# STIX Report

[toggle all -- all sections]

STIX Version | Filename | Generation Date
--- | --- | ---
1.0.1 | fireeye-pivy-report.xml | 2013-11-07T13:31:38.567-05:00

## Document Contents

## STIX Header

Title | Poison Ivy: Assessing Damage and Extracting Intelligence
Package_Intent | Threat Report
Description | This report spotlights Poison Ivy (PIVY), a RAT that remains popular and effective a full eight years after its release, despite its age and familiarity in IT security circles. Poison Ivy is a remote access tool that is freely available for download from its official web site at www.poisonivy-rat.com. First released in 2005, the tool has gone unchanged since 2008 with version 2.3.2. Poison Ivy includes features common to most Windows-based RATs, including key logging, screen capturing, video capturing, file transfers, system administration, password theft, and traffic relaying. Poison Ivy's wide availability and easy-to-use features make it a popular choice for all kinds of criminals. But it is probably most notable for its role in many high profile, targeted APT attacks. These APTs pursue specific targets, using RATs to maintain a persistent presence within the target's network. They move laterally and escalate system privileges to extract sensitive information-whenever the attacker wants to do so. Because some RATs used in targeted attacks are widely available, determining whether an attack is part of a broader APT campaign can be difficult. Equally challenging is identifying malicious traffic to determine the attacker's post-compromise activities and assess overall damage - these RATs often encrypt their network communications after the initial exploit. In 2011, three years after the most recent release of PIVY, attackers used the RAT to compromise security firm RSA and steal data about its SecureID authentication system. That data was subsequently used in other attacks. The RSA attack was linked to Chinese threat actors and described at the time as extremely sophisticated. Exploiting a zero-day vulnerability, the attack delivered PIVY as the payload. It was not an isolated incident. The campaign appears to have started in 2010, with many other companies compromised. PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers, government agencies, defense contractors, and human rights groups. Still active a year later, the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012. Just recently, PIVY was the payload of a zero-day exploit in Internet Explorer used in what is known as a "strategic web compromise" attack against visitors to a U.S. government website and a variety of others. RATs require live, direct, real-time human interaction by the APT attacker. This characteristic is distinctly different from crimeware (malware focused on cybercrime), where the criminal can issue commands to their botnet of compromised endpoints whenever they please and set them to work on a common goal such as a spam relay. In contrast, RATs are much more personal and may indicate that you are dealing with a dedicated threat actor that is interested in your organization specifically.
Handling | Copyright 2013 FireEye, Inc.
Information_Source | Identity → [id=fireeye:identity-e6186ce2-a9c0-4283-b520-61b8563a66b2] Name → FireEye, Inc. Time → Produced_Time → 2013-11-07T13:14:50.884-05:00

fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920 ○ ○

Description | Poison Ivy is a remote access tool that is freely available for download from its official web site at www.poisonivy-rat.com. First released in 2005, the tool has gone unchanged since 2008 with version 2.3.2. Poison Ivy includes features common to most Windows-based RATs, including key logging, screen capturing, video capturing, file transfers, system administration, password theft, and traffic relaying. Poison Ivy's wide availability and easy-to-use features make it a popular choice for all kinds of criminals. But it is probably most notable for its role in many high profile, targeted APT attacks. These APTs pursue specific targets, using RATs to maintain a persistent presence within the target's network. They move laterally and escalate system privileges to extract sensitive information-whenever the attacker wants to do so.4,5 Because some RATs used in targeted attacks are widely available, determining whether an attack is part of a broader APT campaign can be difficult. Equally challenging is identifying malicious traffic to determine the attacker's post-compromise activities and assess overall damage-these RATs often encrypt their network communications after the initial exploit. In 2011, three years after the most recent release of PIVY, attackers used the RAT to compromise security firm RSA and steal data about its SecureID authentication system. That data was subsequently used in other attacks. The RSA attack was linked to Chinese threat actors and described at the time as extremely sophisticated. Exploiting a zero-day vulnerability, the attack delivered PIVY as the payload. It was not an isolated incident. The campaign appears to have started in 2010, with many other companies compromised. PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers, government agencies, defense contractors, and human rights groups. Still active a year later, the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012. Just recently, PIVY was the payload of a zero-day exploit in Internet Explorer used in what is known as a "strategic web compromise" attack against visitors to a U.S. government website and a variety of others. RATs require live, direct, real-time human interaction by the APT attacker. This characteristic is distinctly different from crimeware (malware focused on cybercrime), where the criminal can issue commands to their botnet of compromised endpoints whenever they please and set them to work on a common goal such as a spam relay. In contrast, RATs are much more personal and may indicate that you are dealing with a dedicated threat actor that is interested in your organization specifically.

Behavior | Behavior → Malware → Malware_Instance → Name → Poison Ivy (PIVY)

fireeye:ttp-7e7c8376-3bcb-4529-9bc3-08522d08106b ○ ○

Description | An attacker targets a specific user or group with a Phishing (CAPEC-98) attack tailored to a category of users in order to have maximum relevance and deceptive capability. Spear Phishing is an enhanced version of the Phishing attack targeted to a specific user or group. The quality of the targeted email is usually enhanced by appearing to come from a known or trusted entity. If the email account of some trusted entity has been compromised the message may be digitally signed. The message will contain information specific to the targeted users that will enhance the probability that they will follow the URL to the compromised site. For example, the message may indicate knowledge of the targets employment, residence, interests, or other information that suggests familiarity. As soon as the user follows the instructions in the message, the attack proceeds as a standard Phishing attack.

Behavior | Behavior → Attack_Patterns → Attack_Pattern [capec_id=CAPEC-163] → Description → Spear Phishing

fireeye:ttp-36bdf9a7-ec1e-4963-be3b-6eeaa49a63a4 ○ ○

Description | A Strategic Web Compromise is a targeted attack utilizing third party web sites/resources. The goal is not large-scale malware distribution through mass compromises. Instead the attackers place their exploit code on websites that cater towards a particular set of visitors that they might be interested in. In the past few years we have witnessed several strategic web compromises of organizations in a variety of fields with a recurring focus on those involved with freedom of speech, human rights, defense, foreign policy and foreign relations. In these cases, normally trusted websites have been compromised to serve up malicious code designed to give backdoor access into the systems of unsuspecting visitors. In general a well patched system will be immune from many of the attacks, but in several cases previously unknown 0-day exploits (no available patch) have found their way onto these sites - in short the average visitor may not have much of a chance to defend themselves.

Behavior | Behavior → Attack_Patterns → Attack_Pattern → Description → Strategic Web Compromise

fireeye:ttp-2ee01cb3-e9fa-46f9-8ec5-ffc9cb0b59f1 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 140e728871eff241e0148363b2931b1d

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-33cc429f-7974-49a9-ab2e-6ebc3c37d62b ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 767d04f72f5941326f11f8927cf3697b

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-fa0ffc72-0f73-4b08-84a5-6ea62b46828b ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 03e0271d12a24050da632675b14091c1

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-f0bfc691-7945-47d9-95c7-a0219b8a5c67 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 87133a339492ecb5142a93c7bbfd3805

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-dfb4e482-2b04-4365-973e-1feb5a567263 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 707a4493775fd9c959861dcf04f18283

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-030d3edf-da7c-4d1f-a0b9-6c38a8af73db ○ ○

Victim Targeting | Victim_Targeting → Identity ○ "fireeye:ciqidentity30instance-f8cd0af8-6534-496e-bf53-f6a9aa11e5ce"

fireeye:ttp-19da6e1c-69a8-4c2f-886d-d620d09d3b5a ○ ○

Behavior | Behavior → Attack_Patterns → Attack_Pattern [capec_id=CAPEC-163] → Description → The preferred attack vector used by admin338 is spear-phishing emails. Using content that is relevant to the target, these emails are designed to entice the target to open an attachment that contains the malicious PIVY server code. The content of the spear-phishing emails and the decoy documents opened after exploitation tend to be in English.

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7e7c8376-3bcb-4529-9bc3-08522d08106b" Related TTP Relationship: Targets DEBUG kill chain phase w/ idref ○ "fireeye:ttp-030d3edf-da7c-4d1f-a0b9-6c38a8af73db"

fireeye:ttp-dff22c1b-26f9-4fbd-8b42-8b8507c684fd ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → e765c69b11860c4f1b84276278991253

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-e55c6eaa-bf0f-4b6b-9572-5cd0d3f62134 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → e74d62dfdc308df3038e61dfc4e4256

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-23a87226-706a-430e-96cd-d7f2c99b7b29 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 8087d49e7bb391e0ba6e482f931b0ad5

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-aaba08c5-e50d-49a1-a54a-cfdf1a68ff51 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 0a43013eef1c2ffba36e3c29512c89a2

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-61a62a6a-9a18-4758-8e52-622431c4b8ae ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 808e21d6efa2884811fbd0adf67fda78

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-5b2a2542-47fe-40f9-8915-4bf7c7397810 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → bc90b4593b7b631a78a8305a873d6d5c

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-35322f13-94bd-4b97-abb6-2a9adc24b8d8 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → be6e72ad1b1ed2685a23dfe1b36f03cc

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-80cd5722-40ff-4938-aba5-991bd8da2b39 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 5032ff32a41748bdb40df0fd581cd669

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-c221ae40-f998-4fa9-ba46-9be04e163371 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 0323de551aa10ca6221368c4a73732e6

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-9717d5a3-773c-490d-b90f-718602fb3c43 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 4713557e3ed2ced62ceccbe4d07314b4

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-2c346548-2150-47f1-91c4-a78fa404be12 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 0678645e45fcd3da84ab27122d6775a9

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-8c1057bd-4a8a-4632-b0d4-b72ebd7936d3 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 3c9a177a39e09e9a4ec4f09c029f5cb2

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-2e160c21-83d0-4d09-a833-c85327e49b46 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 51d9e2993d203bd43a502a2b1e1193da

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-7bac9c8b-c19a-4ce6-9337-4750d68f05cc ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → c977d6e9c7844a1c8d6db1b6a9aba497

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-30fb07e5-fe94-480e-9c15-8d494500cf17 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 02ac495eb31a2405fce287565b590a1f

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-b8d4945a-5fc1-4ceb-a2c4-af17def8b396 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 1f43738b1f67266fdafd73235acbf338

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-30ea087f-7d2b-496b-9ed1-5f000c8b7695 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 8010cae3e8431bb11ed6dc9acabb93b7

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-7b284c94-9598-4e6f-944e-188bbb36716d ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → ce8112de474c22c1407ce94245c2d1de

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-f1a0e293-d490-4e89-9fbb-384188076f60 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 026871ea3d6cbbeb90fea6bf2906cc12

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-707ad4a8-e037-466c-9f59-ac935f53e606 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → db815161022fcecf282b40745f72d9fc

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-b1da97a0-e8e7-44d7-8faf-8907589d8465 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 6cf2f645395fbb64bbc14fb8993e2eea

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-a3f90728-8a0c-453b-9101-27515bd01d51 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 4ffcd711fcfe28d3a6dcac244c552efb

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-f4478b80-3dd3-473d-878a-80a6a82a00a9 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → a5232ea8745e2d7f7740d1d222e2364f

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-cc3533bd-a1e5-411c-9cfe-3660dd07e8e3 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → ef90df225101836952ad7e91b55b30cd

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-c31b9c7e-3eda-4a93-aabc-e5a01d1e8577 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 070d1e5c9299afa47df25e63572a3ae8

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-e5b7be4b-c7ca-40b8-b9f3-e686bb9c3c0d ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 6e99585c3fbd4f3a55bd8f604cb35f38

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-cc00cffe-36b3-40ad-a69c-26427af29935 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 8d36fd85d9c7d1f4bb170a28cc23498a

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-ca7cd0ef-48cf-4cf1-9ad8-aed3f83ffdc7 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 330ddac1f605ff8abf60880c584ed797

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-4703ede5-2184-4f06-a6d0-0144faca4662 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 37f70717f549f1938e5785527e56978d

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-aedd016d-12c0-4d6e-902e-9a1cefd3e7e6 ○ ○

Victim Targeting | Victim_Targeting → Identity ○ "fireeye:ciqidentity30instance-917ed96c-05c2-4754-aed9-9123341f7cb8"

fireeye:ttp-ea2c747d-4aa3-4573-8853-37b7159bc180 ○ ○

Behavior | Behavior → Attack_Patterns → Attack_Pattern → Description → Unlike other users of PIVY (admin@338 and menuPass), th3bug does not appear to rely on spear phishing to distribute PIVY. Instead, attacks attributed to th3bug use a strategic Web compromise to infect targets. This approach is more indiscriminate, which probably accounts for the more disparate range of targets. In the FireEye blog, we documented a recent th3bug strategic Web compromise.

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-36bdf9a7-ec1e-4963-be3b-6eeaa49a63a4" Related TTP Relationship: Targets DEBUG kill chain phase w/ idref ○ "fireeye:ttp-aedd016d-12c0-4d6e-902e-9a1cefd3e7e6"

fireeye:ttp-34a3d511-e213-40d5-a932-fc4d836d455e ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → da931466e4ef41fe7855e33ae4d79daf

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-dcce72e4-fdb6-43af-8eb6-bd474a11ad4c ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 70d227a8c4bf293ab85b79d15b9139ce

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-2821af3c-0f2b-45b4-92f5-465ca7a51920 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 418747bc75e1b4db9fbe13981b38db63

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-862fd6e1-1711-4b70-8bec-1591f4baabc1 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 98256615dada111549761a4c00e9fbd4

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-2e20839b-3ced-4bd7-868d-9cfae43eb84f ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 766837eae6eaaf24b965634256ca8f72

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-15f9dece-0c7c-4579-a1f9-61dca12b2e34 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → b174490ddedb3e21e5c1d6fc2e00d2b4

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-dc5135f2-8d89-4993-a083-4fee4debdfb6 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → a3d593e958c1f3ec1adb027168a83ae2

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-7b8662e4-286e-4862-8b00-79bd3750e3a5 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 0e86c994f2af7e6689a2964f493c6752

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-f86febd3-609b-4d2e-9fec-aa805cb498bf ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 55a3b2656ceac2ba6257b6e39f4a5b5a

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-ddc66992-4a1a-470d-bfae-694e740ce181 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 8002debc47e04d534b45f7bb7dfcab4d

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-2787ecb2-9abe-4141-a61a-e4a04c02126f ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 5ba90fa19a14981f9c13a0046807e757

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-ea91fe28-a94a-4511-a31e-a78eb7fcf9bd ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 0eeaf7bf1d3663cc43b5a545f8863a7a

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-027acc14-5136-478c-a9ff-24d7a8288014 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → f6ae04677428c54c80caf84f25488403

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-08596787-5427-4220-8971-f56ca5aabf2b ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 9535f777553b8f20db9b99f90bdf5a9a

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-ceb035a7-096c-4d8a-bb4c-8fdf2fb93cad ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → a5a672d5573f01ae3457bb22107be93f

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-03fcd8c2-a5ee-46f3-b32e-0f0d655f1d92 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 27cd0af60f08b0270e1ec1a50a7ba90a

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-b30eab7f-e848-4170-acce-a21b7ae45902 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 5d7060f4d72b52f73d49a554a59df27a

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-f34df5fa-b871-4102-9f33-431f7863d1c8 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 0526c1bcdbedf7c354b059ff33f8c9ca

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-c91715d4-e81f-4621-8d09-fec8c15d596f ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 95bcaebe0fb21cfc3b4218e1e1c4033e

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-3db69389-6359-4b1d-9f36-956a4e4e65e3 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → f7bb9fe955bf88e02992b86b7ee898e7

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-767d4bfe-da1d-4567-a9e5-982c69d6be45 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 0eb56631aca651cf163b8c02d5d791de

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-b89b39d3-5079-43ba-8984-5992a607ebde ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 41af5776bb2717a452510b7f63c54a00

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-30f89283-873f-4407-b114-a2863cef5684 ○ ○

Victim Targeting | Victim_Targeting → Identity ○ "fireeye:ciqidentity30instance-b4b9537f-66ec-4595-87bf-7c9595f9babe"

fireeye:ttp-fb6aa549-c94a-4e45-b4fd-7e32602dad85 ○ ○

Behavior | Behavior → Attack_Patterns → Attack_Pattern [capec_id=CAPEC-163] → Description → menuPass appears to favor spear phishing to deliver payloads to the intended targets. While the attackers behind menuPass have used other RATs in their campaign, it appears that they use PIVY as their primary persistence mechanism.

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7e7c8376-3bcb-4529-9bc3-08522d08106b" Related TTP Relationship: Targets DEBUG kill chain phase w/ idref ○ "fireeye:ttp-30f89283-873f-4407-b114-a2863cef5684"

fireeye:ttp-0fd8d950-207a-42cd-b153-041be31e48d5 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 421b1220970488738b5f578999ecac0e

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-a19437ea-b8e3-4598-8423-5a73d88f17de ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 410eeaa18dbec01a27c5b41753b3c7ed

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-2f5b0d2f-3a05-4b11-8d60-2244db7ba7d6 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 3c341919b04d9b57f1be69cd6f21d2d4

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-78837766-44ae-4dc7-9fc1-a897d29f0d88 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 45894da9ebcfd132c29acb6411af8af6

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-2fd26025-1453-4df7-a594-4ba6f7cf54d9 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → d5889a7223b9d13b60ab08aafe3344ad

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-5a74a069-0759-4c93-8ea3-70c53a223230 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → c1bcc9513f27c33d24f7ed0fc5700b47

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-d9bd9ffd-3e6f-453d-80f1-c2205c46dc78 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 1d4e74574bd8fde793d85cbe59f8a288

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-54b02531-48bb-4ff5-ba37-f511908aa858 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 3ae7ea7511c0df60997d2c32252758c1

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-c6bc27e1-5ea8-4047-9a56-4be846f4b97d ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 72f9d92c2ee99ad79d956c9d3a1a0989

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-0be8fa38-6ca3-4f87-bf47-44e5bbf6550b ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 4e78ae59302bbfe440ec25cc104a7a53

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-ec1d7f53-2b04-4371-a04d-65f866f39244 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 6bead751a0f6056008d5d200dea0d88b

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-cf1d3250-57c1-4f91-90d6-b08b9073ca5f ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 494e65cf21ad559fccf3dacdd69acc94

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-9c892e1c-77e4-4ed2-a71b-9e6116a44435 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 459ee0adaad4d493830e655eb4d686f7

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-63c1deff-2e5f-4493-86e9-a4bdcca01878 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 46f5de8e9e165d34e622bbf2cf61942b

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-773eea2a-193c-4c85-9521-65f8f9042140 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 6d989302166ba1709d66f90066c2fd59

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-903a54fe-e116-4d73-9320-23609d13d8b0 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 4ac3e877e1f30d2a1aa9639ac0707307

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-4d95e1e8-bdf5-4c10-81dd-9b86ab7da45d ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 6ff16afc92ce09acd2e3890b780efd86

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-cb1f97b1-2919-4535-bfae-ceb396c52f44 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 4ad286a97c82f91df3e07b101a224f5

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-4ffee86a-b160-4a21-8b73-39c27fe6bf28 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 4bc6cab128f623f34bb97194da21d7b6

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-46a77043-53d1-4259-8121-9dbad4a8828f ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 54dcae2d9d420d6d21d4d605ed798332

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-d129c652-a93c-4f2c-9d7a-feb621c0f499 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 19361c808d262d89437bd56072c9a297

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-07fed79f-6a17-4bf9-a2ed-e6f9877d646a ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 52a58fc5e8aeb2e87215649f66210ed8

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-5b971b83-f177-46d4-98ff-d2ffaac3f29e ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 7aa047cd6dac1d0a4fbc6d968c1b6407

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-895af3d5-5700-475e-bb0b-54d29ec2be8e ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → d9af0e6501c7a375e6276709da4572d8

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-e3cec144-e901-4acf-9f10-1008a51b1cb9 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → a5965b750997dbecec61358d41ac93c7

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-25f6285e-0bd7-404b-8dd4-2b903369d38c ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → a4754be7b34ed55faff832edadac61f6

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-0ac3576b-6347-483d-a04b-2c4fc2c9084d ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 65887898252f7e192709a33be268ea41

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-1bbfa9a4-3be6-4597-83cb-1d70b26cd020 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 7b6b8c695270845aae457dd26cd647a0

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-b7ad5451-75ab-4e97-b92c-f72192b9cc87 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 7e3c3eec58cbb6c4bcc4d59a549f7678

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-641e9792-74f7-4b5a-823e-0b85e48d0f3b ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 85af7819c3cd96895d543570b75b202f

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-b8ad4295-4554-42ad-a3f9-09d06856c666 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 54fcf43e6f7641eeacdf1fd12a740c7c

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-4406c7c7-6c58-478d-aacc-0334929ebdde ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 4e84b1448cf96fabe88c623b222057c4

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-4ea4a3cb-7e52-496c-935a-a57e41e0674e ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 76b744382cdc455f8b20542de34493d2

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-a5ae084e-1ea1-4be3-9ffe-dee4f0993dcf ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 5415be1e85fd3b56fe7a6f57ec3cef43

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-7b12666f-f332-438d-acff-73493ba82399 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 5281dcb76c34b8ae45c3f03f883a08db

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-3ae1dd84-5bd4-44c4-9200-7aab41d9973f ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 82f926009c06dfa452714608da21cb77

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-48311f55-2f8d-4d00-87f9-b39cb338f72f ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 090a6a5da51aa84413e42b2c00e4521f

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-05f3d767-ff79-41aa-a591-e88d0cb65f66 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → f39c796e229a65a3ef23c3885471d1df

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-de8f548e-d2cf-4442-886a-814ef174e56b ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → e84853c0484b02b7518dd683787d04fc

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-6bb608dc-9a2e-4e19-9975-01734a625b12 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 9aab46ed60be9f0356f4b6e39191ae5d

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-8baac074-74b8-4a03-ac83-90618f338ce8 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → ea5580bc00700eab50b99203e64ec0c5

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-0eb3ffa1-654d-414d-ada0-ef210cc55d90 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 0a265f04b44c1177eaa96817b0b70c0f

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-ed7733f2-eaf6-4880-b6b8-b96061717d5a ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 55c0b07de69a0cee01101d0d6f66ca3e

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-14fba9df-d3c2-4c80-a391-99d87a0707da ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 5ac4f52d56009c18e9156ae5ea0d2016

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-4a38cbbf-51f7-42a0-98f5-a9bbc597dad0 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 0fe91d41d2b361f6a88b51a6ed880d23

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-7ace7258-bfff-4c5b-bae4-6583a164abf4 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 86328b05ffaf47ae90de61689a3536c4

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-3f1515b4-a171-48b2-8074-6599c784ed85 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 39a59411e7b12236c0b4351168fb47ce

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-91b36537-bd12-457c-9a12-bd94956e0dec ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 56cff0d0e0ce486aa0b9e4bc0bf2a141

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-e3058c9e-4adb-41ae-8352-5317c1be98ee ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 105c80e404324938eae633934ee44ed1

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-7e310f39-a851-4fcd-b687-d3565ffe6a57 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 8a2205deb22c6ad61f007d52dc220351

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-4aa71750-c8f3-4998-b4ed-f67d903dcff9 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → ed179f1f90765963a0b363bedbe674f6

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-5e8dfa9c-8940-46d5-90d9-d2f50bbf9902 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 018509c1165817d4b0a3e728eab41ea0

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-8214e79e-891a-4d4a-b6d7-26cbd145f63c ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → fc384c3d0bf74258c1b8d05c29afb927

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-daeb0891-b153-41d4-b18b-367a5492133a ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 5c00b5d04c31b1b85382ff1eecff6084

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-260d101a-dddc-4a84-9379-4b48418a3365 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 9a014c33f9a9958ffbcf99d2a71d52fe

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-8e4f6736-10de-4a15-934e-1367072428f4 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → e06cb5f8ed24903ab9f42816cb0c2922

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-2e6b7c86-9afd-4412-ac24-e43f08ec7d2e ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → e3ff26beb4334899014cd941816c3180

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-3f39dad8-de02-468d-bd4b-de7ad4a4e357 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → a5ec5a677346634a42c9f9101ce9d861

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-27a595d0-b2b4-414a-899d-9e87893ac858 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 5b668982bcf868629f1e31bdcda21b05

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-8c857eb3-0576-494d-844f-7d911e50d49a ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → f5315fb4a654087d30c69c768d80f826

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-5032acb9-c978-476a-953a-5d8ebd034d10 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → fde24cf3e9dc626b3a6f4481f74de699

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-1f02f735-3aa2-41aa-a2f1-c82f4cfe1f58 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 046f51fb62d01957497a349be2bb555f

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-e49c5caa-16d1-473b-9e47-c43537c90ced ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 9e161fad98a678fa957d8cda2a608cb0

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-fa89f3e2-7988-43d6-974a-ca8ff1084358 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 8ca16b82d57cf6898a55e9fcdb400769

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-16db0c0e-8af6-4a5a-98c4-ae022d88295b ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 5f0bb4d702ed341cf4c3185d4c141110

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-a0f63787-a087-4261-a795-61fb2dae58da ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 08709f35581e0958d1ca4e50b7d86dba

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-fb17d950-6fb0-4483-adc8-fe084cbc9586 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 8e94701b572fb446c2794cdd3c18ecd9

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-e2830a97-b3ef-4c07-8088-75fc624e296d ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 5c5401fd7d32f481570511c73083e9a1

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-534b451e-a5ee-4264-89a0-b57cd2d9a21d ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → a144440d16fb69cf4522f789aacb3ef2

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-a14c6a5e-9fc0-455a-b4bb-f5e9c4fe4ff6 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 00beeeef9dfe8ddf5f8d539504777e7e

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-3ed0364f-62c8-4ebc-b136-deaf6966880b ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → d8c00fed6625e5f8d0b8188a5caac115

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-8e939441-036c-4a34-a80d-751a0395ae8e ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 60963553335fa5877bd5f9be9d8b23a6

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-6e229c21-7b2f-405c-9cf0-1a9aa218ddaf ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → b18505ee9e2cecc69035acc912114768

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-27cf110c-281e-4f93-94aa-cbd34c7efae4 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 625a4f618d14991cd9bd595bdd590570

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-f8a934bd-1570-4b45-927f-1e3af4cc8f45 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 18ccf0e2709406c4a0b3635064ca32dc

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-4d47bd96-8726-492b-ac8e-50cd4b50c8e8 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → abf8e40d7c99e9b3f515ec0872fe099e

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-56736642-633e-4e2e-a823-484e4c037788 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 15d42116acb393ac4d323fb7606c8108

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-17099f03-5ec8-456d-a2de-968aebaafc78 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → b1deff736b6d12b8d98b485e20d318ea

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-74efd1f5-2718-41e7-981d-7e3b9cb50d71 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → e7a5a551f847c735487acede71f8a9d8

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-3321d61c-6bb1-426a-b853-52d8c3466532 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → dad0c02b91f656ffe1d4de3dbf344624

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-f2984dfd-131a-471a-a41f-cdd0fb432b92 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 1b851bb23578033c79b8b15313b9c382

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-2c4ea690-56bb-41f5-bd79-b6ea19aad2e4 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 1ccb5a6dfec4261b32eee8d439f821df

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-ab8a2af8-9411-4415-8c16-4a19e5dfea7e ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 6005cbea84d281e03b53be49d1378885

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-2be46f2d-4e92-4201-ad83-85c47a69b98a ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 377d8d30172f083b7a0cdff846681f81

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-7781ffbf-2a5c-4a54-a489-2fddd85b7363 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 36cc4c909462db0f067b11a5e719a4ee

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-29acc82d-630c-461b-bb4e-ec99ab06b809 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → bf553932f6f418250a4dd81c63b3ccee

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-2b6638b2-9cc6-41bc-b883-aaf45f7a2947 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → cf8094c07c15aa394dddd4eca4aa8c8b

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-c67fe311-d813-4bda-9b32-e19fbb0d1b0e ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 629049d376058a1f31ab2a36f3c0f234

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-fe844499-4819-463c-84dc-362638ea727e ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → e4242bbcc0aa91c40a50a8305d7a3433

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-b0804b4d-4b1f-4e4a-a871-b1473e73a7c1 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 68fec995a13762184a2616bda86757f8

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-33125ae7-0d34-4e97-ab8b-04c42ab60c3d ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 3243a6caaeb7f175330f0fc7f789aced

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-d1d15120-ea83-4634-9ed2-cd1f34d711f1 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 36c6672abdfa7f8c1cf20d27277d7e1a

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-65ab529f-7c86-423c-9d32-25e8152c0964 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → cd6a0b076678165e04f8583d19a9a46f

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-0db3ebb2-b880-4961-a4e5-98f8f4c60e57 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 1372fae7e279b29eb648d158ae022172

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-74e0b32c-7f4b-4fa9-a82d-46ecfb1a059a ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → bb7ae118a83f3bed742dbbc50136dc50

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-cd721637-f104-4a6d-a79e-f74530287be0 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 6848da04f6c10d2cceae4831351cb291

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-58404eca-36d7-4239-a890-630ba1d158f0 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → aa76e01067c064a8091391759a35ef0a

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-bb93ada5-b5f3-4174-bead-0faecdbe28ce ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 11ea8d8dd0ffde8285f3c0049861a442

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-3d7d1585-9cf4-401b-b480-2aae6131d15f ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → e6ca06e9b000933567a8604300094a85

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-1e89baef-ead0-47d0-8a71-52fbc46bc8db ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → aa7368b928eaaff80e42c0d0637c4a61

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-9849ea2a-fc17-4068-9c01-dab903ada13c ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → e62584c9cd15c3fa2b6ed0f3a34688ab

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-0d5fe336-cb01-47df-93a6-7c5de9b01a5a ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → c2f000577585ce59661b21a500eb253e

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-d8e98488-2c1f-41a9-86c9-602d5a96cac1 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → d84851ad131424f04fbffc3bbac03bff

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-0b2e2718-a421-4f9a-ad54-2ab2136698fe ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 223d1396f2b5b7719702c980cbd1d6c0

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-420ef2ec-4603-4107-a9a4-5b14fb27ec95 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → c2c7ceb8a428a36b80b9ce1037d209dd

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-621f3091-a6b6-410b-b715-fb61d91d1511 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → d6dba8166b7b1da0173a0165d3a3e0bf

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-387526e2-fa1a-4d12-aa15-535ed244cdc5 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 20098465e8fd00f8a0845fff134ed844

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-0768d1fb-70e6-4e31-a083-8a1abdf1d8ff ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → d81dac704850c0ee051b8455510cc0a4

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-70d965e8-f28f-4223-abd2-a7efb403e038 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → c84a04eabb91e3dd2388d435527b6906

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-4d6850f0-483b-4f5f-b1da-f87a8510e9a6 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 31f7e35e7a73a1d89b6269412a935996

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-defb1821-8428-4ead-8c08-da365d237ab2 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → cab408c59c3450fcc9ddb401eede170f

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-39c32255-bb13-468e-9cda-c5644b931cb4 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → b5695df9da14b8c9db7e607942d01fac

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-dcc8004b-ab26-4582-b7dc-568acbb48a57 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → c3171961e78d3acdb4cd299c643ba482

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-fa468c98-b8b9-4145-8308-4b91a2c34c72 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 2a113b26b0133f67ed900a06a330683d

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-e61000b5-a2df-466d-9525-974b427fb7e9 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → b2dc98caa647e64a2a8105c298218462

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-ae0ee06f-a939-422e-bf3c-718872457362 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → f815281ed4b16169e0b474dbac612bbc

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-6379656a-19e5-483b-ae0d-747726690807 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → e9622f4b9d2a82c296a773a2c6e63fcb

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-3cb94b8d-da73-4624-ba1d-a2a9769cebd6 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → b08694e14a9b966d8033b42b58ab727d

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-7e39361b-cd37-450a-ab88-f934a103ff72 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 1000371d10154fcfd94028ad66285519

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-585b2299-7a01-48ee-89f9-7f966b2f641c ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 2173b43a66070aadf052ab66dd6933ce

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-fb6cb6fa-d4c4-4f4a-87e3-c3b7ae4d4a3c ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 2ffe59a6a047b2333a1f3eb58753f3bc

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-76b27221-959b-4471-8c9a-2af95655816c ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 441d239744d05b861202e3e25a2af0cd

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-b7610226-c87a-465e-bff9-c3656f423416 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 4ab9bcbec67cafda3a1e4bf6d2d60de9

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-1ca1bdde-4f34-4a35-a215-71007c060ba4 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 6fbd221f328ced713025ffcf589dba9a

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-85bf512d-c12b-40f4-b0b6-793f71cb1e07 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 7d551d1cba1aa7696ab5a787e93b4c83

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-7e16ec98-a87f-403d-a546-a0deb9fa4b81 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 841ec2dec944964fc54786a1167713ff

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-45c33198-370c-4cf6-99e0-9cea66f237fa ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 85321dee31100bd3ece5b586ac3e6557

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-3b83b772-fcba-46e4-9a52-cd4678c68b83 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 9de349e581b66bd410cf7a737d0db1e1

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-632ea185-c226-44e7-858a-05aac2d0c3bf ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 9e2af3377f508c22a3e96e1110ad5f12

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-70d7f498-93a8-4a33-b6a0-028f5ef6ab36 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → a4d13be7f6b8f66c80731b75d7d5aff8

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-4d0aeaec-d073-4615-90b3-a9e717025db9 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → b9ddbb07c4bde0d4f8e6b2065a7d8848

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-435adcbb-7a46-4255-a581-f9f8cf39644b ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → cab66da82594ff5266ac8dd89e3d1539

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-4fe1269e-7360-471e-9788-d13af3dc77ef ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → e5e3fd8a9ee0a5b8e66c11ce1e081067

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-7323cc18-c4b2-4e25-8a5e-3caa4afa3081 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → f0ee1f777d1c6a009c37cbcbf81f3a5a

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-bf2bdcaf-61a0-4e90-bcce-ad0b0551a02e ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → f18c7639dbb8644c4bca179243ee2a99

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-e51f43fe-37eb-4469-a666-a4c74708c9ed ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 4ad286a97c82f91df3e07b101a224f56

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-f9e0c47b-a923-4ea6-805e-bd7dcdefeb26 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → 88fd19e48625e623a4d6abb5d5b78445

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:ttp-59fae6a2-4a3b-418e-8ca7-06a845820666 ○ ○

Behavior | Behavior → Malware → Malware_Instance → Name → d05f81cd8d079b862b2ce7d241ad2209

Related TTPs | Related TTP Relationship: Variant Of DEBUG kill chain phase w/ idref ○ "fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920"

fireeye:courseofaction-70b3d5f6-374b-4488-8688-729b6eedac5b ○ ○
course of action (type: CourseOfActionType)
Title → Analyze with FireEye Calamine Toolset
Description →
Calamine is a set of free tools to help organizations detect and examine Poison Ivy infections on their systems. The package includes these components: * PIVY callback-decoding tool (ChopShop module, available here: https://github.com/fireeye/chopshop) * PIVY memory-decoding tool (PIVY PyCommand script, available here: https://github.com/fireeye/pycommands)
fireeye:campaign-700c8b90-fd16-40e9-8b80-00b0c8bc84ee ○ ○

Title | F

Related TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2ee01cb3-e9fa-46f9-8ec5-ffc9cb0b59f1" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-33cc429f-7974-49a9-ab2e-6ebc3c37d62b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fa0ffc72-0f73-4b08-84a5-6ea62b46828b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f0bfc691-7945-47d9-95c7-a0219b8a5c67" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-dfb4e482-2b04-4365-973e-1feb5a567263"

fireeye:campaign-752c225d-d6f6-4456-9130-d9580fd4007b ○ ○

Title | admin338

Status | Ongoing

Related TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-dff22c1b-26f9-4fbd-8b42-8b8507c684fd" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e55c6eaa-bf0f-4b6b-9572-5cd0d3f62134" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-23a87226-706a-430e-96cd-d7f2c99b7b29" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-aaba08c5-e50d-49a1-a54a-cfdf1a68ff51" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-61a62a6a-9a18-4758-8e52-622431c4b8ae" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-5b2a2542-47fe-40f9-8915-4bf7c7397810" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-35322f13-94bd-4b97-abb6-2a9adc24b8d8" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-80cd5722-40ff-4938-aba5-991bd8da2b39" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-c221ae40-f998-4fa9-ba46-9be04e163371" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-9717d5a3-773c-490d-b90f-718602fb3c43" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2c346548-2150-47f1-91c4-a78fa404be12" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8c1057bd-4a8a-4632-b0d4-b72ebd7936d3" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2e160c21-83d0-4d09-a833-c85327e49b46" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7bac9c8b-c19a-4ce6-9337-4750d68f05cc" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-30fb07e5-fe94-480e-9c15-8d494500cf17" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b8d4945a-5fc1-4ceb-a2c4-af17def8b396" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-30ea087f-7d2b-496b-9ed1-5f000c8b7695" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7b284c94-9598-4e6f-944e-188bbb36716d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f1a0e293-d490-4e89-9fbb-384188076f60" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-707ad4a8-e037-466c-9f59-ac935f53e606" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b1da97a0-e8e7-44d7-8faf-8907589d8465" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-030d3edf-da7c-4d1f-a0b9-6c38a8af73db" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-19da6e1c-69a8-4c2f-886d-d620d09d3b5a"

fireeye:campaign-36082810-2226-4c00-88dc-d69f92efa60e ○ ○

Title | japanorus

Related TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-a3f90728-8a0c-453b-9101-27515bd01d51" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f4478b80-3dd3-473d-878a-80a6a82a00a9"

fireeye:campaign-4ce0b014-1313-4089-a2e6-ba0a37d934f8 ○ ○

Title | nitro

Related TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-cc3533bd-a1e5-411c-9cfe-3660dd07e8e3" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-c31b9c7e-3eda-4a93-aabc-e5a01d1e8577" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e5b7be4b-c7ca-40b8-b9f3-e686bb9c3c0d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-cc00cffe-36b3-40ad-a69c-26427af29935" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ca7cd0ef-48cf-4cf1-9ad8-aed3f83ffdc7" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4703ede5-2184-4f06-a6d0-0144faca4662"

fireeye:campaign-d02a1560-ff69-49f4-ac34-919b8aa4b91e ○ ○

Title | th3bug

Status | Ongoing

Related TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-34a3d511-e213-40d5-a932-fc4d836d455e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-dcce72e4-fdb6-43af-8eb6-bd474a11ad4c" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2821af3c-0f2b-45b4-92f5-465ca7a51920" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-862fd6e1-1711-4b70-8bec-1591f4baabc1" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2e20839b-3ced-4bd7-868d-9cfae43eb84f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-15f9dece-0c7c-4579-a1f9-61dca12b2e34" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-dc5135f2-8d89-4993-a083-4fee4debdfb6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7b8662e4-286e-4862-8b00-79bd3750e3a5" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f86febd3-609b-4d2e-9fec-aa805cb498bf" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ddc66992-4a1a-470d-bfae-694e740ce181" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2787ecb2-9abe-4141-a61a-e4a04c02126f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ea91fe28-a94a-4511-a31e-a78eb7fcf9bd" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-027acc14-5136-478c-a9ff-24d7a8288014" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-08596787-5427-4220-8971-f56ca5aabf2b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-aedd016d-12c0-4d6e-902e-9a1cefd3e7e6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ea2c747d-4aa3-4573-8853-37b7159bc180"

fireeye:campaign-157fd308-1677-46f5-a4b2-66cc24d801d7 ○ ○

Title | wl

Related TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ceb035a7-096c-4d8a-bb4c-8fdf2fb93cad" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-03fcd8c2-a5ee-46f3-b32e-0f0d655f1d92" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b30eab7f-e848-4170-acce-a21b7ae45902" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f34df5fa-b871-4102-9f33-431f7863d1c8" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-c91715d4-e81f-4621-8d09-fec8c15d596f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3db69389-6359-4b1d-9f36-956a4e4e65e3" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-767d4bfe-da1d-4567-a9e5-982c69d6be45" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b89b39d3-5079-43ba-8984-5992a607ebde"

fireeye:campaign-721976f9-56d7-4749-8c69-b3ac7c315f05 ○ ○

Title | menupass

Status | Ongoing

Related TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0fd8d950-207a-42cd-b153-041be31e48d5" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-a19437ea-b8e3-4598-8423-5a73d88f17de" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2f5b0d2f-3a05-4b11-8d60-2244db7ba7d6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-78837766-44ae-4dc7-9fc1-a897d29f0d88" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2fd26025-1453-4df7-a594-4ba6f7cf54d9" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-5a74a069-0759-4c93-8ea3-70c53a223230" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-d9bd9ffd-3e6f-453d-80f1-c2205c46dc78" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-54b02531-48bb-4ff5-ba37-f511908aa858" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-c6bc27e1-5ea8-4047-9a56-4be846f4b97d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0be8fa38-6ca3-4f87-bf47-44e5bbf6550b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ec1d7f53-2b04-4371-a04d-65f866f39244" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-cf1d3250-57c1-4f91-90d6-b08b9073ca5f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-9c892e1c-77e4-4ed2-a71b-9e6116a44435" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-63c1deff-2e5f-4493-86e9-a4bdcca01878" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-773eea2a-193c-4c85-9521-65f8f9042140" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-903a54fe-e116-4d73-9320-23609d13d8b0" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4d95e1e8-bdf5-4c10-81dd-9b86ab7da45d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-cb1f97b1-2919-4535-bfae-ceb396c52f44" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4ffee86a-b160-4a21-8b73-39c27fe6bf28" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-46a77043-53d1-4259-8121-9dbad4a8828f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-d129c652-a93c-4f2c-9d7a-feb621c0f499" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-07fed79f-6a17-4bf9-a2ed-e6f9877d646a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-5b971b83-f177-46d4-98ff-d2ffaac3f29e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-895af3d5-5700-475e-bb0b-54d29ec2be8e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e3cec144-e901-4acf-9f10-1008a51b1cb9" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-25f6285e-0bd7-404b-8dd4-2b903369d38c" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0ac3576b-6347-483d-a04b-2c4fc2c9084d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-1bbfa9a4-3be6-4597-83cb-1d70b26cd020" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b7ad5451-75ab-4e97-b92c-f72192b9cc87" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-641e9792-74f7-4b5a-823e-0b85e48d0f3b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b8ad4295-4554-42ad-a3f9-09d06856c666" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4406c7c7-6c58-478d-aacc-0334929ebdde" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4ea4a3cb-7e52-496c-935a-a57e41e0674e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-a5ae084e-1ea1-4be3-9ffe-dee4f0993dcf" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7b12666f-f332-438d-acff-73493ba82399" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3ae1dd84-5bd4-44c4-9200-7aab41d9973f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-48311f55-2f8d-4d00-87f9-b39cb338f72f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-05f3d767-ff79-41aa-a591-e88d0cb65f66" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-de8f548e-d2cf-4442-886a-814ef174e56b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-6bb608dc-9a2e-4e19-9975-01734a625b12" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8baac074-74b8-4a03-ac83-90618f338ce8" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0eb3ffa1-654d-414d-ada0-ef210cc55d90" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ed7733f2-eaf6-4880-b6b8-b96061717d5a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-14fba9df-d3c2-4c80-a391-99d87a0707da" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4a38cbbf-51f7-42a0-98f5-a9bbc597dad0" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7ace7258-bfff-4c5b-bae4-6583a164abf4" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3f1515b4-a171-48b2-8074-6599c784ed85" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-91b36537-bd12-457c-9a12-bd94956e0dec" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e3058c9e-4adb-41ae-8352-5317c1be98ee" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7e310f39-a851-4fcd-b687-d3565ffe6a57" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4aa71750-c8f3-4998-b4ed-f67d903dcff9" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-5e8dfa9c-8940-46d5-90d9-d2f50bbf9902" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8214e79e-891a-4d4a-b6d7-26cbd145f63c" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-daeb0891-b153-41d4-b18b-367a5492133a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-260d101a-dddc-4a84-9379-4b48418a3365" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8e4f6736-10de-4a15-934e-1367072428f4" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2e6b7c86-9afd-4412-ac24-e43f08ec7d2e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3f39dad8-de02-468d-bd4b-de7ad4a4e357" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-27a595d0-b2b4-414a-899d-9e87893ac858" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8c857eb3-0576-494d-844f-7d911e50d49a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-5032acb9-c978-476a-953a-5d8ebd034d10" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-1f02f735-3aa2-41aa-a2f1-c82f4cfe1f58" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e49c5caa-16d1-473b-9e47-c43537c90ced" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fa89f3e2-7988-43d6-974a-ca8ff1084358" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-16db0c0e-8af6-4a5a-98c4-ae022d88295b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-a0f63787-a087-4261-a795-61fb2dae58da" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fb17d950-6fb0-4483-adc8-fe084cbc9586" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e2830a97-b3ef-4c07-8088-75fc624e296d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-534b451e-a5ee-4264-89a0-b57cd2d9a21d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-a14c6a5e-9fc0-455a-b4bb-f5e9c4fe4ff6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3ed0364f-62c8-4ebc-b136-deaf6966880b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8e939441-036c-4a34-a80d-751a0395ae8e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-6e229c21-7b2f-405c-9cf0-1a9aa218ddaf" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-27cf110c-281e-4f93-94aa-cbd34c7efae4" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f8a934bd-1570-4b45-927f-1e3af4cc8f45" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4d47bd96-8726-492b-ac8e-50cd4b50c8e8" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-56736642-633e-4e2e-a823-484e4c037788" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-17099f03-5ec8-456d-a2de-968aebaafc78" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-74efd1f5-2718-41e7-981d-7e3b9cb50d71" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3321d61c-6bb1-426a-b853-52d8c3466532" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f2984dfd-131a-471a-a41f-cdd0fb432b92" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2c4ea690-56bb-41f5-bd79-b6ea19aad2e4" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ab8a2af8-9411-4415-8c16-4a19e5dfea7e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2be46f2d-4e92-4201-ad83-85c47a69b98a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7781ffbf-2a5c-4a54-a489-2fddd85b7363" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-29acc82d-630c-461b-bb4e-ec99ab06b809" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2b6638b2-9cc6-41bc-b883-aaf45f7a2947" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-c67fe311-d813-4bda-9b32-e19fbb0d1b0e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fe844499-4819-463c-84dc-362638ea727e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b0804b4d-4b1f-4e4a-a871-b1473e73a7c1" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-33125ae7-0d34-4e97-ab8b-04c42ab60c3d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-d1d15120-ea83-4634-9ed2-cd1f34d711f1" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-65ab529f-7c86-423c-9d32-25e8152c0964" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0db3ebb2-b880-4961-a4e5-98f8f4c60e57" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-74e0b32c-7f4b-4fa9-a82d-46ecfb1a059a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-cd721637-f104-4a6d-a79e-f74530287be0" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-58404eca-36d7-4239-a890-630ba1d158f0" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-bb93ada5-b5f3-4174-bead-0faecdbe28ce" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3d7d1585-9cf4-401b-b480-2aae6131d15f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-1e89baef-ead0-47d0-8a71-52fbc46bc8db" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-9849ea2a-fc17-4068-9c01-dab903ada13c" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0d5fe336-cb01-47df-93a6-7c5de9b01a5a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-d8e98488-2c1f-41a9-86c9-602d5a96cac1" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0b2e2718-a421-4f9a-ad54-2ab2136698fe" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-420ef2ec-4603-4107-a9a4-5b14fb27ec95" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-621f3091-a6b6-410b-b715-fb61d91d1511" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-387526e2-fa1a-4d12-aa15-535ed244cdc5" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0768d1fb-70e6-4e31-a083-8a1abdf1d8ff" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-70d965e8-f28f-4223-abd2-a7efb403e038" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4d6850f0-483b-4f5f-b1da-f87a8510e9a6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-defb1821-8428-4ead-8c08-da365d237ab2" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-39c32255-bb13-468e-9cda-c5644b931cb4" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-dcc8004b-ab26-4582-b7dc-568acbb48a57" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fa468c98-b8b9-4145-8308-4b91a2c34c72" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e61000b5-a2df-466d-9525-974b427fb7e9" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ae0ee06f-a939-422e-bf3c-718872457362" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-6379656a-19e5-483b-ae0d-747726690807" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3cb94b8d-da73-4624-ba1d-a2a9769cebd6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-30f89283-873f-4407-b114-a2863cef5684" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fb6aa549-c94a-4e45-b4fd-7e32602dad85"

fireeye:threatactor-7b14e202-bd27-4885-b8d7-b908a9651a03 ○ ○

Title | F

Observed TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2ee01cb3-e9fa-46f9-8ec5-ffc9cb0b59f1" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-33cc429f-7974-49a9-ab2e-6ebc3c37d62b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fa0ffc72-0f73-4b08-84a5-6ea62b46828b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f0bfc691-7945-47d9-95c7-a0219b8a5c67" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-dfb4e482-2b04-4365-973e-1feb5a567263"

fireeye:threatactor-9b371afe-ddfd-4954-abaf-8abb357ac78e ○ ○

Title | admin338

Types | type Value → APT

Observed TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-dff22c1b-26f9-4fbd-8b42-8b8507c684fd" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e55c6eaa-bf0f-4b6b-9572-5cd0d3f62134" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-23a87226-706a-430e-96cd-d7f2c99b7b29" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-aaba08c5-e50d-49a1-a54a-cfdf1a68ff51" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-61a62a6a-9a18-4758-8e52-622431c4b8ae" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-5b2a2542-47fe-40f9-8915-4bf7c7397810" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-35322f13-94bd-4b97-abb6-2a9adc24b8d8" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-80cd5722-40ff-4938-aba5-991bd8da2b39" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-c221ae40-f998-4fa9-ba46-9be04e163371" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-9717d5a3-773c-490d-b90f-718602fb3c43" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2c346548-2150-47f1-91c4-a78fa404be12" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8c1057bd-4a8a-4632-b0d4-b72ebd7936d3" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2e160c21-83d0-4d09-a833-c85327e49b46" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7bac9c8b-c19a-4ce6-9337-4750d68f05cc" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-30fb07e5-fe94-480e-9c15-8d494500cf17" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b8d4945a-5fc1-4ceb-a2c4-af17def8b396" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-30ea087f-7d2b-496b-9ed1-5f000c8b7695" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7b284c94-9598-4e6f-944e-188bbb36716d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f1a0e293-d490-4e89-9fbb-384188076f60" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-707ad4a8-e037-466c-9f59-ac935f53e606" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b1da97a0-e8e7-44d7-8faf-8907589d8465" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-030d3edf-da7c-4d1f-a0b9-6c38a8af73db" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-19da6e1c-69a8-4c2f-886d-d620d09d3b5a"

fireeye:threatactor-12b54231-a99d-431e-9587-34b4cb447e98 ○ ○

Title | japanorus

Observed TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-a3f90728-8a0c-453b-9101-27515bd01d51" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f4478b80-3dd3-473d-878a-80a6a82a00a9"

fireeye:threatactor-3cc07211-163e-4d26-8c5c-2d0998b60d4f ○ ○

Title | nitro

Observed TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-cc3533bd-a1e5-411c-9cfe-3660dd07e8e3" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-c31b9c7e-3eda-4a93-aabc-e5a01d1e8577" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e5b7be4b-c7ca-40b8-b9f3-e686bb9c3c0d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-cc00cffe-36b3-40ad-a69c-26427af29935" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ca7cd0ef-48cf-4cf1-9ad8-aed3f83ffdc7" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4703ede5-2184-4f06-a6d0-0144faca4662"

fireeye:threatactor-fb580b4d-b36d-415c-b711-d9997955f5c1 ○ ○

Title | th3bug

Types | type Value → APT

Observed TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-34a3d511-e213-40d5-a932-fc4d836d455e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-dcce72e4-fdb6-43af-8eb6-bd474a11ad4c" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2821af3c-0f2b-45b4-92f5-465ca7a51920" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-862fd6e1-1711-4b70-8bec-1591f4baabc1" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2e20839b-3ced-4bd7-868d-9cfae43eb84f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-15f9dece-0c7c-4579-a1f9-61dca12b2e34" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-dc5135f2-8d89-4993-a083-4fee4debdfb6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7b8662e4-286e-4862-8b00-79bd3750e3a5" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f86febd3-609b-4d2e-9fec-aa805cb498bf" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ddc66992-4a1a-470d-bfae-694e740ce181" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2787ecb2-9abe-4141-a61a-e4a04c02126f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ea91fe28-a94a-4511-a31e-a78eb7fcf9bd" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-027acc14-5136-478c-a9ff-24d7a8288014" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-08596787-5427-4220-8971-f56ca5aabf2b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-aedd016d-12c0-4d6e-902e-9a1cefd3e7e6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ea2c747d-4aa3-4573-8853-37b7159bc180"

fireeye:threatactor-c5f80025-d518-470e-977d-e99d50ea21e8 ○ ○

Title | wl

Observed TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ceb035a7-096c-4d8a-bb4c-8fdf2fb93cad" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-03fcd8c2-a5ee-46f3-b32e-0f0d655f1d92" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b30eab7f-e848-4170-acce-a21b7ae45902" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f34df5fa-b871-4102-9f33-431f7863d1c8" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-c91715d4-e81f-4621-8d09-fec8c15d596f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3db69389-6359-4b1d-9f36-956a4e4e65e3" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-767d4bfe-da1d-4567-a9e5-982c69d6be45" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b89b39d3-5079-43ba-8984-5992a607ebde"

fireeye:threatactor-0d059e61-df46-46e4-9fe3-fb10dfd1751c ○ ○

Title | menupass

Types | type Value → APT

Observed TTPs | DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0fd8d950-207a-42cd-b153-041be31e48d5" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-a19437ea-b8e3-4598-8423-5a73d88f17de" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2f5b0d2f-3a05-4b11-8d60-2244db7ba7d6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-78837766-44ae-4dc7-9fc1-a897d29f0d88" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2fd26025-1453-4df7-a594-4ba6f7cf54d9" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-5a74a069-0759-4c93-8ea3-70c53a223230" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-d9bd9ffd-3e6f-453d-80f1-c2205c46dc78" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-54b02531-48bb-4ff5-ba37-f511908aa858" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-c6bc27e1-5ea8-4047-9a56-4be846f4b97d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0be8fa38-6ca3-4f87-bf47-44e5bbf6550b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ec1d7f53-2b04-4371-a04d-65f866f39244" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-cf1d3250-57c1-4f91-90d6-b08b9073ca5f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-9c892e1c-77e4-4ed2-a71b-9e6116a44435" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-63c1deff-2e5f-4493-86e9-a4bdcca01878" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-773eea2a-193c-4c85-9521-65f8f9042140" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-903a54fe-e116-4d73-9320-23609d13d8b0" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4d95e1e8-bdf5-4c10-81dd-9b86ab7da45d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-cb1f97b1-2919-4535-bfae-ceb396c52f44" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4ffee86a-b160-4a21-8b73-39c27fe6bf28" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-46a77043-53d1-4259-8121-9dbad4a8828f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-d129c652-a93c-4f2c-9d7a-feb621c0f499" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-07fed79f-6a17-4bf9-a2ed-e6f9877d646a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-5b971b83-f177-46d4-98ff-d2ffaac3f29e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-895af3d5-5700-475e-bb0b-54d29ec2be8e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e3cec144-e901-4acf-9f10-1008a51b1cb9" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-25f6285e-0bd7-404b-8dd4-2b903369d38c" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0ac3576b-6347-483d-a04b-2c4fc2c9084d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-1bbfa9a4-3be6-4597-83cb-1d70b26cd020" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b7ad5451-75ab-4e97-b92c-f72192b9cc87" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-641e9792-74f7-4b5a-823e-0b85e48d0f3b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b8ad4295-4554-42ad-a3f9-09d06856c666" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4406c7c7-6c58-478d-aacc-0334929ebdde" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4ea4a3cb-7e52-496c-935a-a57e41e0674e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-a5ae084e-1ea1-4be3-9ffe-dee4f0993dcf" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7b12666f-f332-438d-acff-73493ba82399" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3ae1dd84-5bd4-44c4-9200-7aab41d9973f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-48311f55-2f8d-4d00-87f9-b39cb338f72f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-05f3d767-ff79-41aa-a591-e88d0cb65f66" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-de8f548e-d2cf-4442-886a-814ef174e56b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-6bb608dc-9a2e-4e19-9975-01734a625b12" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8baac074-74b8-4a03-ac83-90618f338ce8" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0eb3ffa1-654d-414d-ada0-ef210cc55d90" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ed7733f2-eaf6-4880-b6b8-b96061717d5a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-14fba9df-d3c2-4c80-a391-99d87a0707da" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4a38cbbf-51f7-42a0-98f5-a9bbc597dad0" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7ace7258-bfff-4c5b-bae4-6583a164abf4" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3f1515b4-a171-48b2-8074-6599c784ed85" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-91b36537-bd12-457c-9a12-bd94956e0dec" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e3058c9e-4adb-41ae-8352-5317c1be98ee" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7e310f39-a851-4fcd-b687-d3565ffe6a57" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4aa71750-c8f3-4998-b4ed-f67d903dcff9" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-5e8dfa9c-8940-46d5-90d9-d2f50bbf9902" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8214e79e-891a-4d4a-b6d7-26cbd145f63c" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-daeb0891-b153-41d4-b18b-367a5492133a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-260d101a-dddc-4a84-9379-4b48418a3365" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8e4f6736-10de-4a15-934e-1367072428f4" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2e6b7c86-9afd-4412-ac24-e43f08ec7d2e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3f39dad8-de02-468d-bd4b-de7ad4a4e357" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-27a595d0-b2b4-414a-899d-9e87893ac858" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8c857eb3-0576-494d-844f-7d911e50d49a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-5032acb9-c978-476a-953a-5d8ebd034d10" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-1f02f735-3aa2-41aa-a2f1-c82f4cfe1f58" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e49c5caa-16d1-473b-9e47-c43537c90ced" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fa89f3e2-7988-43d6-974a-ca8ff1084358" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-16db0c0e-8af6-4a5a-98c4-ae022d88295b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-a0f63787-a087-4261-a795-61fb2dae58da" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fb17d950-6fb0-4483-adc8-fe084cbc9586" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e2830a97-b3ef-4c07-8088-75fc624e296d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-534b451e-a5ee-4264-89a0-b57cd2d9a21d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-a14c6a5e-9fc0-455a-b4bb-f5e9c4fe4ff6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3ed0364f-62c8-4ebc-b136-deaf6966880b" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-8e939441-036c-4a34-a80d-751a0395ae8e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-6e229c21-7b2f-405c-9cf0-1a9aa218ddaf" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-27cf110c-281e-4f93-94aa-cbd34c7efae4" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f8a934bd-1570-4b45-927f-1e3af4cc8f45" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4d47bd96-8726-492b-ac8e-50cd4b50c8e8" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-56736642-633e-4e2e-a823-484e4c037788" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-17099f03-5ec8-456d-a2de-968aebaafc78" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-74efd1f5-2718-41e7-981d-7e3b9cb50d71" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3321d61c-6bb1-426a-b853-52d8c3466532" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-f2984dfd-131a-471a-a41f-cdd0fb432b92" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2c4ea690-56bb-41f5-bd79-b6ea19aad2e4" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ab8a2af8-9411-4415-8c16-4a19e5dfea7e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2be46f2d-4e92-4201-ad83-85c47a69b98a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-7781ffbf-2a5c-4a54-a489-2fddd85b7363" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-29acc82d-630c-461b-bb4e-ec99ab06b809" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-2b6638b2-9cc6-41bc-b883-aaf45f7a2947" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-c67fe311-d813-4bda-9b32-e19fbb0d1b0e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fe844499-4819-463c-84dc-362638ea727e" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-b0804b4d-4b1f-4e4a-a871-b1473e73a7c1" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-33125ae7-0d34-4e97-ab8b-04c42ab60c3d" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-d1d15120-ea83-4634-9ed2-cd1f34d711f1" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-65ab529f-7c86-423c-9d32-25e8152c0964" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0db3ebb2-b880-4961-a4e5-98f8f4c60e57" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-74e0b32c-7f4b-4fa9-a82d-46ecfb1a059a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-cd721637-f104-4a6d-a79e-f74530287be0" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-58404eca-36d7-4239-a890-630ba1d158f0" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-bb93ada5-b5f3-4174-bead-0faecdbe28ce" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3d7d1585-9cf4-401b-b480-2aae6131d15f" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-1e89baef-ead0-47d0-8a71-52fbc46bc8db" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-9849ea2a-fc17-4068-9c01-dab903ada13c" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0d5fe336-cb01-47df-93a6-7c5de9b01a5a" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-d8e98488-2c1f-41a9-86c9-602d5a96cac1" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0b2e2718-a421-4f9a-ad54-2ab2136698fe" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-420ef2ec-4603-4107-a9a4-5b14fb27ec95" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-621f3091-a6b6-410b-b715-fb61d91d1511" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-387526e2-fa1a-4d12-aa15-535ed244cdc5" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-0768d1fb-70e6-4e31-a083-8a1abdf1d8ff" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-70d965e8-f28f-4223-abd2-a7efb403e038" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-4d6850f0-483b-4f5f-b1da-f87a8510e9a6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-defb1821-8428-4ead-8c08-da365d237ab2" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-39c32255-bb13-468e-9cda-c5644b931cb4" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-dcc8004b-ab26-4582-b7dc-568acbb48a57" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fa468c98-b8b9-4145-8308-4b91a2c34c72" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-e61000b5-a2df-466d-9525-974b427fb7e9" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-ae0ee06f-a939-422e-bf3c-718872457362" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-6379656a-19e5-483b-ae0d-747726690807" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-3cb94b8d-da73-4624-ba1d-a2a9769cebd6" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-30f89283-873f-4407-b114-a2863cef5684" DEBUG kill chain phase w/ idref ○ "fireeye:ttp-fb6aa549-c94a-4e45-b4fd-7e32602dad85"

## TTPs

[toggle all TTPs]

Title | ID
--- | ---
Poison Ivy (PIVY) | fireeye:ttp-591f0cb7-d66f-4e14-a8e6-5927b597f920
EXPANDABLE CONTENT HERE
Spear Phishing | fireeye:ttp-7e7c8376-3bcb-4529-9bc3-08522d08106b
EXPANDABLE CONTENT HERE
Strategic Web Compromise | fireeye:ttp-36bdf9a7-ec1e-4963-be3b-6eeaa49a63a4
EXPANDABLE CONTENT HERE
PIVY Variant (140e728871eff241e0148363b2931b1d) | fireeye:ttp-2ee01cb3-e9fa-46f9-8ec5-ffc9cb0b59f1
EXPANDABLE CONTENT HERE
PIVY Variant (767d04f72f5941326f11f8927cf3697b) | fireeye:ttp-33cc429f-7974-49a9-ab2e-6ebc3c37d62b
EXPANDABLE CONTENT HERE
PIVY Variant (03e0271d12a24050da632675b14091c1) | fireeye:ttp-fa0ffc72-0f73-4b08-84a5-6ea62b46828b
EXPANDABLE CONTENT HERE
PIVY Variant (87133a339492ecb5142a93c7bbfd3805) | fireeye:ttp-f0bfc691-7945-47d9-95c7-a0219b8a5c67
EXPANDABLE CONTENT HERE
PIVY Variant (707a4493775fd9c959861dcf04f18283) | fireeye:ttp-dfb4e482-2b04-4365-973e-1feb5a567263
EXPANDABLE CONTENT HERE
Victim Targeting: admin338 | fireeye:ttp-030d3edf-da7c-4d1f-a0b9-6c38a8af73db
EXPANDABLE CONTENT HERE
Spear Phishing Attack Pattern as practiced by admin338 | fireeye:ttp-19da6e1c-69a8-4c2f-886d-d620d09d3b5a
EXPANDABLE CONTENT HERE
PIVY Variant (e765c69b11860c4f1b84276278991253) | fireeye:ttp-dff22c1b-26f9-4fbd-8b42-8b8507c684fd
EXPANDABLE CONTENT HERE
PIVY Variant (e74d62dfdc308df3038e61dfc4e4256) | fireeye:ttp-e55c6eaa-bf0f-4b6b-9572-5cd0d3f62134
EXPANDABLE CONTENT HERE
PIVY Variant (8087d49e7bb391e0ba6e482f931b0ad5) | fireeye:ttp-23a87226-706a-430e-96cd-d7f2c99b7b29
EXPANDABLE CONTENT HERE
PIVY Variant (0a43013eef1c2ffba36e3c29512c89a2) | fireeye:ttp-aaba08c5-e50d-49a1-a54a-cfdf1a68ff51
EXPANDABLE CONTENT HERE
PIVY Variant (808e21d6efa2884811fbd0adf67fda78) | fireeye:ttp-61a62a6a-9a18-4758-8e52-622431c4b8ae
EXPANDABLE CONTENT HERE
PIVY Variant (bc90b4593b7b631a78a8305a873d6d5c) | fireeye:ttp-5b2a2542-47fe-40f9-8915-4bf7c7397810
EXPANDABLE CONTENT HERE
PIVY Variant (be6e72ad1b1ed2685a23dfe1b36f03cc) | fireeye:ttp-35322f13-94bd-4b97-abb6-2a9adc24b8d8
EXPANDABLE CONTENT HERE
PIVY Variant (5032ff32a41748bdb40df0fd581cd669) | fireeye:ttp-80cd5722-40ff-4938-aba5-991bd8da2b39
EXPANDABLE CONTENT HERE
PIVY Variant (0323de551aa10ca6221368c4a73732e6) | fireeye:ttp-c221ae40-f998-4fa9-ba46-9be04e163371
EXPANDABLE CONTENT HERE
PIVY Variant (4713557e3ed2ced62ceccbe4d07314b4) | fireeye:ttp-9717d5a3-773c-490d-b90f-718602fb3c43
EXPANDABLE CONTENT HERE
PIVY Variant (0678645e45fcd3da84ab27122d6775a9) | fireeye:ttp-2c346548-2150-47f1-91c4-a78fa404be12
EXPANDABLE CONTENT HERE
PIVY Variant (3c9a177a39e09e9a4ec4f09c029f5cb2) | fireeye:ttp-8c1057bd-4a8a-4632-b0d4-b72ebd7936d3
EXPANDABLE CONTENT HERE
PIVY Variant (51d9e2993d203bd43a502a2b1e1193da) | fireeye:ttp-2e160c21-83d0-4d09-a833-c85327e49b46
EXPANDABLE CONTENT HERE
PIVY Variant (c977d6e9c7844a1c8d6db1b6a9aba497) | fireeye:ttp-7bac9c8b-c19a-4ce6-9337-4750d68f05cc
EXPANDABLE CONTENT HERE
PIVY Variant (02ac495eb31a2405fce287565b590a1f) | fireeye:ttp-30fb07e5-fe94-480e-9c15-8d494500cf17
EXPANDABLE CONTENT HERE
PIVY Variant (1f43738b1f67266fdafd73235acbf338) | fireeye:ttp-b8d4945a-5fc1-4ceb-a2c4-af17def8b396
EXPANDABLE CONTENT HERE
PIVY Variant (8010cae3e8431bb11ed6dc9acabb93b7) | fireeye:ttp-30ea087f-7d2b-496b-9ed1-5f000c8b7695
EXPANDABLE CONTENT HERE
PIVY Variant (ce8112de474c22c1407ce94245c2d1de) | fireeye:ttp-7b284c94-9598-4e6f-944e-188bbb36716d
EXPANDABLE CONTENT HERE
PIVY Variant (026871ea3d6cbbeb90fea6bf2906cc12) | fireeye:ttp-f1a0e293-d490-4e89-9fbb-384188076f60
EXPANDABLE CONTENT HERE
PIVY Variant (db815161022fcecf282b40745f72d9fc) | fireeye:ttp-707ad4a8-e037-466c-9f59-ac935f53e606
EXPANDABLE CONTENT HERE
PIVY Variant (6cf2f645395fbb64bbc14fb8993e2eea) | fireeye:ttp-b1da97a0-e8e7-44d7-8faf-8907589d8465
EXPANDABLE CONTENT HERE
PIVY Variant (4ffcd711fcfe28d3a6dcac244c552efb) | fireeye:ttp-a3f90728-8a0c-453b-9101-27515bd01d51
EXPANDABLE CONTENT HERE
PIVY Variant (a5232ea8745e2d7f7740d1d222e2364f) | fireeye:ttp-f4478b80-3dd3-473d-878a-80a6a82a00a9
EXPANDABLE CONTENT HERE
PIVY Variant (ef90df225101836952ad7e91b55b30cd) | fireeye:ttp-cc3533bd-a1e5-411c-9cfe-3660dd07e8e3
EXPANDABLE CONTENT HERE
PIVY Variant (070d1e5c9299afa47df25e63572a3ae8) | fireeye:ttp-c31b9c7e-3eda-4a93-aabc-e5a01d1e8577
EXPANDABLE CONTENT HERE
PIVY Variant (6e99585c3fbd4f3a55bd8f604cb35f38) | fireeye:ttp-e5b7be4b-c7ca-40b8-b9f3-e686bb9c3c0d
EXPANDABLE CONTENT HERE
PIVY Variant (8d36fd85d9c7d1f4bb170a28cc23498a) | fireeye:ttp-cc00cffe-36b3-40ad-a69c-26427af29935
EXPANDABLE CONTENT HERE
PIVY Variant (330ddac1f605ff8abf60880c584ed797) | fireeye:ttp-ca7cd0ef-48cf-4cf1-9ad8-aed3f83ffdc7
EXPANDABLE CONTENT HERE
PIVY Variant (37f70717f549f1938e5785527e56978d) | fireeye:ttp-4703ede5-2184-4f06-a6d0-0144faca4662
EXPANDABLE CONTENT HERE
Victim Targeting: th3bug | fireeye:ttp-aedd016d-12c0-4d6e-902e-9a1cefd3e7e6
EXPANDABLE CONTENT HERE
Strategic Web Compromise Attack Pattern as practiced by th3bug | fireeye:ttp-ea2c747d-4aa3-4573-8853-37b7159bc180
EXPANDABLE CONTENT HERE
PIVY Variant (da931466e4ef41fe7855e33ae4d79daf) | fireeye:ttp-34a3d511-e213-40d5-a932-fc4d836d455e
EXPANDABLE CONTENT HERE
PIVY Variant (70d227a8c4bf293ab85b79d15b9139ce) | fireeye:ttp-dcce72e4-fdb6-43af-8eb6-bd474a11ad4c
EXPANDABLE CONTENT HERE
PIVY Variant (418747bc75e1b4db9fbe13981b38db63) | fireeye:ttp-2821af3c-0f2b-45b4-92f5-465ca7a51920
EXPANDABLE CONTENT HERE
PIVY Variant (98256615dada111549761a4c00e9fbd4) | fireeye:ttp-862fd6e1-1711-4b70-8bec-1591f4baabc1
EXPANDABLE CONTENT HERE
PIVY Variant (766837eae6eaaf24b965634256ca8f72) | fireeye:ttp-2e20839b-3ced-4bd7-868d-9cfae43eb84f
EXPANDABLE CONTENT HERE
PIVY Variant (b174490ddedb3e21e5c1d6fc2e00d2b4) | fireeye:ttp-15f9dece-0c7c-4579-a1f9-61dca12b2e34
EXPANDABLE CONTENT HERE
PIVY Variant (a3d593e958c1f3ec1adb027168a83ae2) | fireeye:ttp-dc5135f2-8d89-4993-a083-4fee4debdfb6
EXPANDABLE CONTENT HERE
PIVY Variant (0e86c994f2af7e6689a2964f493c6752) | fireeye:ttp-7b8662e4-286e-4862-8b00-79bd3750e3a5
EXPANDABLE CONTENT HERE
PIVY Variant (55a3b2656ceac2ba6257b6e39f4a5b5a) | fireeye:ttp-f86febd3-609b-4d2e-9fec-aa805cb498bf
EXPANDABLE CONTENT HERE
PIVY Variant (8002debc47e04d534b45f7bb7dfcab4d) | fireeye:ttp-ddc66992-4a1a-470d-bfae-694e740ce181
EXPANDABLE CONTENT HERE
PIVY Variant (5ba90fa19a14981f9c13a0046807e757) | fireeye:ttp-2787ecb2-9abe-4141-a61a-e4a04c02126f
EXPANDABLE CONTENT HERE
PIVY Variant (0eeaf7bf1d3663cc43b5a545f8863a7a) | fireeye:ttp-ea91fe28-a94a-4511-a31e-a78eb7fcf9bd
EXPANDABLE CONTENT HERE
PIVY Variant (f6ae04677428c54c80caf84f25488403) | fireeye:ttp-027acc14-5136-478c-a9ff-24d7a8288014
EXPANDABLE CONTENT HERE
PIVY Variant (9535f777553b8f20db9b99f90bdf5a9a) | fireeye:ttp-08596787-5427-4220-8971-f56ca5aabf2b
EXPANDABLE CONTENT HERE
PIVY Variant (a5a672d5573f01ae3457bb22107be93f) | fireeye:ttp-ceb035a7-096c-4d8a-bb4c-8fdf2fb93cad
EXPANDABLE CONTENT HERE
PIVY Variant (27cd0af60f08b0270e1ec1a50a7ba90a) | fireeye:ttp-03fcd8c2-a5ee-46f3-b32e-0f0d655f1d92
EXPANDABLE CONTENT HERE
PIVY Variant (5d7060f4d72b52f73d49a554a59df27a) | fireeye:ttp-b30eab7f-e848-4170-acce-a21b7ae45902
EXPANDABLE CONTENT HERE
PIVY Variant (0526c1bcdbedf7c354b059ff33f8c9ca) | fireeye:ttp-f34df5fa-b871-4102-9f33-431f7863d1c8
EXPANDABLE CONTENT HERE
PIVY Variant (95bcaebe0fb21cfc3b4218e1e1c4033e) | fireeye:ttp-c91715d4-e81f-4621-8d09-fec8c15d596f
EXPANDABLE CONTENT HERE
PIVY Variant (f7bb9fe955bf88e02992b86b7ee898e7) | fireeye:ttp-3db69389-6359-4b1d-9f36-956a4e4e65e3
EXPANDABLE CONTENT HERE
PIVY Variant (0eb56631aca651cf163b8c02d5d791de) | fireeye:ttp-767d4bfe-da1d-4567-a9e5-982c69d6be45
EXPANDABLE CONTENT HERE
PIVY Variant (41af5776bb2717a452510b7f63c54a00) | fireeye:ttp-b89b39d3-5079-43ba-8984-5992a607ebde
EXPANDABLE CONTENT HERE
Victim Targeting: menupass | fireeye:ttp-30f89283-873f-4407-b114-a2863cef5684
EXPANDABLE CONTENT HERE
Spear Phishing Attack Pattern as practiced by menupass | fireeye:ttp-fb6aa549-c94a-4e45-b4fd-7e32602dad85
EXPANDABLE CONTENT HERE
PIVY Variant (421b1220970488738b5f578999ecac0e) | fireeye:ttp-0fd8d950-207a-42cd-b153-041be31e48d5
EXPANDABLE CONTENT HERE
PIVY Variant (410eeaa18dbec01a27c5b41753b3c7ed) | fireeye:ttp-a19437ea-b8e3-4598-8423-5a73d88f17de
EXPANDABLE CONTENT HERE
PIVY Variant (3c341919b04d9b57f1be69cd6f21d2d4) | fireeye:ttp-2f5b0d2f-3a05-4b11-8d60-2244db7ba7d6
EXPANDABLE CONTENT HERE
PIVY Variant (45894da9ebcfd132c29acb6411af8af6) | fireeye:ttp-78837766-44ae-4dc7-9fc1-a897d29f0d88
EXPANDABLE CONTENT HERE
PIVY Variant (d5889a7223b9d13b60ab08aafe3344ad) | fireeye:ttp-2fd26025-1453-4df7-a594-4ba6f7cf54d9
EXPANDABLE CONTENT HERE
PIVY Variant (c1bcc9513f27c33d24f7ed0fc5700b47) | fireeye:ttp-5a74a069-0759-4c93-8ea3-70c53a223230
EXPANDABLE CONTENT HERE
PIVY Variant (1d4e74574bd8fde793d85cbe59f8a288) | fireeye:ttp-d9bd9ffd-3e6f-453d-80f1-c2205c46dc78
EXPANDABLE CONTENT HERE
PIVY Variant (3ae7ea7511c0df60997d2c32252758c1) | fireeye:ttp-54b02531-48bb-4ff5-ba37-f511908aa858
EXPANDABLE CONTENT HERE
PIVY Variant (72f9d92c2ee99ad79d956c9d3a1a0989) | fireeye:ttp-c6bc27e1-5ea8-4047-9a56-4be846f4b97d
EXPANDABLE CONTENT HERE
PIVY Variant (4e78ae59302bbfe440ec25cc104a7a53) | fireeye:ttp-0be8fa38-6ca3-4f87-bf47-44e5bbf6550b
EXPANDABLE CONTENT HERE
PIVY Variant (6bead751a0f6056008d5d200dea0d88b) | fireeye:ttp-ec1d7f53-2b04-4371-a04d-65f866f39244
EXPANDABLE CONTENT HERE
PIVY Variant (494e65cf21ad559fccf3dacdd69acc94) | fireeye:ttp-cf1d3250-57c1-4f91-90d6-b08b9073ca5f
EXPANDABLE CONTENT HERE
PIVY Variant (459ee0adaad4d493830e655eb4d686f7) | fireeye:ttp-9c892e1c-77e4-4ed2-a71b-9e6116a44435
EXPANDABLE CONTENT HERE
PIVY Variant (46f5de8e9e165d34e622bbf2cf61942b) | fireeye:ttp-63c1deff-2e5f-4493-86e9-a4bdcca01878
EXPANDABLE CONTENT HERE
PIVY Variant (6d989302166ba1709d66f90066c2fd59) | fireeye:ttp-773eea2a-193c-4c85-9521-65f8f9042140
EXPANDABLE CONTENT HERE
PIVY Variant (4ac3e877e1f30d2a1aa9639ac0707307) | fireeye:ttp-903a54fe-e116-4d73-9320-23609d13d8b0
EXPANDABLE CONTENT HERE
PIVY Variant (6ff16afc92ce09acd2e3890b780efd86) | fireeye:ttp-4d95e1e8-bdf5-4c10-81dd-9b86ab7da45d
EXPANDABLE CONTENT HERE
PIVY Variant (4ad286a97c82f91df3e07b101a224f5) | fireeye:ttp-cb1f97b1-2919-4535-bfae-ceb396c52f44
EXPANDABLE CONTENT HERE
PIVY Variant (4bc6cab128f623f34bb97194da21d7b6) | fireeye:ttp-4ffee86a-b160-4a21-8b73-39c27fe6bf28
EXPANDABLE CONTENT HERE
PIVY Variant (54dcae2d9d420d6d21d4d605ed798332) | fireeye:ttp-46a77043-53d1-4259-8121-9dbad4a8828f
EXPANDABLE CONTENT HERE
PIVY Variant (19361c808d262d89437bd56072c9a297) | fireeye:ttp-d129c652-a93c-4f2c-9d7a-feb621c0f499
EXPANDABLE CONTENT HERE
PIVY Variant (52a58fc5e8aeb2e87215649f66210ed8) | fireeye:ttp-07fed79f-6a17-4bf9-a2ed-e6f9877d646a
EXPANDABLE CONTENT HERE
PIVY Variant (7aa047cd6dac1d0a4fbc6d968c1b6407) | fireeye:ttp-5b971b83-f177-46d4-98ff-d2ffaac3f29e
EXPANDABLE CONTENT HERE
PIVY Variant (d9af0e6501c7a375e6276709da4572d8) | fireeye:ttp-895af3d5-5700-475e-bb0b-54d29ec2be8e
EXPANDABLE CONTENT HERE
PIVY Variant (a5965b750997dbecec61358d41ac93c7) | fireeye:ttp-e3cec144-e901-4acf-9f10-1008a51b1cb9
EXPANDABLE CONTENT HERE
PIVY Variant (a4754be7b34ed55faff832edadac61f6) | fireeye:ttp-25f6285e-0bd7-404b-8dd4-2b903369d38c
EXPANDABLE CONTENT HERE
PIVY Variant (65887898252f7e192709a33be268ea41) | fireeye:ttp-0ac3576b-6347-483d-a04b-2c4fc2c9084d
EXPANDABLE CONTENT HERE
PIVY Variant (7b6b8c695270845aae457dd26cd647a0) | fireeye:ttp-1bbfa9a4-3be6-4597-83cb-1d70b26cd020
EXPANDABLE CONTENT HERE
PIVY Variant (7e3c3eec58cbb6c4bcc4d59a549f7678) | fireeye:ttp-b7ad5451-75ab-4e97-b92c-f72192b9cc87
EXPANDABLE CONTENT HERE
PIVY Variant (85af7819c3cd96895d543570b75b202f) | fireeye:ttp-641e9792-74f7-4b5a-823e-0b85e48d0f3b
EXPANDABLE CONTENT HERE
PIVY Variant (54fcf43e6f7641eeacdf1fd12a740c7c) | fireeye:ttp-b8ad4295-4554-42ad-a3f9-09d06856c666
EXPANDABLE CONTENT HERE
PIVY Variant (4e84b1448cf96fabe88c623b222057c4) | fireeye:ttp-4406c7c7-6c58-478d-aacc-0334929ebdde
EXPANDABLE CONTENT HERE
PIVY Variant (76b744382cdc455f8b20542de34493d2) | fireeye:ttp-4ea4a3cb-7e52-496c-935a-a57e41e0674e
EXPANDABLE CONTENT HERE
PIVY Variant (5415be1e85fd3b56fe7a6f57ec3cef43) | fireeye:ttp-a5ae084e-1ea1-4be3-9ffe-dee4f0993dcf
EXPANDABLE CONTENT HERE
PIVY Variant (5281dcb76c34b8ae45c3f03f883a08db) | fireeye:ttp-7b12666f-f332-438d-acff-73493ba82399
EXPANDABLE CONTENT HERE
PIVY Variant (82f926009c06dfa452714608da21cb77) | fireeye:ttp-3ae1dd84-5bd4-44c4-9200-7aab41d9973f
EXPANDABLE CONTENT HERE
PIVY Variant (090a6a5da51aa84413e42b2c00e4521f) | fireeye:ttp-48311f55-2f8d-4d00-87f9-b39cb338f72f
EXPANDABLE CONTENT HERE
PIVY Variant (f39c796e229a65a3ef23c3885471d1df) | fireeye:ttp-05f3d767-ff79-41aa-a591-e88d0cb65f66
EXPANDABLE CONTENT HERE
PIVY Variant (e84853c0484b02b7518dd683787d04fc) | fireeye:ttp-de8f548e-d2cf-4442-886a-814ef174e56b
EXPANDABLE CONTENT HERE
PIVY Variant (9aab46ed60be9f0356f4b6e39191ae5d) | fireeye:ttp-6bb608dc-9a2e-4e19-9975-01734a625b12
EXPANDABLE CONTENT HERE
PIVY Variant (ea5580bc00700eab50b99203e64ec0c5) | fireeye:ttp-8baac074-74b8-4a03-ac83-90618f338ce8
EXPANDABLE CONTENT HERE
PIVY Variant (0a265f04b44c1177eaa96817b0b70c0f) | fireeye:ttp-0eb3ffa1-654d-414d-ada0-ef210cc55d90
EXPANDABLE CONTENT HERE
PIVY Variant (55c0b07de69a0cee01101d0d6f66ca3e) | fireeye:ttp-ed7733f2-eaf6-4880-b6b8-b96061717d5a
EXPANDABLE CONTENT HERE
PIVY Variant (5ac4f52d56009c18e9156ae5ea0d2016) | fireeye:ttp-14fba9df-d3c2-4c80-a391-99d87a0707da
EXPANDABLE CONTENT HERE
PIVY Variant (0fe91d41d2b361f6a88b51a6ed880d23) | fireeye:ttp-4a38cbbf-51f7-42a0-98f5-a9bbc597dad0
EXPANDABLE CONTENT HERE
PIVY Variant (86328b05ffaf47ae90de61689a3536c4) | fireeye:ttp-7ace7258-bfff-4c5b-bae4-6583a164abf4
EXPANDABLE CONTENT HERE
PIVY Variant (39a59411e7b12236c0b4351168fb47ce) | fireeye:ttp-3f1515b4-a171-48b2-8074-6599c784ed85
EXPANDABLE CONTENT HERE
PIVY Variant (56cff0d0e0ce486aa0b9e4bc0bf2a141) | fireeye:ttp-91b36537-bd12-457c-9a12-bd94956e0dec
EXPANDABLE CONTENT HERE
PIVY Variant (105c80e404324938eae633934ee44ed1) | fireeye:ttp-e3058c9e-4adb-41ae-8352-5317c1be98ee
EXPANDABLE CONTENT HERE
PIVY Variant (8a2205deb22c6ad61f007d52dc220351) | fireeye:ttp-7e310f39-a851-4fcd-b687-d3565ffe6a57
EXPANDABLE CONTENT HERE
PIVY Variant (ed179f1f90765963a0b363bedbe674f6) | fireeye:ttp-4aa71750-c8f3-4998-b4ed-f67d903dcff9
EXPANDABLE CONTENT HERE
PIVY Variant (018509c1165817d4b0a3e728eab41ea0) | fireeye:ttp-5e8dfa9c-8940-46d5-90d9-d2f50bbf9902
EXPANDABLE CONTENT HERE
PIVY Variant (fc384c3d0bf74258c1b8d05c29afb927) | fireeye:ttp-8214e79e-891a-4d4a-b6d7-26cbd145f63c
EXPANDABLE CONTENT HERE
PIVY Variant (5c00b5d04c31b1b85382ff1eecff6084) | fireeye:ttp-daeb0891-b153-41d4-b18b-367a5492133a
EXPANDABLE CONTENT HERE
PIVY Variant (9a014c33f9a9958ffbcf99d2a71d52fe) | fireeye:ttp-260d101a-dddc-4a84-9379-4b48418a3365
EXPANDABLE CONTENT HERE
PIVY Variant (e06cb5f8ed24903ab9f42816cb0c2922) | fireeye:ttp-8e4f6736-10de-4a15-934e-1367072428f4
EXPANDABLE CONTENT HERE
PIVY Variant (e3ff26beb4334899014cd941816c3180) | fireeye:ttp-2e6b7c86-9afd-4412-ac24-e43f08ec7d2e
EXPANDABLE CONTENT HERE
PIVY Variant (a5ec5a677346634a42c9f9101ce9d861) | fireeye:ttp-3f39dad8-de02-468d-bd4b-de7ad4a4e357
EXPANDABLE CONTENT HERE
PIVY Variant (5b668982bcf868629f1e31bdcda21b05) | fireeye:ttp-27a595d0-b2b4-414a-899d-9e87893ac858
EXPANDABLE CONTENT HERE
PIVY Variant (f5315fb4a654087d30c69c768d80f826) | fireeye:ttp-8c857eb3-0576-494d-844f-7d911e50d49a
EXPANDABLE CONTENT HERE
PIVY Variant (fde24cf3e9dc626b3a6f4481f74de699) | fireeye:ttp-5032acb9-c978-476a-953a-5d8ebd034d10
EXPANDABLE CONTENT HERE
PIVY Variant (046f51fb62d01957497a349be2bb555f) | fireeye:ttp-1f02f735-3aa2-41aa-a2f1-c82f4cfe1f58
EXPANDABLE CONTENT HERE
PIVY Variant (9e161fad98a678fa957d8cda2a608cb0) | fireeye:ttp-e49c5caa-16d1-473b-9e47-c43537c90ced
EXPANDABLE CONTENT HERE
PIVY Variant (8ca16b82d57cf6898a55e9fcdb400769) | fireeye:ttp-fa89f3e2-7988-43d6-974a-ca8ff1084358
EXPANDABLE CONTENT HERE
PIVY Variant (5f0bb4d702ed341cf4c3185d4c141110) | fireeye:ttp-16db0c0e-8af6-4a5a-98c4-ae022d88295b
EXPANDABLE CONTENT HERE
PIVY Variant (08709f35581e0958d1ca4e50b7d86dba) | fireeye:ttp-a0f63787-a087-4261-a795-61fb2dae58da
EXPANDABLE CONTENT HERE
PIVY Variant (8e94701b572fb446c2794cdd3c18ecd9) | fireeye:ttp-fb17d950-6fb0-4483-adc8-fe084cbc9586
EXPANDABLE CONTENT HERE
PIVY Variant (5c5401fd7d32f481570511c73083e9a1) | fireeye:ttp-e2830a97-b3ef-4c07-8088-75fc624e296d
EXPANDABLE CONTENT HERE
PIVY Variant (a144440d16fb69cf4522f789aacb3ef2) | fireeye:ttp-534b451e-a5ee-4264-89a0-b57cd2d9a21d
EXPANDABLE CONTENT HERE
PIVY Variant (00beeeef9dfe8ddf5f8d539504777e7e) | fireeye:ttp-a14c6a5e-9fc0-455a-b4bb-f5e9c4fe4ff6
EXPANDABLE CONTENT HERE
PIVY Variant (d8c00fed6625e5f8d0b8188a5caac115) | fireeye:ttp-3ed0364f-62c8-4ebc-b136-deaf6966880b
EXPANDABLE CONTENT HERE
PIVY Variant (60963553335fa5877bd5f9be9d8b23a6) | fireeye:ttp-8e939441-036c-4a34-a80d-751a0395ae8e
EXPANDABLE CONTENT HERE
PIVY Variant (b18505ee9e2cecc69035acc912114768) | fireeye:ttp-6e229c21-7b2f-405c-9cf0-1a9aa218ddaf
EXPANDABLE CONTENT HERE
PIVY Variant (625a4f618d14991cd9bd595bdd590570) | fireeye:ttp-27cf110c-281e-4f93-94aa-cbd34c7efae4
EXPANDABLE CONTENT HERE
PIVY Variant (18ccf0e2709406c4a0b3635064ca32dc) | fireeye:ttp-f8a934bd-1570-4b45-927f-1e3af4cc8f45
EXPANDABLE CONTENT HERE
PIVY Variant (abf8e40d7c99e9b3f515ec0872fe099e) | fireeye:ttp-4d47bd96-8726-492b-ac8e-50cd4b50c8e8
EXPANDABLE CONTENT HERE
PIVY Variant (15d42116acb393ac4d323fb7606c8108) | fireeye:ttp-56736642-633e-4e2e-a823-484e4c037788
EXPANDABLE CONTENT HERE
PIVY Variant (b1deff736b6d12b8d98b485e20d318ea) | fireeye:ttp-17099f03-5ec8-456d-a2de-968aebaafc78
EXPANDABLE CONTENT HERE
PIVY Variant (e7a5a551f847c735487acede71f8a9d8) | fireeye:ttp-74efd1f5-2718-41e7-981d-7e3b9cb50d71
EXPANDABLE CONTENT HERE
PIVY Variant (dad0c02b91f656ffe1d4de3dbf344624) | fireeye:ttp-3321d61c-6bb1-426a-b853-52d8c3466532
EXPANDABLE CONTENT HERE
PIVY Variant (1b851bb23578033c79b8b15313b9c382) | fireeye:ttp-f2984dfd-131a-471a-a41f-cdd0fb432b92
EXPANDABLE CONTENT HERE
PIVY Variant (1ccb5a6dfec4261b32eee8d439f821df) | fireeye:ttp-2c4ea690-56bb-41f5-bd79-b6ea19aad2e4
EXPANDABLE CONTENT HERE
PIVY Variant (6005cbea84d281e03b53be49d1378885) | fireeye:ttp-ab8a2af8-9411-4415-8c16-4a19e5dfea7e
EXPANDABLE CONTENT HERE
PIVY Variant (377d8d30172f083b7a0cdff846681f81) | fireeye:ttp-2be46f2d-4e92-4201-ad83-85c47a69b98a
EXPANDABLE CONTENT HERE
PIVY Variant (36cc4c909462db0f067b11a5e719a4ee) | fireeye:ttp-7781ffbf-2a5c-4a54-a489-2fddd85b7363
EXPANDABLE CONTENT HERE
PIVY Variant (bf553932f6f418250a4dd81c63b3ccee) | fireeye:ttp-29acc82d-630c-461b-bb4e-ec99ab06b809
EXPANDABLE CONTENT HERE
PIVY Variant (cf8094c07c15aa394dddd4eca4aa8c8b) | fireeye:ttp-2b6638b2-9cc6-41bc-b883-aaf45f7a2947
EXPANDABLE CONTENT HERE
PIVY Variant (629049d376058a1f31ab2a36f3c0f234) | fireeye:ttp-c67fe311-d813-4bda-9b32-e19fbb0d1b0e
EXPANDABLE CONTENT HERE
PIVY Variant (e4242bbcc0aa91c40a50a8305d7a3433) | fireeye:ttp-fe844499-4819-463c-84dc-362638ea727e
EXPANDABLE CONTENT HERE
PIVY Variant (68fec995a13762184a2616bda86757f8) | fireeye:ttp-b0804b4d-4b1f-4e4a-a871-b1473e73a7c1
EXPANDABLE CONTENT HERE
PIVY Variant (3243a6caaeb7f175330f0fc7f789aced) | fireeye:ttp-33125ae7-0d34-4e97-ab8b-04c42ab60c3d
EXPANDABLE CONTENT HERE
PIVY Variant (36c6672abdfa7f8c1cf20d27277d7e1a) | fireeye:ttp-d1d15120-ea83-4634-9ed2-cd1f34d711f1
EXPANDABLE CONTENT HERE
PIVY Variant (cd6a0b076678165e04f8583d19a9a46f) | fireeye:ttp-65ab529f-7c86-423c-9d32-25e8152c0964
EXPANDABLE CONTENT HERE
PIVY Variant (1372fae7e279b29eb648d158ae022172) | fireeye:ttp-0db3ebb2-b880-4961-a4e5-98f8f4c60e57
EXPANDABLE CONTENT HERE
PIVY Variant (bb7ae118a83f3bed742dbbc50136dc50) | fireeye:ttp-74e0b32c-7f4b-4fa9-a82d-46ecfb1a059a
EXPANDABLE CONTENT HERE
PIVY Variant (6848da04f6c10d2cceae4831351cb291) | fireeye:ttp-cd721637-f104-4a6d-a79e-f74530287be0
EXPANDABLE CONTENT HERE
PIVY Variant (aa76e01067c064a8091391759a35ef0a) | fireeye:ttp-58404eca-36d7-4239-a890-630ba1d158f0
EXPANDABLE CONTENT HERE
PIVY Variant (11ea8d8dd0ffde8285f3c0049861a442) | fireeye:ttp-bb93ada5-b5f3-4174-bead-0faecdbe28ce
EXPANDABLE CONTENT HERE
PIVY Variant (e6ca06e9b000933567a8604300094a85) | fireeye:ttp-3d7d1585-9cf4-401b-b480-2aae6131d15f
EXPANDABLE CONTENT HERE
PIVY Variant (aa7368b928eaaff80e42c0d0637c4a61) | fireeye:ttp-1e89baef-ead0-47d0-8a71-52fbc46bc8db
EXPANDABLE CONTENT HERE
PIVY Variant (e62584c9cd15c3fa2b6ed0f3a34688ab) | fireeye:ttp-9849ea2a-fc17-4068-9c01-dab903ada13c
EXPANDABLE CONTENT HERE
PIVY Variant (c2f000577585ce59661b21a500eb253e) | fireeye:ttp-0d5fe336-cb01-47df-93a6-7c5de9b01a5a
EXPANDABLE CONTENT HERE
PIVY Variant (d84851ad131424f04fbffc3bbac03bff) | fireeye:ttp-d8e98488-2c1f-41a9-86c9-602d5a96cac1
EXPANDABLE CONTENT HERE
PIVY Variant (223d1396f2b5b7719702c980cbd1d6c0) | fireeye:ttp-0b2e2718-a421-4f9a-ad54-2ab2136698fe
EXPANDABLE CONTENT HERE
PIVY Variant (c2c7ceb8a428a36b80b9ce1037d209dd) | fireeye:ttp-420ef2ec-4603-4107-a9a4-5b14fb27ec95
EXPANDABLE CONTENT HERE
PIVY Variant (d6dba8166b7b1da0173a0165d3a3e0bf) | fireeye:ttp-621f3091-a6b6-410b-b715-fb61d91d1511
EXPANDABLE CONTENT HERE
PIVY Variant (20098465e8fd00f8a0845fff134ed844) | fireeye:ttp-387526e2-fa1a-4d12-aa15-535ed244cdc5
EXPANDABLE CONTENT HERE
PIVY Variant (d81dac704850c0ee051b8455510cc0a4) | fireeye:ttp-0768d1fb-70e6-4e31-a083-8a1abdf1d8ff
EXPANDABLE CONTENT HERE
PIVY Variant (c84a04eabb91e3dd2388d435527b6906) | fireeye:ttp-70d965e8-f28f-4223-abd2-a7efb403e038
EXPANDABLE CONTENT HERE
PIVY Variant (31f7e35e7a73a1d89b6269412a935996) | fireeye:ttp-4d6850f0-483b-4f5f-b1da-f87a8510e9a6
EXPANDABLE CONTENT HERE
PIVY Variant (cab408c59c3450fcc9ddb401eede170f) | fireeye:ttp-defb1821-8428-4ead-8c08-da365d237ab2
EXPANDABLE CONTENT HERE
PIVY Variant (b5695df9da14b8c9db7e607942d01fac) | fireeye:ttp-39c32255-bb13-468e-9cda-c5644b931cb4
EXPANDABLE CONTENT HERE
PIVY Variant (c3171961e78d3acdb4cd299c643ba482) | fireeye:ttp-dcc8004b-ab26-4582-b7dc-568acbb48a57
EXPANDABLE CONTENT HERE
PIVY Variant (2a113b26b0133f67ed900a06a330683d) | fireeye:ttp-fa468c98-b8b9-4145-8308-4b91a2c34c72
EXPANDABLE CONTENT HERE
PIVY Variant (b2dc98caa647e64a2a8105c298218462) | fireeye:ttp-e61000b5-a2df-466d-9525-974b427fb7e9
EXPANDABLE CONTENT HERE
PIVY Variant (f815281ed4b16169e0b474dbac612bbc) | fireeye:ttp-ae0ee06f-a939-422e-bf3c-718872457362
EXPANDABLE CONTENT HERE
PIVY Variant (e9622f4b9d2a82c296a773a2c6e63fcb) | fireeye:ttp-6379656a-19e5-483b-ae0d-747726690807
EXPANDABLE CONTENT HERE
PIVY Variant (b08694e14a9b966d8033b42b58ab727d) | fireeye:ttp-3cb94b8d-da73-4624-ba1d-a2a9769cebd6
EXPANDABLE CONTENT HERE
PIVY Variant (1000371d10154fcfd94028ad66285519) | fireeye:ttp-7e39361b-cd37-450a-ab88-f934a103ff72
EXPANDABLE CONTENT HERE
PIVY Variant (2173b43a66070aadf052ab66dd6933ce) | fireeye:ttp-585b2299-7a01-48ee-89f9-7f966b2f641c
EXPANDABLE CONTENT HERE
PIVY Variant (2ffe59a6a047b2333a1f3eb58753f3bc) | fireeye:ttp-fb6cb6fa-d4c4-4f4a-87e3-c3b7ae4d4a3c
EXPANDABLE CONTENT HERE
PIVY Variant (441d239744d05b861202e3e25a2af0cd) | fireeye:ttp-76b27221-959b-4471-8c9a-2af95655816c
EXPANDABLE CONTENT HERE
PIVY Variant (4ab9bcbec67cafda3a1e4bf6d2d60de9) | fireeye:ttp-b7610226-c87a-465e-bff9-c3656f423416
EXPANDABLE CONTENT HERE
PIVY Variant (6fbd221f328ced713025ffcf589dba9a) | fireeye:ttp-1ca1bdde-4f34-4a35-a215-71007c060ba4
EXPANDABLE CONTENT HERE
PIVY Variant (7d551d1cba1aa7696ab5a787e93b4c83) | fireeye:ttp-85bf512d-c12b-40f4-b0b6-793f71cb1e07
EXPANDABLE CONTENT HERE
PIVY Variant (841ec2dec944964fc54786a1167713ff) | fireeye:ttp-7e16ec98-a87f-403d-a546-a0deb9fa4b81
EXPANDABLE CONTENT HERE
PIVY Variant (85321dee31100bd3ece5b586ac3e6557) | fireeye:ttp-45c33198-370c-4cf6-99e0-9cea66f237fa
EXPANDABLE CONTENT HERE
PIVY Variant (9de349e581b66bd410cf7a737d0db1e1) | fireeye:ttp-3b83b772-fcba-46e4-9a52-cd4678c68b83
EXPANDABLE CONTENT HERE
PIVY Variant (9e2af3377f508c22a3e96e1110ad5f12) | fireeye:ttp-632ea185-c226-44e7-858a-05aac2d0c3bf
EXPANDABLE CONTENT HERE
PIVY Variant (a4d13be7f6b8f66c80731b75d7d5aff8) | fireeye:ttp-70d7f498-93a8-4a33-b6a0-028f5ef6ab36
EXPANDABLE CONTENT HERE
PIVY Variant (b9ddbb07c4bde0d4f8e6b2065a7d8848) | fireeye:ttp-4d0aeaec-d073-4615-90b3-a9e717025db9
EXPANDABLE CONTENT HERE
PIVY Variant (cab66da82594ff5266ac8dd89e3d1539) | fireeye:ttp-435adcbb-7a46-4255-a581-f9f8cf39644b
EXPANDABLE CONTENT HERE
PIVY Variant (e5e3fd8a9ee0a5b8e66c11ce1e081067) | fireeye:ttp-4fe1269e-7360-471e-9788-d13af3dc77ef
EXPANDABLE CONTENT HERE
PIVY Variant (f0ee1f777d1c6a009c37cbcbf81f3a5a) | fireeye:ttp-7323cc18-c4b2-4e25-8a5e-3caa4afa3081
EXPANDABLE CONTENT HERE
PIVY Variant (f18c7639dbb8644c4bca179243ee2a99) | fireeye:ttp-bf2bdcaf-61a0-4e90-bcce-ad0b0551a02e
EXPANDABLE CONTENT HERE
PIVY Variant (4ad286a97c82f91df3e07b101a224f56) | fireeye:ttp-e51f43fe-37eb-4469-a666-a4c74708c9ed
EXPANDABLE CONTENT HERE
PIVY Variant (88fd19e48625e623a4d6abb5d5b78445) | fireeye:ttp-f9e0c47b-a923-4ea6-805e-bd7dcdefeb26
EXPANDABLE CONTENT HERE
PIVY Variant (d05f81cd8d079b862b2ce7d241ad2209) | fireeye:ttp-59fae6a2-4a3b-418e-8ca7-06a845820666
EXPANDABLE CONTENT HERE

## Courses of Action

[toggle all Courses of Action]

Type | ID
--- | ---
Other | fireeye:courseofaction-70b3d5f6-374b-4488-8688-729b6eedac5b
EXPANDABLE CONTENT HERE

## Campaigns

[toggle all Campaigns]

Type | ID
--- | ---
Other | fireeye:campaign-700c8b90-fd16-40e9-8b80-00b0c8bc84ee
EXPANDABLE CONTENT HERE
Other | fireeye:campaign-752c225d-d6f6-4456-9130-d9580fd4007b
EXPANDABLE CONTENT HERE
Other | fireeye:campaign-36082810-2226-4c00-88dc-d69f92efa60e
EXPANDABLE CONTENT HERE
Other | fireeye:campaign-4ce0b014-1313-4089-a2e6-ba0a37d934f8
EXPANDABLE CONTENT HERE
Other | fireeye:campaign-d02a1560-ff69-49f4-ac34-919b8aa4b91e
EXPANDABLE CONTENT HERE
Other | fireeye:campaign-157fd308-1677-46f5-a4b2-66cc24d801d7
EXPANDABLE CONTENT HERE
Other | fireeye:campaign-721976f9-56d7-4749-8c69-b3ac7c315f05
EXPANDABLE CONTENT HERE

## Threat Actors

[toggle all Threat Actors]

Type | ID
--- | ---
[ThreatActor, no Title] | fireeye:threatactor-7b14e202-bd27-4885-b8d7-b908a9651a03
EXPANDABLE CONTENT HERE
[ThreatActor, no Title] | fireeye:threatactor-9b371afe-ddfd-4954-abaf-8abb357ac78e
EXPANDABLE CONTENT HERE
[ThreatActor, no Title] | fireeye:threatactor-12b54231-a99d-431e-9587-34b4cb447e98
EXPANDABLE CONTENT HERE
[ThreatActor, no Title] | fireeye:threatactor-3cc07211-163e-4d26-8c5c-2d0998b60d4f
EXPANDABLE CONTENT HERE
[ThreatActor, no Title] | fireeye:threatactor-fb580b4d-b36d-415c-b711-d9997955f5c1
EXPANDABLE CONTENT HERE
[ThreatActor, no Title] | fireeye:threatactor-c5f80025-d518-470e-977d-e99d50ea21e8
EXPANDABLE CONTENT HERE
[ThreatActor, no Title] | fireeye:threatactor-0d059e61-df46-46e4-9fe3-fb10dfd1751c
EXPANDABLE CONTENT HERE

© Generic Company