 189.100.148.188 (MISP Attribute #655) 189.100.148.188 ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 179.208.187.216 (MISP Attribute #656) Malware Artifacts IP Watchlist Network activity: 179.208.187.216 (MISP Attribute #656) 179.208.187.216 ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 46.246.89.246 (MISP Attribute #657) Malware Artifacts IP Watchlist Network activity: 46.246.89.246 (MISP Attribute #657) 46.246.89.246 ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 198.12.150.249 (MISP Attribute #658) Malware Artifacts IP Watchlist Network activity: 198.12.150.249 (MISP Attribute #658) 198.12.150.249 ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 50.63.202.57 (MISP Attribute #659) Malware Artifacts IP Watchlist Network activity: 50.63.202.57 (MISP Attribute #659) 50.63.202.57 ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 193.105.134.27 (MISP Attribute #660) Malware Artifacts IP Watchlist Network activity: 193.105.134.27 (MISP Attribute #660) 193.105.134.27 ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #661) Malware Artifacts URL Watchlist Network activity: http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #661) http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #662) Malware Artifacts URL Watchlist Network activity: http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #662) http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: http://mail.asambleanacional.gob.ec (MISP Attribute #663) Malware Artifacts URL Watchlist Network activity: http://mail.asambleanacional.gob.ec (MISP Attribute #663) http://mail.asambleanacional.gob.ec ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado (MISP Attribute #664) Malware Artifacts URL Watchlist Network activity: http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado (MISP Attribute #664) http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg (MISP Attribute #665) Malware Artifacts URL Watchlist Network activity: http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg (MISP Attribute #665) http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: claudiobonadio88@gmail.com (MISP Attribute #666) Malware Artifacts Malicious E-mail Payload delivery: claudiobonadio88@gmail.com (MISP Attribute #666) claudiobonadio88@gmail.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: cfed.bonadio@gmail.com (MISP Attribute #667) Malware Artifacts Malicious E-mail Payload delivery: cfed.bonadio@gmail.com (MISP Attribute #667) cfed.bonadio@gmail.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: focusedtior1@gmail.com (MISP Attribute #668) Malware Artifacts Malicious E-mail Payload delivery: focusedtior1@gmail.com (MISP Attribute #668) focusedtior1@gmail.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: no.response.delivery.es@gmail.com (MISP Attribute #669) Malware Artifacts Malicious E-mail Payload delivery: no.response.delivery.es@gmail.com (MISP Attribute #669) no.response.delivery.es@gmail.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: enripintos123@outlook.es (MISP Attribute #670) Malware Artifacts Malicious E-mail Payload delivery: enripintos123@outlook.es (MISP Attribute #670) enripintos123@outlook.es ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: movimiento.anti.correista@gmail.com (MISP Attribute #671) Malware Artifacts Malicious E-mail Payload delivery: movimiento.anti.correista@gmail.com (MISP Attribute #671) movimiento.anti.correista@gmail.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: no-responder@supportgmai1.com (MISP Attribute #672) Malware Artifacts Malicious E-mail Payload delivery: no-responder@supportgmai1.com (MISP Attribute #672) no-responder@supportgmai1.com ../../../descendant-or-self::node() High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload type Payload type Payload type Payload type Event Threat Level: Medium MISP Tag: TLP:GREEN MISP Tag: SOURCE:CITIZENLAB MISP Tag: DETECT MISP Tag: PUBLISHED citizenlab https://citizenlab.org/2015/12/packrat-report/ ../../../descendant-or-self::node()