7.9 KiB
7.9 KiB
| 1 | uuid | event_id | category | type | value | comment | to_ids | date |
|---|---|---|---|---|---|---|---|---|
| 2 | 5bec8d6d-6cc8-4aef-b8c9-171c8064ab0b | 140 | Network activity | domain | msap.services | 1 | 20181114 | |
| 3 | 5bec8d6d-71e0-40b6-add8-171c8064ab0b | 140 | Network activity | domain | www.msap.services | 1 | 20181114 | |
| 4 | 5bec8d7b-b658-4050-8b3c-45cc8064ab0b | 140 | Network activity | ip-dst | 144.202.59.23 | iOS exploit server | 1 | 20190920 |
| 5 | 5bed8343-d968-4c72-a106-2b328064ab0b | 140 | Network activity | ip-dst | 66.42.58.59 | iOS C2 | 1 | 20190920 |
| 6 | 5bed84bf-8710-4cba-b9eb-05688064ab0b | 140 | Network activity | ip-dst | 43.251.16.87 | 1 | 20181115 | |
| 7 | 5d76c6d3-0658-494c-afb4-61de8064ab0b | 140 | Network activity | url | http://www.msap.services/S5gDoN | 0 | 20190909 | |
| 8 | 5d76c6d3-0d28-4b27-9ac6-61de8064ab0b | 140 | Network activity | url | http://bit.ly/2B4GwEf | 0 | 20190909 | |
| 9 | 5d76c6d3-1170-4f0e-ade3-61de8064ab0b | 140 | Network activity | url | http://www.msap.services/EzpOhU | 0 | 20190909 | |
| 10 | 5d76c6d3-14c4-4b77-85be-61de8064ab0b | 140 | Network activity | url | http://bit.ly/2AYy61a | 0 | 20190909 | |
| 11 | 5d76c6d3-1708-4847-8b18-61de8064ab0b | 140 | Network activity | url | http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL29wZW4/aWQ9MUlTakl2eFoxX1g5YkdJSnQtMlpKeDRDRWwzdVVhRmlv | 0 | 20190909 | |
| 12 | 5d76c6d3-2150-4f97-80c4-61de8064ab0b | 140 | Network activity | url | http://msap.services/yHJbS6 | 0 | 20190909 | |
| 13 | 5d76c6d3-2f9c-40b2-8cd5-61de8064ab0b | 140 | Network activity | url | http://www.msap.services/70FtQX | 0 | 20190909 | |
| 14 | 5d76c6d3-578c-4a96-88fe-61de8064ab0b | 140 | Network activity | url | http://bit.ly/2PSvdau | 0 | 20190909 | |
| 15 | 5d76c6d3-5824-4b00-8dda-61de8064ab0b | 140 | Network activity | url | http://suo.im/5okeFb | 0 | 20190909 | |
| 16 | 5d76c6d3-7058-403d-a9b1-61de8064ab0b | 140 | Network activity | url | http://www.msap.services/GfHuRi | 0 | 20190909 | |
| 17 | 5d76c6d3-8604-4125-b369-61de8064ab0b | 140 | Network activity | url | http://www.msap.services/XgL5A9 | 0 | 20190909 | |
| 18 | 5d76c6d3-8624-44df-8338-61de8064ab0b | 140 | Network activity | url | http://bit.ly/2T2CoeX | 0 | 20190909 | |
| 19 | 5d76c6d3-936c-411b-a0c9-61de8064ab0b | 140 | Network activity | url | http://bit.ly/2QroNMt | 0 | 20190909 | |
| 20 | 5d76c6d3-a174-4130-a62c-61de8064ab0b | 140 | Network activity | url | http://www.msap.services/6FeBOy | 0 | 20190909 | |
| 21 | 5d76c6d3-a530-4671-8fab-61de8064ab0b | 140 | Network activity | url | http://bit.ly/2SVPqdY | 0 | 20190909 | |
| 22 | 5d76c6d3-b644-45e2-a9d7-61de8064ab0b | 140 | Network activity | url | http://www.msap.services/1R7mqD | 0 | 20190909 | |
| 23 | 5d76c6d3-b878-442a-b476-61de8064ab0b | 140 | Network activity | url | http://bit.ly/2z1WayM | 0 | 20190909 | |
| 24 | 5d76c6d3-b8ec-438c-8161-61de8064ab0b | 140 | Network activity | url | http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly93d3cubnl0aW1lcy5jb20vMjAxOC8xMS8wMi9vYml0dWFyaWVzL2xvZGktZ3lhcmktZGVhZC5odG1s | 0 | 20190909 | |
| 25 | 5d76c6d3-bb64-4b8d-b773-61de8064ab0b | 140 | Network activity | url | http://www.msap.services/yHJbS6 | 0 | 20190909 | |
| 26 | 5d76c6d3-bd08-4528-9fab-61de8064ab0b | 140 | Network activity | url | http://www.msap.services/F8XGNe | 0 | 20190909 | |
| 27 | 5d76c6d3-ce00-497f-9284-61de8064ab0b | 140 | Network activity | url | http://suo.im/5ot25j | 0 | 20190909 | |
| 28 | 5d76c6d3-d218-49a3-96f3-61de8064ab0b | 140 | Network activity | url | http://bit.ly/2qHg3Xt | 0 | 20190909 | |
| 29 | 5d76c6d3-f8f0-4399-a2ae-61de8064ab0b | 140 | Network activity | url | http//www.msap.services/2bKr8Z | 0 | 20190909 | |
| 30 | 5d76c6d4-0854-4d51-8fb7-61de8064ab0b | 140 | Network activity | url | http://www.msap.services/ZpzstM | 0 | 20190909 | |
| 31 | 5d76c6d4-12f0-4f58-9a9b-61de8064ab0b | 140 | Network activity | url | http://www.msap.services/ZQfqzs | 0 | 20190909 | |
| 32 | 5d76c6d4-2fb8-46f2-a589-61de8064ab0b | 140 | Network activity | url | http://bit.ly/2Drl90q | 0 | 20190909 | |
| 33 | 5d76c6d4-3b64-4591-b0df-61de8064ab0b | 140 | Network activity | url | http://45.76.149.154:5000/web/info?org=aHR0cDovL3d3dy5waGF5dWwuY29tL25ld3MvYXJ0aWNsZS5hc3B4P2lkPTQxNDc0JmZiY2xpZD1Jd0FSM1RadGdjanppUkhNZFJuOEdhZ1RMUV9iMHFrX0VBZWY2YldxRU5SanhaZkkzRFdPNFpsRExPcFdz | 0 | 20190909 | |
| 34 | 5d76c6d4-52b4-413f-bf04-61de8064ab0b | 140 | Network activity | url | https://www.energy-mail.org/B20V54 | 0 | 20190909 | |
| 35 | 5d76c6d4-7398-45b0-b5e9-61de8064ab0b | 140 | Network activity | url | http://bit.ly/2T6pCMf | 0 | 20190909 | |
| 36 | 5d76c6d4-c2a8-4ee3-bf3d-61de8064ab0b | 140 | Network activity | url | https://bit.ly/2MgSRwL | 0 | 20190909 | |
| 37 | 5d76c6d4-dde0-484e-ac13-61de8064ab0b | 140 | Network activity | url | https://bit.ly/2XePmYt | 0 | 20190909 | |
| 38 | 5d76c70f-df94-4cd0-b977-4cea8064ab0b | 140 | Network activity | domain | www.energy-mail.org | 1 | 20190909 | |
| 39 | 5d76c730-b4c0-4746-af7e-61db8064ab0b | 140 | Network activity | url | http://43.251.16.87:5000//dev/loader | 0 | 20190909 | |
| 40 | 5d76c7a0-2dac-4e65-a0ca-67208064ab0b | 140 | Network activity | ip-dst | 45.32.75.217 | 1 | 20190909 | |
| 41 | 5d76c7a0-3c28-4110-aa88-67208064ab0b | 140 | Network activity | ip-dst | 45.76.149.154 | Android exploit server | 1 | 20190920 |
| 42 | 5d76c98c-0998-4c3d-94fa-61de8064ab0b | 140 | Network activity | domain | bf.mk | 1 | 20190909 | |
| 43 | 5d76c98c-0cb4-4be5-b3d6-61de8064ab0b | 140 | Network activity | domain | rf.mk | 1 | 20190909 | |
| 44 | 5d76c98c-1b78-4933-98f8-61de8064ab0b | 140 | Network activity | domain | mailcontactanalysis.online | 1 | 20190909 | |
| 45 | 5d76c98c-3358-4897-a52b-61de8064ab0b | 140 | Network activity | domain | mailnotes.online | 1 | 20190909 | |
| 46 | 5d76c98c-52b4-4bb9-b61b-61de8064ab0b | 140 | Network activity | domain | mailanalysis.services | 1 | 20190909 | |
| 47 | 5d76c98c-6be4-4b4a-9a37-61de8064ab0b | 140 | Network activity | domain | polarismail.services | 1 | 20190909 | |
| 48 | 5d76c98c-77cc-4a32-b989-61de8064ab0b | 140 | Network activity | domain | energy-mail.org | 1 | 20190909 | |
| 49 | 5d76c98c-8960-4e6c-be1c-61de8064ab0b | 140 | Network activity | domain | izelense.com | 1 | 20190909 | |
| 50 | 5d76c98c-95a0-4186-9d08-61de8064ab0b | 140 | Network activity | domain | antmoving.online | 1 | 20190909 | |
| 51 | 5d76c98c-a620-4e86-969b-61de8064ab0b | 140 | Network activity | domain | gmailapp.me | 1 | 20190909 | |
| 52 | 5d76c98c-be94-4716-9cc3-61de8064ab0b | 140 | Network activity | domain | beemail.online | 1 | 20190909 | |
| 53 | 5d76c98c-f230-436d-a69f-61de8064ab0b | 140 | Network activity | domain | walkingnote.online | 1 | 20190909 | |
| 54 | 5d76c9b2-5654-4b42-a28f-61dc8064ab0b | 140 | Attribution | whois-registrant-email | ornaments798@outlook.com | 0 | 20190909 | |
| 55 | 5d76c9b2-8b24-4fb2-8ff3-61dc8064ab0b | 140 | Attribution | whois-registrant-email | dashenqu832@outlook.com | 0 | 20190909 | |
| 56 | 5d76cc33-7aac-4eb8-a1be-66c48064ab0b | 140 | Network activity | ip-dst | 45.78.79.100 | 1 | 20190909 | |
| 57 | 5d76cf56-94f8-4a16-84d5-67af8064ab0b | 140 | Network activity | ip-dst | 149.28.93.11 | 1 | 20190909 | |
| 58 | 5d76d19b-0704-42fa-95c5-61df8064ab0b | 140 | Network activity | ip-dst | 95.169.2.57 | 1 | 20190909 | |
| 59 | 5d76d6f2-f44c-4b21-ba2d-67578064ab0b | 140 | Network activity | ip-dst | 206.189.65.198 | 1 | 20190909 | |
| 60 | 5d76dae6-bdc4-4cca-8161-61de8064ab0b | 140 | Network activity | ip-dst | 140.82.17.222 | 1 | 20190909 | |
| 61 | 5d76dcf6-f094-47a0-8fd4-4cea8064ab0b | 140 | Network activity | ip-dst | 45.76.53.26 | 1 | 20190909 | |
| 62 | 5d76de15-2544-4f39-baed-61db8064ab0b | 140 | Network activity | ip-dst | 45.32.91.137 | 1 | 20190909 | |
| 63 | 5d76dfaf-574c-4253-b1f1-67578064ab0b | 140 | Artifacts dropped | sha256 | 0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560 | iOS payload | 1 | 20190909 |
| 64 | 5d76e2eb-37c8-4b75-b5d7-67578064ab0b | 140 | Payload delivery | email-src | touchxun658@gmail.com | OAuth email addresses | 0 | 20190909 |
| 65 | 5d76e2eb-abe8-44bb-8dbf-67578064ab0b | 140 | Payload delivery | email-src | antmoving.online@gmail.com | OAuth email addresses | 0 | 20190909 |
| 66 | 5d76e2eb-df2c-4913-b458-67578064ab0b | 140 | Payload delivery | email-src | energymail.org@gmail.com | OAuth email addresses | 0 | 20190909 |
| 67 | 5d76e2eb-e004-41d8-bc9d-67578064ab0b | 140 | Payload delivery | email-src | jameslewis199106@gmail.com | OAuth email addresses | 0 | 20190909 |
| 68 | 5d8545bf-ec98-4d0c-a8a3-55038064ab0b | 140 | Payload delivery | sha256 | 6977e6098815cd91016be9d76f194ed4622640d03c6cdd66b1032306a2190af7 | libbourbon | 0 | 20190920 |
| 69 | 5d8545d4-ee30-435b-827e-55078064ab0b | 140 | Payload delivery | sha256 | e510c361c8101384277dd95cc2c8e76715dd241f58553f592245b620422beaf3 | Whisky | 0 | 20190920 |
| 70 | 5d8545e3-c264-43d8-9666-55068064ab0b | 140 | Payload delivery | sha256 | 0d13e403303b52edae6beb76a6fe7ed454f340aae1246b9a3f55ca728da2d6aa | Scotch | 0 | 20190920 |
| 71 | 5d854603-8bf4-44fe-96ae-47ce8064ab0b | 140 | Payload delivery | sha256 | b85fe634f3c5b1022a1adbc21f3b85b58451ca2b89e9380fc5f22b9340a18b88 | Loader | 0 | 20190920 |
| 72 | 5d892cd4-fba0-4c21-90d9-0b328064ab0b | 140 | Network activity | user-agent | hots scot | Scotch user agent | 1 | 20190923 |