5.0 KiB
5.0 KiB
| 1 | uuid | event_id | category | type | value | comment | to_ids | date |
|---|---|---|---|---|---|---|---|---|
| 2 | 007694f1-b73a-40a5-bcf5-dded27746669 | 8 | Network activity | url | http://aax.me/0b152 | 0 | 20161108 | |
| 3 | 19e97c58-4992-4f0b-8f49-6a6378a289eb | 8 | Payload delivery | sha256 | 4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be | message_032456944343.docm | 0 | 20161108 |
| 4 | 280056b8-69aa-432c-9826-6d5b820eb44e | 8 | Payload delivery | email-src | andrew.dwight389@outlook.com | The Case of the Fake Journalist | 0 | 20161108 |
| 5 | 35aa025c-2f62-4f9d-9fb7-391542226a7a | 8 | Network activity | domain | optimizedimghosting.com | The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL | 1 | 20161108 |
| 6 | 3813bc78-21d9-40a2-b76e-61016eb71ccb | 8 | Network activity | domain | adhostingcache.com | 1 | 20161108 | |
| 7 | 41c48554-6911-48eb-88a0-411dc4bd9047 | 8 | Payload delivery | sha1 | 1c3757006f972ca957d925accf8bbb3023550d1b | message_032456944343.docm | 0 | 20161108 |
| 8 | 45dbee97-3aa0-487d-bd73-a3c10a511403 | 8 | Network activity | ip-dst | 95.215.44.37 | IP linked to adhostingcache.com | 0 | 20161108 |
| 9 | 537df72e-b2b9-4016-b337-06930c42c455 | 8 | Network activity | url | http://goo.gl/60HAqJ | redirects to http://aax.me/0b152 | 0 | 20161108 |
| 10 | 58224765-51f8-4d28-9040-49798e96ca05 | 8 | Attribution | threat-actor | Stealth Falcon | 0 | 20161108 | |
| 11 | 582247a8-11b4-4da0-9ca1-69fe8e96ca05 | 8 | Payload delivery | domain | aax.me | 1 | 20161108 | |
| 12 | 582247d0-d7a0-49c3-a6ae-69fe8e96ca05 | 8 | Payload delivery | url | http://aax.me/a6faa | Link sent in a phishing email | 1 | 20161108 |
| 13 | 582247f6-eeec-47b0-b6d8-69fe8e96ca05 | 8 | Payload delivery | url | https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate | ownCloud15 instance | 0 | 20161108 |
| 14 | 5822492e-087c-4fa8-afe1-49798e96ca05 | 8 | Network activity | domain | simpleadbanners.com | Domains linked to adhostingcache.com | 0 | 20161108 |
| 15 | 5822492e-1d40-4098-a87b-49798e96ca05 | 8 | Network activity | domain | clickstatistic.com | Domains linked to adhostingcache.com | 0 | 20161108 |
| 16 | 5822492e-7490-4c3f-9a10-49798e96ca05 | 8 | Network activity | domain | bestairlinepricetags.com | Domains linked to adhostingcache.com | 0 | 20161108 |
| 17 | 5822492e-d888-418e-906d-49798e96ca05 | 8 | Network activity | domain | fasttravelclearance.com | Domains linked to adhostingcache.com | 0 | 20161108 |
| 18 | 5822494d-792c-4d8c-9be0-49798e96ca05 | 8 | Network activity | domain | airlineadverts.com | Domain linked to incapsulawebcache.com | 0 | 20161108 |
| 19 | 5822494d-7ab0-42bd-bd9d-49798e96ca05 | 8 | Network activity | domain | ministrynewschannel.com | Domain linked to incapsulawebcache.com | 0 | 20161108 |
| 20 | 5822494d-bf14-4b41-803a-49798e96ca05 | 8 | Network activity | domain | ministrynewsinfo.com | Domain linked to incapsulawebcache.com | 0 | 20161108 |
| 21 | 62fcd7b4-5d95-49bd-a9ff-3c2e1854839b | 8 | Network activity | url | http://optimizedimghosting.com/wddf/hrrw/ggrr.txt | The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL | 0 | 20161108 |
| 22 | 6c1856f6-0068-4c83-8aba-9fd4bb4277a1 | 8 | Payload delivery | url | http://aax.me/d0dde | loaded a page containing a redirect to the website of Al Jazeera. Before completing the redirect, it invoked JavaScript to profile the target’s computer. | 0 | 20161108 |
| 23 | 707eed9b-bb2c-4951-af0d-060b4c860e89 | 8 | External analysis | link | https://citizenlab.org/2016/05/stealth-falcon/ | 0 | 20161108 | |
| 24 | 70881ae4-3da1-409e-8bd3-7f508092a2c9 | 8 | Payload delivery | sha256 | 5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f | right2fight.docm (malicious document) | 0 | 20161108 |
| 25 | 7fd6e683-9615-4f4e-b901-03e7dbb81337 | 8 | Network activity | url | https://incapsulawebcache.com/cache/cache.nfo | 0 | 20161108 | |
| 26 | 8010c934-027b-40c5-ba1e-3efca8e52d5a | 8 | Network activity | domain | incapsulawebcache.com | stage two server | 1 | 20161108 |
| 27 | 8682a3ad-80da-4732-bf5a-e675e27c56fe | 8 | Network activity | domain | edgecacheimagehosting.com | stage two server | 1 | 20161108 |
| 28 | 9ca61973-d717-496a-a158-82d9b2e37965 | 8 | Payload delivery | md5 | 87e1df6f36b96b56186444e37e2a1ef5 | message_032456944343.docm | 0 | 20161108 |
| 29 | bc8e2ca7-cd3c-4205-9028-b8b106f12389 | 8 | Payload delivery | email-src | the_right_to_fight@openmailbox.org | Fake invitation | 0 | 20161108 |
| 30 | cd191e4e-a5a1-4009-93b7-92cc6a3d6984 | 8 | Payload delivery | sha1 | f25466e4820404c817eaf75818b7177891735886 | right2fight.docm (malicious document) | 0 | 20161108 |
| 31 | d9a62cda-db4c-4d70-858c-6bbaaa041e63 | 8 | Network activity | domain | adhostingcaches.com | registered on December 3rd | 1 | 20161108 |
| 32 | decfcbf1-1331-4624-88b7-a88c94637dd0 | 8 | Network activity | url | http://adhostingcache.com/ehhe/eh4g4/adcache.txt | Gathered information is returned to and the server’s response is executed as a PowerShell command. | 0 | 20161108 |
| 33 | e8f3b924-1221-4d08-8fef-f689529a7b6d | 8 | Network activity | url | http://aax.me/redirect.js | to profile a user’s system, perhaps to gather intelligence about potentially exploitable vulnerabilities. | 0 | 20161108 |
| 34 | f0215c0c-b708-43d8-873e-80a3e8e54cfa | 8 | Network activity | url | https://edgecacheimagehosting.com/images/image.nfo | The Stage Two in this case reported back to | 0 | 20161108 |
| 35 | f4f40c31-dd17-4dc6-baa3-6beb35c04c00 | 8 | Payload delivery | md5 | 80e8ef78b9e28015cde4205aaa65da97 | right2fight.docm (malicious document) | 0 | 20161108 |