2.9 KiB
2.9 KiB
| 1 | uuid | event_id | category | type | value | comment | to_ids | date |
|---|---|---|---|---|---|---|---|---|
| 2 | 581bacca-464c-4997-8812-49798e96ca05 | 4 | Network activity | domain | usacia.websecexp.com | c2 server from Palo Alto study | 1 | 20151016 |
| 3 | 581bacca-5998-41ad-afb4-49798e96ca05 | 4 | Network activity | domain | webhttps.websecexp.com | c2 server from Palo Alto study | 1 | 20151016 |
| 4 | 581bacca-ad18-4ff6-b8b5-49798e96ca05 | 4 | Network activity | domain | appeur.gnway.cc | c2 server from Palo Alto study | 1 | 20151016 |
| 5 | 581bacca-eb70-4443-a7d1-49798e96ca05 | 4 | Network activity | domain | usafbi.websecexp.com | c2 server from Palo Alto study | 1 | 20151016 |
| 6 | 581bace8-59d0-4c6e-859a-497a8e96ca05 | 4 | Payload type | text | 9002 | 0 | 20151016 | |
| 7 | 581bacf2-d924-45bd-a930-49798e96ca05 | 4 | Payload type | text | 3102 | The variant is labeled 3102, because it always uses the string “3102” in its first communications with a C2 server | 0 | 20151016 |
| 8 | 581bad0a-7524-46f8-9d57-497a8e96ca05 | 4 | Network activity | ip-dst | 198.44.190.85 | This IP is a Virtual Private Server (VPS) hosted in the US and owned by VpsQuan | 1 | 20151016 |
| 9 | 581bad2c-3a60-4be9-8d21-49798e96ca05 | 4 | Payload delivery | md5 | 53f81415ccedf453d6e3ebcdc142b966 | Attachments | 0 | 20151016 |
| 10 | 581bad2c-d2d4-46f4-b0cb-49798e96ca05 | 4 | Payload delivery | md5 | 699b3d90b050cae37f65c855ec7f616a | Attachments | 0 | 20151016 |
| 11 | 581bad2c-e744-4a48-ae12-49798e96ca05 | 4 | Payload delivery | md5 | 6701662097e274f3cd089ceec35471d2 | Attachments | 0 | 20151016 |
| 12 | 581bad50-2488-429a-b001-497a8e96ca05 | 4 | Artifacts dropped | md5 | c4c147bdfddffec2eea6bf99661e69ee | ca-bundle.exe | 1 | 20151016 |
| 13 | 581bad50-7890-4dcf-8436-497a8e96ca05 | 4 | Artifacts dropped | md5 | cec071424d417a095221bf8992819388 | XLBugHandler.dll | 1 | 20151016 |
| 14 | 581bad50-8998-4012-926d-497a8e96ca05 | 4 | Artifacts dropped | md5 | 5710d567d98a8f4a6682859ce3a35336 | lsass.exe | 1 | 20151016 |
| 15 | 581bad50-a014-4095-a054-497a8e96ca05 | 4 | Artifacts dropped | md5 | 56f0e67d981024ddcc215543698f44fb | mcutil.dll | 1 | 20151016 |
| 16 | 581bad50-aea8-4d5f-8e0c-497a8e96ca05 | 4 | Artifacts dropped | md5 | 884d46c01c762ad6ddd2759fd921bf71 | mcf.exe | 1 | 20151016 |
| 17 | 581bad50-d494-4e55-aa91-497a8e96ca05 | 4 | Artifacts dropped | md5 | 7e0081fba718fcd71753d3199a290f03 | mcf.ep | 1 | 20151016 |
| 18 | 581bad60-2a18-44cc-ac40-49798e96ca05 | 4 | Artifacts dropped | md5 | 49ceba3347d39870f15f2ab0391af234 | xlbug.dat | 1 | 20151016 |
| 19 | 581bad77-2c58-479e-833e-497a8e96ca05 | 4 | Network activity | domain | t1.mailsecurityservice.com | 1 | 20151016 | |
| 20 | 581bad77-cde8-4c65-9449-497a8e96ca05 | 4 | Network activity | domain | t2.mailsecurityservice.com | 1 | 20151016 | |
| 21 | 581bad90-56b0-4c8b-ba6b-497a8e96ca05 | 4 | Internal reference | link | https://citizenlab.org/2015/10/targeted-attacks-ngo-burma/ | 0 | 20151016 | |
| 22 | 5824e57b-8458-4669-b6a0-497a8e96ca05 | 4 | Attribution | whois-registrant-email | wojiaojilao2@sohu.com | 0 | 20151016 | |
| 23 | 5824e58f-be40-407d-b91b-497a8e96ca05 | 4 | Network activity | domain | iyouthen.com | Identified through passive DNS | 1 | 20151016 |
| 24 | 5824e5f1-d174-487e-9156-497a8e96ca05 | 4 | Payload delivery | url | http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe | 1 | 20151016 |