CyberThreatIntel/Unknown/APT-C-37/26-08-19/IOC_APT-C-37_04-09-19.json

135 lines
8.1 KiB
JSON
Raw Permalink Normal View History

2019-09-08 14:38:25 +00:00
<EFBFBD><EFBFBD>[
{
"Indicator": "A6J-) ,/J/) D#-/ BJ'/'* -E'3.exe",
"Description": "03d82852bbb28d1740e50206e7726c006b9b984a8309e2f203e65a67d7d3bcad"
},
{
"Indicator": "History.lnk",
"Description": "3853e0bf00d6dbfc574bc0564f0c90b93a66d644dd4dc8b8c00564f0b6edf581"
},
{
"Indicator": "ss.vbs",
"Description": "2e5f9bb1cef985eab15ad8d9072e51c71be2810fea789836b401b96bc898943b"
},
{
"Indicator": "news.docx",
"Description": "08fa35e25f4c7a6279a84b337d541989498d74f2c5e84cc4039d667fedc725c7"
},
{
"Indicator": "xyx.jse",
"Description": "32e216942f995f285947c7e7ee8cf438440c8a1e033bb27517f5e5361dafa8e8"
},
{
"Indicator": "adamnews.for.ug",
"Description": "domain requested"
},
{
"Indicator": "israanews.zz.com.ve",
"Description": "domain requested"
},
{
"Indicator": "mmksba.dyndns.org",
"Description": "Domain C2"
},
{
"Indicator": "webhoptest.webhop.info",
"Description": "Domain C2"
},
{
"Indicator": "mmksba.simple-url.com",
"Description": "Domain C2"
},
{
"Indicator": "85.17.26.65",
"Description": "IP requested"
},
{
"Indicator": "66.154.103.156",
"Description": "IP C2"
},
{
"Indicator": "37.48.111.5",
"Description": "IP C2"
},
{
"Indicator": "http://israanews.zz.com.ve/hw.zip.zip",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://adamnews.for.ug/hwdownhww",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.dyndns.org:4455/is-ready",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://webhoptest.webhop.info:4433/is-ready",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.simple-url.com:4422/is-ready",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://webhoptest.webhop.info:4433/is-sending",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.simple-url.com:4422/is-sending",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.dyndns.org:4455/is-sending",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://webhoptest.webhop.info:4433/is-recving",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.simple-url.com:4422/is-recving",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.dyndns.org:4455/is-recving",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://webhoptest.webhop.info:4433/is-enum-driver",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.simple-url.com:4422/is-enum-driver",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.dyndns.org:4455/is-enum-driver",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://webhoptest.webhop.info:4433/is-enum-faf",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.simple-url.com:4422/is-enum-faf",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.dyndns.org:4455/is-enum-faf",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://webhoptest.webhop.info:4433/is-enum-process",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.simple-url.com:4422/is-enum-process",
"Description": "HTTP/HTTPS requests"
},
{
"Indicator": "http://mmksba.dyndns.org:4455/is-enum-process",
"Description": "HTTP/HTTPS requests"
}
]