4.3 KiB
4.3 KiB
| 1 | uuid | event_id | category | type | value | comment | to_ids | date |
|---|---|---|---|---|---|---|---|---|
| 2 | 11bb35af-5ad7-4a10-844c-fb4482603b0b | 11 | Network activity | url | http://accountgoogle.firewall-gateway.com/serviclogin | Decoy webpage | 0 | 20160310 |
| 3 | 11cf9c54-4d35-4a58-8128-a1076025ff25 | 11 | Network activity | domain | sys.firewall-gateway.net | C2 domain | 1 | 20160310 |
| 4 | 1f0bc371-f681-4049-855d-235e6bc5eb8e | 11 | Network activity | ip-dst | 5.54.19.17 | 1 | 20160310 | |
| 5 | 228f765c-d5ab-4fcf-a190-775b9ed2ad70 | 11 | Network activity | domain | firewallupdate.firewall-gateway.com | Domain found through passive DNS | 1 | 20160310 |
| 6 | 23403344-c52e-4c19-9f7b-f5291b451bee | 11 | Payload delivery | md5 | fef27f432e0ae8218143bc410fda340e | 1 | 20160310 | |
| 7 | 26fb914b-1601-4049-a8b5-c9afc3a16bc0 | 11 | Network activity | domain | accountgoogle.firewall-gateway.com | Phishing Campaign Infrastructure | 1 | 20160310 |
| 8 | 318dd748-c9d9-4f7b-9b42-75a60001f9e1 | 11 | Network activity | ip-dst | 95.154.195.171 | 1 | 20160310 | |
| 9 | 35a7486a-38a7-4d3a-bdd8-1284d464484b | 11 | Network activity | domain | firewallupdate.firewall-gateway.net | Domain found through passive DNS | 1 | 20160310 |
| 10 | 3baf841e-c377-44ba-ba20-dcfd7aa8ba22 | 11 | Network activity | domain | accounts-google.firewall-gateway.com | Domain found through passive DNS | 1 | 20160310 |
| 11 | 40edc447-3aaa-4f79-8268-16eddff19b33 | 11 | Network activity | domain | accountsgoogles.firewall-gateway.com | Domain found through passive DNS | 1 | 20160310 |
| 12 | 53477c01-59ad-47be-b808-4c6b518523fc | 11 | Network activity | ip-dst | 109.169.77.230 | Resolve domain news[.]firewall-gateway[.]com | 1 | 20160310 |
| 13 | 581c1169-35f8-439b-ad90-49798e96ca05 | 11 | External analysis | link | https://citizenlab.org/2016/03/shifting-tactics/ | 0 | 20161104 | |
| 14 | 5824e149-ba7c-4e04-b905-69fe8e96ca05 | 11 | Artifacts dropped | md5 | ea45265fe98b25e719d5a9cc3b412d66 | uroyh.exe | 1 | 20160310 |
| 15 | 5824e1e5-e340-40b0-b3fa-69fe8e96ca05 | 11 | Attribution | threat-actor | Scarlet Mimic | 0 | 20160310 | |
| 16 | 5824e33f-4c08-4b5f-8092-497a8e96ca05 | 11 | Payload type | text | FakeM | 0 | 20160310 | |
| 17 | 6308d2e1-a83a-44b2-b96f-267bc24efbd1 | 11 | Network activity | domain | filegoogle.firewall-gateway.com | Phishing Campaign Infrastructure | 1 | 20160310 |
| 18 | 633179a0-3d6e-4ca5-9b89-02d8522ef275 | 11 | Payload delivery | filename | Reappraisal_of_India_Tibet_Policy.doc | 0 | 20160310 | |
| 19 | 6d15c4fe-2de7-4abc-9593-c9eeae9b928f | 11 | Payload delivery | md5 | 3b869c8e23d66ad0527882fc79ff7237 | 1 | 20160310 | |
| 20 | 712c9cc1-2b2b-4636-87d2-12bd313376dc | 11 | Payload delivery | md5 | 1bf438b5744db73eea58379a3b9f30e5 | 1 | 20160310 | |
| 21 | 73e5412a-1252-495d-956d-28cfdd8edaed | 11 | Network activity | domain | news.firewall-gateway.com | 1 | 20160310 | |
| 22 | 86627daf-07c8-467f-babc-426d586e7d4a | 11 | Network activity | domain | detail43.myfirewall.org | 1 | 20160310 | |
| 23 | 8b0a371b-0c73-455d-a7ae-d0a530f23b04 | 11 | Network activity | domain | drivgoogle.firewall-gateway.com | Domain found through passive DNS | 1 | 20160310 |
| 24 | 8ce49cb3-e458-4568-b560-04a314ce9539 | 11 | Network activity | ip-dst | 192.253.251.118 | 1 | 20160310 | |
| 25 | 99702482-486a-4b63-8fa9-f094835827b2 | 11 | Payload delivery | md5 | 5c030802ad411fea059cc9cc4c118125 | uroyh-unpacked.exe | 1 | 20160310 |
| 26 | a31a03ec-f99e-4bec-95dc-3574c3512217 | 11 | Network activity | ip-dst | 95.154.195.159 | 1 | 20160310 | |
| 27 | a95b5c9c-7ec9-42ff-a12c-075b3255de77 | 11 | Payload delivery | md5 | 7735e571d0450e2a31e97e4f8e0f66fa | Attached file | 1 | 20160310 |
| 28 | ad5c4c3d-6194-4059-9aa1-1593b62d32a9 | 11 | Network activity | ip-dst | 109.169.40.172 | 1 | 20160310 | |
| 29 | b2cebdea-e90b-416f-9a0f-94a566b32a2a | 11 | Network activity | ip-dst | 46.127.56.109 | 1 | 20160310 | |
| 30 | b84e33b7-1958-4507-b7bb-6bb63304842c | 11 | Network activity | domain | googlefile.firewall-gateway.net | Domain found through passive DNS | 1 | 20160310 |
| 31 | baf16087-e811-438d-bcdd-9779043dfb06 | 11 | Payload delivery | md5 | d2e9412428c3bcf3ec98dba8a78adb7b | iph.bat | 1 | 20160310 |
| 32 | c379b263-55d3-464d-b94f-178f02f883a8 | 11 | Network activity | ip-dst | 87.117.229.109 | 1 | 20160310 | |
| 33 | cda51492-e33b-4521-be3b-35ec4b8bc9b4 | 11 | Network activity | url | http://accountgoogle.firewall-gateway.com/servicclogin | Decoy webpage | 0 | 20160310 |
| 34 | dbabd2ee-213d-4b02-951f-a020cfc3582e | 11 | Payload delivery | md5 | 8b83fc5d3a6a80281269f9e337fe3fff | pshvb.exe | 1 | 20160310 |
| 35 | ebbe87e2-7f84-4f68-b766-f63820da7966 | 11 | Network activity | domain | accountsgoogle.firewall-gateway.com | Domain found through passive DNS | 1 | 20160310 |
| 36 | f48470fd-c782-4831-a20d-4704b62f1358 | 11 | Network activity | ip-dst | 78.129.252.159 | 1 | 20160310 | |
| 37 | fc6d0f74-9e43-44a7-b7b8-0ca5c7c487e6 | 11 | Network activity | url | http://filegoogle.firewall-gateway.com/servicelogin | Decoy webpage | 1 | 20160310 |