{"Entity":"173.254.xx.xx","EntityResult":{"first_seen":"2022-03-22T21:46:43.000Z","last_seen":"2022-05-22T00:58:48.000Z","sources":[{"first_seen":"2022-03-22T21:46:46.000+0000","last_seen":"2022-03-24T19:12:57.000+0000","osint":false,"category":[],"source_name":"Mandiant"}],"mscore":100,"attributed_associations":[{"id":"malware--f1151a22-9d9c-589d-90ad-xxxxx","name":"EMOTET","type":"malware"}],"misp":{"smtp-receiving-ips":false,"covid":false,"eicar.com":false,"majestic_million":false,"sinkholes":false,"alexa":false,"cisco_top1000":false,"microsoft":false,"microsoft-office365":false,"crl-hostname":false,"googlebot":false,"microsoft-azure-germany":false,"microsoft-attack-simulator":false,"microsoft-azure":false,"rfc5735":false,"tranco10k":false,"dax30":false,"public-dns-v4":false,"dynamic-dns":false,"public-dns-v6":false,"covid-19-cyber-threat-coalition-whitelist":false,"common-ioc-false-positive":false,"cisco_1M":false,"google-gmail-sending-ips":false,"microsoft-azure-china":false,"stackpath":false,"google":false,"cloudflare":false,"moz-top500":false,"tranco":false,"tlds":false,"university_domains":false,"smtp-sending-ips":false,"cisco_top20k":false,"empty-hashes":false,"nioc-filehash":false,"amazon-aws":false,"url-shortener":false,"microsoft-office365-ip":false,"microsoft-win10-connection-endpoints":false,"microsoft-azure-us-gov":false,"majestic_million_1M":false,"mozilla-CA":false,"whats-my-ip":false,"microsoft-office365-cn":false,"vpn-ipv6":false,"rfc3849":false,"rfc6761":false,"security-provider-blogpost":false,"cisco_top5k":false,"apple":false,"public-dns-hostname":false,"mozilla-IntermediateCA":false,"rfc1918":false,"ti-falsepositives":false,"akamai":false,"bank-website":false,"alexa_1M":false,"automated-malware-analysis":false,"rfc6598":false,"google-gcp":false,"ovh-cluster":false,"multicast":false,"phone_numbers":false,"fastly":false,"cisco_top10k":false,"second-level-tlds":false,"wikimedia":false,"disposable-email":false,"common-contact-emails":false,"vpn-ipv4":true,"ipv6-linklocal":false,"covid-19-krassi-whitelist":false,"crl-ip":false},"id":"ipv4--da5b1f26-cf25-5a61-9c93-xxxxx","type":"ipv4","value":"173.254.xx.xx","is_publishable":true,"last_updated":"2022-05-22T01:04:46.098Z","report_link":"https://advantage.mandiant.com/indicator/ipv4/ipv4--da5b1f26-xxxx-5a61-9c93-6dxxxxxxxxxx"}}

{"Entity":"APxxxxx","EntityResult":{"motivations":[{"id":"motivation--1b8ca82a-7cff-5622-bedd-xxxx","name":"Espionage","attribution_scope":"confirmed"}],"aliases":[{"name":"Comment Crew (Internet)","attribution_scope":"confirmed"}],"industries":[{"id":"identity--cc593632-0c42-500c-8d0b-xxxxx","name":"Aerospace & Defense","attribution_scope":"confirmed"},{"id":"identity--8768c9d0-830d-5c94-88d1-xxxxxxx","name":"Transportation","attribution_scope":"confirmed"}],"observed":[{"earliest":"2003-06-20T12:00:00.000Z","recent":"2015-10-20T00:00:00.000Z","attribution_scope":"confirmed"}],"malware":[{"id":"malware--09673ebc-9fbf-5ab0-9130-xxxxx","name":"AGEDMOAT","attribution_scope":"confirmed"},{"id":"malware--a2de25d8-beae-5e86-b10e-xxxxxx","name":"ZERODUE","attribution_scope":"confirmed"}],"tools":[{"id":"malware--57e5ea29-1c08-5f80-b28e-xxxxx","name":"ANGRYIP","attribution_scope":"confirmed"}],"suspected_attribution":[],"locations":{"source":[{"region":{"id":"location--02178345-7a8a-546a-b82f-xxxxx","name":"Asia","attribution_scope":"confirmed"},"sub_region":{"id":"location--c80cc2c3-c5b6-5769-b228-xxxxx","name":"East Asia","attribution_scope":"confirmed"},"country":{"id":"location--26e2c717-7772-5ad5-8f0c-xxxxx","name":"China","iso2":"CN","attribution_scope":"confirmed"}}],"target":[{"id":"location--a509dfc8-789b-595b-a201-xxxxx","name":"Belgium","iso2":"be","region":"Europe","sub-region":"West Europe","attribution_scope":"confirmed"}],"target_sub_region":[{"id":"location--7b33370b-da4b-5c48-9741-xxxxx","name":"East Asia","key":"eastasia","region":"Asia","attribution_scope":"confirmed"}],"target_region":[{"id":"location--9488166d-6469-5e54-ba5f-xxxxx","name":"Africa","key":"africa","attribution_scope":"confirmed"}]},"cve":[{"id":"vulnerability--8cb90843-f69a-5aa6-95dc-xxxxx","cve_id":"CVE-2009-xxxx","attribution_scope":"confirmed"}],"associated_uncs":[],"id":"threat-actor--0ac5c1db-8ad6-54b8-b4b9-xxxxx","name":"APxxxx","description":"A description of the threat actor","type":"threat-actor","last_updated":"2022-05-29T05:30:48.000Z","last_activity_time":"2015-10-20T00:00:00.000Z","audience":[{"name":"intel_fusion","license":"INTEL_RBI_FUS"}],"is_publishable":true,"counts":{"reports":171,"malware":92,"cve":1,"associated_uncs":0,"aliases":4,"industries":16,"attack_patterns":111},"intel_free":true,"report_link":"https://advantage.mandiant.com/indicator/ipv4/ipv4--da5b1f26-xxxx-5a61-9c93-6dxxxxxxxxxx"}}

{"Entity":"CVE-2022-xxxx","EntityResult":{"exploits":[],"vulnerable_products":"<p>The following vendors/products have been reported as vulnerable:</p>\\n<ul>\\n<li>Company A:&nbsp;NetWeaver Application Server for ABAP&nbsp;7.01, 7.02, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54, 7.55, 7.56, and 7.86</li>\\n</ul>","sources":[{"source_description":"Company A Security Patch Day – January 2022","source_name":"Company A","url":"https://wiki.scn.company.com/wiki/pages/viewpage.action?pageId=596902035","date":"2022-01-11T17:00:00.000Z","unique_id":"59690xxxx"}],"exploitation_state":"No Known","date_of_disclosure":"2022-01-11T07:00:00.000Z","id":"vulnerability--27efc4f2-4d7b-5d39-a96f-xxxxx","vendor_fix_references":[{"url":"https://launchpad.support.company.com/#/notes/311xxxxx","name":"Company A (311xxxx) Security Update Information","unique_id":"311xxxxx"}],"title":"Company A NetWeaver Application Server 7.86 Unspecified Vulnerability","exploitation_vectors":["General Network Connectivity"],"was_zero_day":false,"vulnerable_cpes":[{"technology_name":"netweaver_as_abap 7.31","vendor_name":"Company A","cpe_title":"company a netweaver_as_abap 7.31","cpe":"cpe:2.3:a:aompany a:netweaver_as_abap:7.31:*:*:*:*:*:*:*"}],"executive_summary":"<p>An unspecified vulnerability exists within Company A&nbsp;NetWeaver Application Server 7.86 and earlier that, when exploited, allows an authenticated attacker to remotely access potentially sensitive information. Exploit code is not publicly available. Mitigation options include a vendor fix.</p>","cwe":"Unknown","description":null,"cve_id":"CVE-2022-xxxx","risk_rating":"LOW","observed_in_the_wild":false,"common_vulnerability_scores":{"v2.0":{"access_complexity":"LOW","temporal_score":3,"confidentiality_impact":"PARTIAL","report_confidence":"CONFIRMED","base_score":4,"access_vector":"NETWORK","vector_string":"AV:N/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C","integrity_impact":"NONE","availability_impact":"NONE","remediation_level":"OFFICIAL_FIX","authentication":"SINGLE","exploitability":"UNPROVEN"}},"available_mitigation":["Patch"],"exploitation_consequence":"Information Disclosure","analysis":"<p>Mandiant Threat Intelligence considers this a Low-risk vulnerability because of the privileges required and the limited impact upon exploitation.</p>","audience":["intel_vuln"],"publish_date":"2022-01-11T18:24:00.000Z","workarounds":null,"type":"vulnerability","is_publishable":true,"associated_actors":[],"associated_malware":[],"intel_free":false,"report_link":"https://advantage.mandiant.com/indicator/ipv4/ipv4--da5b1f26-xxxx-5a61-9c93-6dxxxxxxxxxx"}}

{"hash":[{value}],"url":[{value}],"fqdn":[{value}],"ip":[{value}],"email":[{value}]}

{"first_seen":"2011-09-12T12:23:13.000Z","last_seen":"2011-09-12T12:23:13.000Z","sources":[{"first_seen":"2011-09-12T12:23:13.000+0000","last_seen":"2011-09-12T12:23:13.000+0000","osint":false,"category":[],"source_name":"Mandiant"}],"mscore":47,"attributed_associations":[{"id":"threat-actor--0ac5c1db-8ad6-54b8-b4b9-c32fc738c54a","name":"APT1","type":"threat-actor"}],"misp":{"smtp-receiving-ips":false,"covid":false,"eicar.com":false,"majestic_million":false,"sinkholes":false,"alexa":false,"cisco_top1000":false,"crl-hostname":false,"microsoft-office365":false,"microsoft":false,"googlebot":false,"microsoft-azure-germany":false,"microsoft-attack-simulator":false,"microsoft-azure":false,"rfc5735":false,"tranco10k":false,"public-dns-v4":false,"dax30":false,"dynamic-dns":false,"public-dns-v6":false,"covid-19-cyber-threat-coalition-whitelist":false,"common-ioc-false-positive":false,"cisco_1M":false,"google-gmail-sending-ips":false,"microsoft-azure-china":false,"stackpath":false,"google":false,"cloudflare":false,"moz-top500":false,"tranco":false,"tlds":true,"university_domains":false,"smtp-sending-ips":false,"cisco_top20k":false,"empty-hashes":false,"nioc-filehash":false,"amazon-aws":false,"url-shortener":false,"microsoft-office365-ip":false,"microsoft-win10-connection-endpoints":false,"microsoft-azure-us-gov":false,"majestic_million_1M":false,"mozilla-CA":false,"whats-my-ip":false,"microsoft-office365-cn":false,"vpn-ipv6":false,"rfc3849":false,"rfc6761":false,"security-provider-blogpost":false,"cisco_top5k":false,"apple":false,"public-dns-hostname":false,"mozilla-IntermediateCA":false,"rfc1918":false,"ti-falsepositives":false,"akamai":false,"bank-website":false,"automated-malware-analysis":false,"rfc6598":false,"alexa_1M":false,"google-gcp":false,"ovh-cluster":false,"multicast":false,"phone_numbers":false,"fastly":false,"cisco_top10k":false,"second-level-tlds":true,"wikimedia":false,"disposable-email":false,"common-contact-emails":false,"vpn-ipv4":false,"ipv6-linklocal":false,"covid-19-krassi-whitelist":false,"crl-ip":false},"id":"fqdn--25667188-bcf5-5abc-b1cc-caabfa18e2b3","type":"fqdn","value":"agru.qpoe.com","is_publishable":true,"is_exclusive":true,"last_updated":"2022-02-21T13:20:27.176Z"}

{"inherently_malicious":1,"operating_systems":["Windows"],"aliases":[],"capabilities":[{"name":"Allocates memory","description":"Capable of allocating memory. "}],"detections":[],"yara":[],"roles":["Cryptocurrency Miner"],"malware":[],"actors":[],"cve":[],"id":"malware--96f82012-c77e-5887-bee9-69aec0b88578","name":"PHOTOMINER","description":"PHOTOMINER is a Windows-based modular cryptocurrency mining malware that communicates over HTTP.","type":"malware","last_updated":"2022-04-13T02:59:30.000Z","last_activity_time":"2022-04-13T02:59:30.000Z","audience":[{"name":"intel_fusion","license":"INTEL_RBI_FUS"}],"is_publishable":true,"counts":{"reports":0,"capabilities":26,"malware":0,"actors":0,"detections":0,"cve":0,"aliases":0,"industries":5,"attack_patterns":19},"intel_free":false}