Export from MISP Threat Report Insider Information: An intrusion campaign targeting Chinese language news sites (MISP Event #108) Threat Report Insider Information: An intrusion campaign targeting Chinese language news sites 108 2017-07-04T00:00:00+00:00 2017-07-04T11:25:53+00:00 New Artifacts dropped Artifacts dropped: 19c5f8829444956ba30e023aaaec6408 (MISP Attribute #16407) Malware Artifacts File Hash Watchlist Artifacts dropped: 19c5f8829444956ba30e023aaaec6408 (MISP Attribute #16407) MD5 19c5f8829444956ba30e023aaaec6408 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: ac5763000ae435875f3b709a5f23ecc0 (MISP Attribute #16408) Malware Artifacts File Hash Watchlist Artifacts dropped: ac5763000ae435875f3b709a5f23ecc0 (MISP Attribute #16408) MD5 ac5763000ae435875f3b709a5f23ecc0 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: d80fc6a4f175e3ab417b9f96c3b37c73 (MISP Attribute #16409) Malware Artifacts File Hash Watchlist Artifacts dropped: d80fc6a4f175e3ab417b9f96c3b37c73 (MISP Attribute #16409) MD5 d80fc6a4f175e3ab417b9f96c3b37c73 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 945de4d3a046a698aec222fc90a148ba (MISP Attribute #16410) Malware Artifacts File Hash Watchlist Artifacts dropped: 945de4d3a046a698aec222fc90a148ba (MISP Attribute #16410) MD5 945de4d3a046a698aec222fc90a148ba None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 95efa51b52f121cec239980127b7f96b (MISP Attribute #16411) Malware Artifacts File Hash Watchlist Artifacts dropped: 95efa51b52f121cec239980127b7f96b (MISP Attribute #16411) MD5 95efa51b52f121cec239980127b7f96b None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 13b148aead5e844f7262da768873cec0 (MISP Attribute #16412) Malware Artifacts File Hash Watchlist Artifacts dropped: 13b148aead5e844f7262da768873cec0 (MISP Attribute #16412) MD5 13b148aead5e844f7262da768873cec0 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 029ba5f0f6997bc36a094e86848a5b82 (MISP Attribute #16413) Malware Artifacts File Hash Watchlist Artifacts dropped: 029ba5f0f6997bc36a094e86848a5b82 (MISP Attribute #16413) MD5 029ba5f0f6997bc36a094e86848a5b82 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: e841ecaa44b3589120b72e60b53f39c6 (MISP Attribute #16414) Malware Artifacts File Hash Watchlist Artifacts dropped: e841ecaa44b3589120b72e60b53f39c6 (MISP Attribute #16414) MD5 e841ecaa44b3589120b72e60b53f39c6 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 88e027b1ef7b2da1766e6b6819bba0f0 (MISP Attribute #16415) Malware Artifacts File Hash Watchlist Artifacts dropped: 88e027b1ef7b2da1766e6b6819bba0f0 (MISP Attribute #16415) MD5 88e027b1ef7b2da1766e6b6819bba0f0 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: bb080489dbc98a59cac130475e019fb2 (MISP Attribute #16416) Malware Artifacts File Hash Watchlist Artifacts dropped: bb080489dbc98a59cac130475e019fb2 (MISP Attribute #16416) MD5 bb080489dbc98a59cac130475e019fb2 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 88f43fe753e64d9c536fca16979984ef (MISP Attribute #16417) Malware Artifacts File Hash Watchlist Artifacts dropped: 88f43fe753e64d9c536fca16979984ef (MISP Attribute #16417) MD5 88f43fe753e64d9c536fca16979984ef None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: f282fd20d7eaebe848b5111ecdae82a6 (MISP Attribute #16418) Malware Artifacts File Hash Watchlist Artifacts dropped: f282fd20d7eaebe848b5111ecdae82a6 (MISP Attribute #16418) MD5 f282fd20d7eaebe848b5111ecdae82a6 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: e0338b1f010fdc4751de5f58e4acf2ad (MISP Attribute #16419) Malware Artifacts File Hash Watchlist Artifacts dropped: e0338b1f010fdc4751de5f58e4acf2ad (MISP Attribute #16419) MD5 e0338b1f010fdc4751de5f58e4acf2ad None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: c1dabd54a672cbc2747c53a8041d5602 (MISP Attribute #16420) Malware Artifacts File Hash Watchlist Artifacts dropped: c1dabd54a672cbc2747c53a8041d5602 (MISP Attribute #16420) MD5 c1dabd54a672cbc2747c53a8041d5602 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 2332aa40d15399179c068ab205a5303d (MISP Attribute #16421) Malware Artifacts File Hash Watchlist Artifacts dropped: 2332aa40d15399179c068ab205a5303d (MISP Attribute #16421) MD5 2332aa40d15399179c068ab205a5303d None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 4ddf012d8a42ad2666e06ad2f0a8410e (MISP Attribute #16422) Malware Artifacts File Hash Watchlist Artifacts dropped: 4ddf012d8a42ad2666e06ad2f0a8410e (MISP Attribute #16422) MD5 4ddf012d8a42ad2666e06ad2f0a8410e None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Attribution Attribution: aobama_5@yahoo.com (MISP Attribute #16353) Malware Artifacts Attribution: aobama_5@yahoo.com (MISP Attribute #16353) None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: email23.secuerserver.com (MISP Attribute #16374) Malware Artifacts Domain Watchlist Network activity: email23.secuerserver.com (MISP Attribute #16374) email23.secuerserver.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: hk.secuerserver.com (MISP Attribute #16375) Malware Artifacts Domain Watchlist Network activity: hk.secuerserver.com (MISP Attribute #16375) hk.secuerserver.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: dns.bowenpress.org (MISP Attribute #16376) Malware Artifacts Domain Watchlist Network activity: dns.bowenpress.org (MISP Attribute #16376) dns.bowenpress.org High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: secuerserver.com (MISP Attribute #16354) Malware Artifacts Domain Watchlist Payload delivery: secuerserver.com (MISP Attribute #16354) secuerserver.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: bowenpres.com (MISP Attribute #16355) Malware Artifacts Domain Watchlist Payload delivery: bowenpres.com (MISP Attribute #16355) bowenpres.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: bowenpress.net (MISP Attribute #16356) Malware Artifacts Domain Watchlist Payload delivery: bowenpress.net (MISP Attribute #16356) bowenpress.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: bowenpress.org (MISP Attribute #16357) Malware Artifacts Domain Watchlist Payload delivery: bowenpress.org (MISP Attribute #16357) bowenpress.org High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: bowenpross.com (MISP Attribute #16358) Malware Artifacts Domain Watchlist Payload delivery: bowenpross.com (MISP Attribute #16358) bowenpross.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: datalink.one (MISP Attribute #16359) Malware Artifacts Domain Watchlist Payload delivery: datalink.one (MISP Attribute #16359) datalink.one High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: epochatimes.com (MISP Attribute #16360) Malware Artifacts Domain Watchlist Payload delivery: epochatimes.com (MISP Attribute #16360) epochatimes.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: get.adobe.com.bowenpress.org (MISP Attribute #16361) Malware Artifacts Domain Watchlist Payload delivery: get.adobe.com.bowenpress.org (MISP Attribute #16361) get.adobe.com.bowenpress.org High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: hk.secuerserver.com (MISP Attribute #16362) Malware Artifacts Domain Watchlist Payload delivery: hk.secuerserver.com (MISP Attribute #16362) hk.secuerserver.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: pop.secuerserver.com (MISP Attribute #16363) Malware Artifacts Domain Watchlist Payload delivery: pop.secuerserver.com (MISP Attribute #16363) pop.secuerserver.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: smtpout.secuerserver.com (MISP Attribute #16364) Malware Artifacts Domain Watchlist Payload delivery: smtpout.secuerserver.com (MISP Attribute #16364) smtpout.secuerserver.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: www.bowenpress.org (MISP Attribute #16365) Malware Artifacts Domain Watchlist Payload delivery: www.bowenpress.org (MISP Attribute #16365) www.bowenpress.org High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: www.mail.secuerserver.com (MISP Attribute #16366) Malware Artifacts Domain Watchlist Payload delivery: www.mail.secuerserver.com (MISP Attribute #16366) www.mail.secuerserver.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: www.secuerserver.com (MISP Attribute #16367) Malware Artifacts Domain Watchlist Payload delivery: www.secuerserver.com (MISP Attribute #16367) www.secuerserver.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: www.vnews.hk (MISP Attribute #16368) Malware Artifacts Domain Watchlist Payload delivery: www.vnews.hk (MISP Attribute #16368) www.vnews.hk High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: hellomice@mail.com (MISP Attribute #16348) Malware Artifacts Malicious E-mail Payload delivery: hellomice@mail.com (MISP Attribute #16348) hellomice@mail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: aisia.anminda8@mail.com (MISP Attribute #16349) Malware Artifacts Malicious E-mail Payload delivery: aisia.anminda8@mail.com (MISP Attribute #16349) aisia.anminda8@mail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: 45.124.24.39 (MISP Attribute #16405) Malware Artifacts IP Watchlist Payload delivery: 45.124.24.39 (MISP Attribute #16405) 45.124.24.39 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: 23.239.106.119 (MISP Attribute #16406) Malware Artifacts IP Watchlist Payload delivery: 23.239.106.119 (MISP Attribute #16406) 23.239.106.119 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: 43.240.14.37 (MISP Attribute #16352) Malware Artifacts IP Watchlist Payload delivery: 43.240.14.37 (MISP Attribute #16352) 43.240.14.37 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://43.240.14.37/asdasdasadqddd12222111.php/article.asp (MISP Attribute #16350) Malware Artifacts URL Watchlist Payload delivery: http://43.240.14.37/asdasdasadqddd12222111.php/article.asp (MISP Attribute #16350) http://43.240.14.37/asdasdasadqddd12222111.php/article.asp High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://chinadagitaltimes.net/2016/07/chinese-hackers-blamed-multiple-breaches-fdic (MISP Attribute #16351) Malware Artifacts URL Watchlist Payload delivery: http://chinadagitaltimes.net/2016/07/chinese-hackers-blamed-multiple-breaches-fdic (MISP Attribute #16351) http://chinadagitaltimes.net/2016/07/chinese-hackers-blamed-multiple-breaches-fdic High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate.html (MISP Attribute #16369) Malware Artifacts URL Watchlist Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate.html (MISP Attribute #16369) http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate.html High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20160703/AdobeUpdate20160703.exe (MISP Attribute #16370) Malware Artifacts URL Watchlist Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20160703/AdobeUpdate20160703.exe (MISP Attribute #16370) http://get.adobe.com.bowenpress.org/Adobe/update/20160703/AdobeUpdate20160703.exe High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20160812/AdobeUpdate20160812.exe (MISP Attribute #16371) Malware Artifacts URL Watchlist Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20160812/AdobeUpdate20160812.exe (MISP Attribute #16371) http://get.adobe.com.bowenpress.org/Adobe/update/20160812/AdobeUpdate20160812.exe High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate20161201.exe (MISP Attribute #16372) Malware Artifacts URL Watchlist Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate20161201.exe (MISP Attribute #16372) http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate20161201.exe High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20170312/AdobeUpdate20170312.exe (MISP Attribute #16373) Malware Artifacts URL Watchlist Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20170312/AdobeUpdate20170312.exe (MISP Attribute #16373) http://get.adobe.com.bowenpress.org/Adobe/update/20170312/AdobeUpdate20170312.exe High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Event Threat Level: High MISP Tag: TLP:GREEN MISP Tag: SOURCE:CITIZENLAB MISP Tag: DETECT MISP Tag: TARGET:HONGKONG citizenlab ../../../descendant-or-self::node()