675 lines
24 KiB
JSON
675 lines
24 KiB
JSON
{"response":[{
|
|
"Event": {
|
|
"id": "133",
|
|
"orgc_id": "2",
|
|
"org_id": "2",
|
|
"date": "2018-01-31",
|
|
"threat_level_id": "2",
|
|
"info": "Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces",
|
|
"published": true,
|
|
"uuid": "5a71edc8-26a8-43fb-8271-5c948e96ca05",
|
|
"attribute_count": "40",
|
|
"analysis": "2",
|
|
"timestamp": "1533377838",
|
|
"distribution": "1",
|
|
"proposal_email_lock": false,
|
|
"locked": false,
|
|
"publish_timestamp": "1533378310",
|
|
"sharing_group_id": "0",
|
|
"Org": {
|
|
"id": "2",
|
|
"name": "citizenlab",
|
|
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
|
|
},
|
|
"Orgc": {
|
|
"id": "2",
|
|
"name": "citizenlab",
|
|
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
|
|
},
|
|
"Attribute": [
|
|
{
|
|
"id": "18346",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657c65-f658-4b36-9ac8-15688064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377637",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "91e976f76cc027931fed4cf70702efff",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18347",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657c65-7f80-448a-992b-15688064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377637",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "57ffde3504934e25904bcc57d27f9217",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18348",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657c65-3318-46b2-9cd8-15688064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377637",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "75b86a01196854919626e87d5bd45a38",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18349",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657c65-9788-4a4c-b5a9-15688064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377637",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "c25acaa45b0cf65a39c8413fa99e1fe8",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18350",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657c65-86ec-442d-b077-15688064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377637",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "4d85904b15c0adc8664f71bc2c5496bf",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18351",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657c65-5c00-46f9-b147-15688064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377637",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "88e85fb6074ae50a3ccc9b410805ffe5",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18352",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657c65-7318-4bf3-8278-15688064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377637",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "058a5d47f8834fccfff8971f0544e387",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18353",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657c65-8bcc-4a7e-aa47-15688064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377637",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "124c475d67aa8391f5220efcc64ca5b3",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18354",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657c65-56dc-4bb8-800d-15688064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377637",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "054bad7ec0e19cec931078d45382fee6",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18355",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657c65-b82c-4e03-aa1b-15688064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377637",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "b1c114ae9172a3bacc5c6b30c410f354",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18356",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657c65-cb5c-4c8a-b8db-15688064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377637",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "72c88c4a9d2316b266a6702374411a99",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18357",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657d14-2854-4f64-9d64-72cf8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377812",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "67e866c461c285853b225d2b2c850c4f",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18358",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657d14-0654-4e9b-b833-72cf8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377812",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "e1b03f5837533ecc9a05e19650d68e1d",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18359",
|
|
"type": "md5",
|
|
"category": "Artifacts dropped",
|
|
"to_ids": false,
|
|
"uuid": "5b657d14-8f34-41e0-ba68-72cf8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377812",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "11e0f3e1c7d8855ed7f1dcfce4b7702a",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18343",
|
|
"type": "whois-registrant-email",
|
|
"category": "Attribution",
|
|
"to_ids": false,
|
|
"uuid": "5b657c33-0f28-4582-acc2-72cd8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377587",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "bqfkdrmnhh0623@gmail.com",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18344",
|
|
"type": "whois-registrant-name",
|
|
"category": "Attribution",
|
|
"to_ids": false,
|
|
"uuid": "5b657c43-9d0c-49d7-97a8-72cc8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377603",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "huang ning",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18345",
|
|
"type": "whois-registrant-phone",
|
|
"category": "Attribution",
|
|
"to_ids": false,
|
|
"uuid": "5b657c55-0d84-46ef-9e3b-167e8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377621",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "8677687877",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18048",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5a71edfd-5044-404c-8b48-09238e96ca05",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1517415933",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "commail.co",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18049",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5a71edfd-f620-4e5f-bc15-09238e96ca05",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1517415933",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "tibetfrum.info",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18050",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5a71edfd-6f60-4192-8e0f-09238e96ca05",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1517415933",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "tibethouse.info",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18051",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5a71edfd-1054-4f90-b881-09238e96ca05",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1517415933",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "tibetnews.info",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18052",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5a71edfd-2d74-416f-b7f1-09238e96ca05",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1517415933",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "daynew.today",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18053",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5a71edfd-3760-46ea-ac88-09238e96ca05",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1517415933",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "daynews.today",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18054",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5a71edfd-1460-419f-bf27-09238e96ca05",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1517415933",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "tibetnews.today",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18055",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5a71edfd-f73c-4213-9784-09238e96ca05",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1517415933",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "comemails.email",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18056",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5a71edfd-65f0-498f-8143-09238e96ca05",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1517415933",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "comemail.email",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18336",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657c1b-de48-4c26-a83a-72cb8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377563",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "google.comemail.email",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18337",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657c1b-46f4-4103-9646-72cb8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377563",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "google.comemails.email",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18338",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657c1b-7ab4-4be5-bdfa-72cb8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377563",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "google.commail.co",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18339",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657c1b-9da8-4d2a-be4e-72cb8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377563",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "google.commail.email",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18340",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657c1b-8868-476a-ad15-72cb8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377563",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "mail.google.commail.co",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18341",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657c1b-7b50-4ccb-8487-72cb8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377563",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "www.comemail.email",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18342",
|
|
"type": "domain",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657c1b-5dc0-4f64-8569-72cb8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377563",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "www.google.comemails.email",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18330",
|
|
"type": "ip-dst",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657bbb-48f4-4cc2-a236-72cf8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377467",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "27.126.186.222",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18331",
|
|
"type": "ip-dst",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657bbb-e338-4722-af6a-72cf8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377467",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "103.55.24.196",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18332",
|
|
"type": "ip-dst",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657bbb-eed0-4569-a919-72cf8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377467",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "203.189.232.207",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18333",
|
|
"type": "ip-dst",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657bbb-d594-49ae-8e85-72cf8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377467",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "45.127.97.222",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18334",
|
|
"type": "ip-dst",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657bbb-9bdc-4b23-b160-72cf8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377467",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "115.126.86.151",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18335",
|
|
"type": "ip-dst",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "5b657bbb-f600-4013-bb4b-72cf8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377467",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "27.126.176.169",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
},
|
|
{
|
|
"id": "18360",
|
|
"type": "email-src",
|
|
"category": "Payload delivery",
|
|
"to_ids": false,
|
|
"uuid": "5b657d2e-f628-4a1e-b142-72cb8064ab0b",
|
|
"event_id": "133",
|
|
"distribution": "5",
|
|
"timestamp": "1533377838",
|
|
"comment": "",
|
|
"sharing_group_id": "0",
|
|
"deleted": false,
|
|
"value": "tibetanparliarnent@yahoo.com",
|
|
"SharingGroup": [],
|
|
"ShadowAttribute": []
|
|
}
|
|
],
|
|
"ShadowAttribute": [],
|
|
"Tag": []
|
|
}
|
|
}]}
|