{
  "Event": {
    "analysis": "2",
    "date": "2021-07-02",
    "extends_uuid": "",
    "info": "IndigoZebra APT continues to attack Central Asia with evolving tools",
    "publish_timestamp": "1625229678",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1625229668",
    "uuid": "d8c0c469-2d3e-437a-80a1-a38bfe5998e8",
    "Orgc": {
      "name": "CUDESO",
      "uuid": "56c42374-fdb8-4544-a218-41ffc0a8ab16"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "BoxCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226473",
        "to_ids": true,
        "type": "md5",
        "uuid": "a404dd9f-8b13-46b6-88b8-7583aa3648a7",
        "value": "b9973b6f9f15e6b20ba1c923540a3c9b"
      },
      {
        "category": "Payload delivery",
        "comment": "BoxCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226473",
        "to_ids": true,
        "type": "md5",
        "uuid": "45242739-8b9e-4324-ae19-c460ad58b009",
        "value": "974201f7895967bff0b018b95d5f5f4b"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "4df26904-ed9c-4aa8-be31-aa8d67969be7",
        "value": "3ecfc67294923acdf6bd018a73f6c590"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "9114de34-6760-40d4-ab03-0b0e417e605f",
        "value": "35caae29c47dfb570773f6d5fd37e625"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "9d505926-3729-4a7d-bf3e-1d96d44d1472",
        "value": "3562bf97997c54d74f58d4c1ad84fcea"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "6549429f-d8da-4206-900f-fd1b3a5d5b12",
        "value": "c00f6268075e3af85176bf0b00c66c13"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "2d189ef0-065e-4f08-8631-33f68cd029b0",
        "value": "85ea346e74c120c83db7a89531f9d9a1"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "c27b46c5-e4da-4dce-8013-72114d15ae36",
        "value": "5a8783783472be67c09926cc139d5b27"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "a43ae0ad-6ef5-4b52-973c-7d6c7543eaee",
        "value": "b3d11e570da4a66f4b8520bc6107283b"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "c813e5ca-7d43-4ea6-9533-7e2429a8c89d",
        "value": "fdcae752f64245c159ab0f4d585c5bf8"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "a4d1c859-0cef-45c8-99ba-344d17a2e679",
        "value": "bb521918d08a4480699e673554d7072c"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "1ccd72e4-312d-475e-90cf-95041a2475f6",
        "value": "c5406e7e161c758e863eb63001861bb1"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "c756711a-f597-42fb-9f91-5d29fb4d1f16",
        "value": "4d6e93d2416898ea3a4f419aa3a438e3"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "b78e1ccf-1c18-4086-b98e-553aea2f3cd2",
        "value": "6dfd06f91060e421320b6ebd63c957f0"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "b5741f08-3382-4999-a3bc-5e704f757780",
        "value": "0b10ac9bf6d2d31cbce06b09f9b0ae75"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "b85b6f39-1b99-462d-94e8-54dc8e975a99",
        "value": "b831a48e96e2f033d09d7ad5edd1dc67"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "9aaa5dc4-6bae-47de-b861-1cd6b2d52a97",
        "value": "a875112c66da104c35d0eb43385d7094"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "d5865e29-9510-4d82-9334-0b22122de313",
        "value": "1a28c673b2b481ba53e31f77a27669e7"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "ad5e6db5-be1b-43e2-b980-c8e1d0a98f52",
        "value": "ef3383809fdf5a895b42e02bf06f5aa3"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "88b7c994-6233-4b35-bb99-cf0c446209c7",
        "value": "aa107be86814d9c86911a2a7874d38a0"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "aff8fbbb-356f-48d0-8cc2-f34107a59b59",
        "value": "45d8cfe3450562564a1eb00a1aa0db83"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "76a08e74-3726-47ab-a843-91c43bbbd826",
        "value": "cdd7bfa36c6e47730fad94113aba7070"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "8a4b5d3b-5f21-4964-b27e-2c2def8a814b",
        "value": "06d72a4d99fcd76a3502432657f3c999"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "9a942823-2c54-4895-a315-69ee3a8fdd7d",
        "value": "5a91ccabd2b12ac56ba5170cf9ff8343"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "2eae27c0-8b06-467d-98d2-c41dbbd9ea41",
        "value": "33f42e9678ee91369d11ef344bbd5a0d"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "b7d7281a-49e2-43b1-ad97-adbeddb78ef1",
        "value": "84575619a690d3ef1209b7e3a7e79935"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "e57d6e37-6639-40b9-901f-3b329fa6f2cd",
        "value": "16e61624827d7785740b17c771a052e6"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "ed13b649-d423-4da2-a717-2df301efff4b",
        "value": "ccc7f88b72c286fd756e76309022e9f8"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "dad2ca4b-d239-4478-bd4e-9fc04304524f",
        "value": "e98031cf43bfed73db0bce43918a608c"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "6e79acee-0292-4ec7-a180-ec70c859ebaf",
        "value": "5ea42089cf91464b9c0c42292c18ba4c"
      },
      {
        "category": "Payload delivery",
        "comment": "xCaon",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226492",
        "to_ids": true,
        "type": "md5",
        "uuid": "f03a3675-25c4-4b6c-9c80-714bd05177db",
        "value": "cff6d9f5d214e3366d6b4ae31c413adc"
      },
      {
        "category": "Payload delivery",
        "comment": "PoisonIvy",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226504",
        "to_ids": true,
        "type": "md5",
        "uuid": "66d137ec-f1cd-4368-a156-2bde441fbfda",
        "value": "c74711de8aa68e7d97f501eda328d032"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a95bca59-0926-4e6d-8c53-fd49438b413b",
        "value": "infodocs.kginfocom.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "6e68c4b3-572c-42ce-9efd-add57c54fdb4",
        "value": "infodocs.kginfocom.com/gin/kw.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "21cbd237-ef3c-463f-a271-fbf54e9d018c",
        "value": "infodocs.kginfocom.com/gin/tab.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "b6d8477b-b5f8-4c70-a306-8261084c5fe7",
        "value": "ousync.kginfocom.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "f4b2fe85-6bbd-488d-8b6b-1fad7f0518cc",
        "value": "ousync.kginfocom.com/sync/kw.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e4c43742-5d6e-47e7-a60a-af7285d69f2a",
        "value": "uslugi.mahallafond.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "25c8bdc7-3820-424b-adf6-815f3ad9627d",
        "value": "uslugi.mahallafond.com/hall/kw.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1356b7df-214b-4d89-a60e-e71d7892a958",
        "value": "6z98os.id597.link"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "f413643d-9867-4332-8a58-e3ac08addc73",
        "value": "6z98os.id597.link/css/art.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "24cd28ec-225f-483f-af25-cd85de254c36",
        "value": "hwyigd.laccessal.org"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "ccbb2d63-8262-4ce0-a034-74fa4ca64ea9",
        "value": "hwyigd.laccessal.org/news/art.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "56dedd36-d2e0-4fc9-a085-35e833f4660a",
        "value": "hwyigd.laccessal.org/news/js.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8ee7214a-b962-4f22-ac4e-7707e3355d6b",
        "value": "help.2019mfa.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "6803b69d-0095-4df1-b0a4-f17037d0f109",
        "value": "help.2019mfa.com/help/art.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2a3ce912-d367-40a8-9905-b92ec7ee6f7a",
        "value": "m.usascd.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "5b71b1d5-bf23-406a-9d2d-a92ec6a378d4",
        "value": "m.usascd.com/uss/word.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "3b3f786d-8780-4c0d-8210-5e4194aa406f",
        "value": "ns01-mfa.ungov.org"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "b2173407-49cc-41d6-88fb-b800bfe0ace7",
        "value": "ns01-mfa.ungov.org/un/art.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "be5c6e12-b8cf-47b0-a5b9-558c4d1ccb93",
        "value": "dcc.ungov.org"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "72fe20ae-da1f-4268-9d1d-109934ff3e87",
        "value": "dcc.ungov.org/crss/art.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c0140daa-9087-431b-9068-f0b69c517664",
        "value": "index.google-upgrade.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "ecec4d5c-998c-4baf-8e2b-a4c5866e43c0",
        "value": "index.google-upgrade.com/upgrade/art.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "27541670-185f-4873-bad2-251ca23e97fd",
        "value": "mofa.ungov.org"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "aeba90e3-eb74-455c-8c9a-97c2a1f17ed1",
        "value": "mofa.ungov.org/momo/art.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59814876-b0a3-42bf-9bd1-198853cc58d6",
        "value": "update.ictdp.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "ed64d5a2-2024-492a-a2b0-d8d7780ea293",
        "value": "update.ictdp.com/new/art.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "ef595b36-0f05-4994-aba8-a6cdce20cce4",
        "value": "post.mfa-uz.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "bed858bf-fbe7-408b-8642-ff28a7802227",
        "value": "post.mfa-uz.com/post/art.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "25bf55e0-6982-497c-8fe3-bdaef7668610",
        "value": "cdn.muincxoil.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "91e5b026-d845-4358-bac4-29a811654547",
        "value": "cdn.muincxoil.com/cdn/js.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "16249b3f-e82c-4d1f-a92f-583cca4e0e98",
        "value": "cdn.muincxoil.com/cdn/art.asp"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1448c68f-5e3f-4dea-a607-a9dfafc63c04",
        "value": "tm.2019mfa.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C servers",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625226628",
        "to_ids": true,
        "type": "url",
        "uuid": "f44dcb42-7bf6-413a-800d-e7cfd54223c0",
        "value": "tm.2019mfa.com/css/p_d.asp"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625229414",
        "to_ids": false,
        "type": "link",
        "uuid": "c6c053a5-fbed-4ee2-baef-afee9f38c5f8",
        "value": "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625229540",
        "to_ids": false,
        "type": "filename",
        "uuid": "2f3f300b-5333-4248-a15b-8fa1bff46372",
        "value": "NSC Press conference.rar"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625229540",
        "to_ids": false,
        "type": "filename",
        "uuid": "9a819dd7-9dc7-4f74-9bba-d9747b6bbfe2",
        "value": "NSC Press conference.exe"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625229540",
        "to_ids": false,
        "type": "filename",
        "uuid": "6c2aeda3-6b82-4cc6-a73c-52fe99cf333b",
        "value": "%PUBLIC%\\spools.exe"
      },
      {
        "category": "Persistence mechanism",
        "comment": "Persistence",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625229586",
        "to_ids": false,
        "type": "regkey",
        "uuid": "79524b6f-6231-4143-84b6-6c487bae637a",
        "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\load"
      },
      {
        "category": "Payload delivery",
        "comment": "Post-infection - ntbscan",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1625229618",
        "to_ids": false,
        "type": "sha1",
        "uuid": "91ee1e61-a628-4f5c-b7a5-96185d0b4e0e",
        "value": "90da10004c8f6fafdaa2cf18922670a745564f45"
      }
    ]
  }
}