[
  {
    "id": 4250,
    "indicator": "yqv.3322.org",
    "type": "hostname",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4251,
    "indicator": "111.cf22.com",
    "type": "hostname",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4252,
    "indicator": "lindashuaiddos.f3322.org",
    "type": "hostname",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4253,
    "indicator": "zj.passwd1.com",
    "type": "hostname",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4254,
    "indicator": "syn.netbot.cc",
    "type": "hostname",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4255,
    "indicator": "jj94.3322.org",
    "type": "hostname",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4256,
    "indicator": "fymy.8800.org",
    "type": "hostname",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4257,
    "indicator": "ttlatale.3322.org",
    "type": "hostname",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4258,
    "indicator": "75.148my.com",
    "type": "hostname",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4259,
    "indicator": "aaa.swhk.net",
    "type": "hostname",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4260,
    "indicator": "kk.netbot.cc",
    "type": "hostname",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4261,
    "indicator": "22d0fa8571e1691cf2ffb1b20c1d536a",
    "type": "FileHash-MD5",
    "created": "2017-08-23T14:01:05",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 30409371,
    "indicator": "e508026c2c2620bd4bd11d35499cfc2b563a1392",
    "type": "YARA",
    "created": "2017-08-23T14:01:05",
    "content": "rule ChickenDOS_Linux    \n   {   \n       \n       meta:   \n           author = \"Jason Jones <jasonjones@arbor.net>\"   \n           description = \"Linux-variant of Chicken ident for both dropper and dropped file\"   \n           source = \"https://github.com/arbor/yara/blob/master/chicken.yara\"   \n          \n       strings:   \n           $cfg = \"fake.cfg\"   \n           $file1 = \"ThreadAttack.cpp\"   \n           $file2 = \"Fake.cpp\"   \n           $str1 = \"dns_array\"   \n           $str2 = \"DomainRandEx\"   \n           $str3 = \"cpu %llu %llu %llu %llu\"   \n           $str4 = \"[ %02d.%02d %02d:%02d:%02d.%03ld ] [%lu] [%s] %s\" ascii   \n          \n       condition:   \n           $cfg and all of ($file*) and 3 of ($str*)   \n   }",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 30409372,
    "indicator": "6d42e4d8e3d9099b855d530eb0f165c54b82dcd4",
    "type": "YARA",
    "created": "2017-08-23T14:01:05",
    "content": "rule ChickenDOS   \n   {   \n      \n       meta:   \n           author = \"Jason Jones <jasonjones@arbor.net>\"   \n           description = \"Win32-variant of Chicken ident for both dropper and dropped file\"   \n           source = \"https://github.com/arbor/yara/blob/master/chicken.yara\"   \n      \n       strings:   \n           $pdb1 = \"\\\\Chicken\\\\Release\\\\svchost.pdb\"   \n           $pdb2 = \"\\\\IntergrateCHK\\\\Release\\\\IntergrateCHK.pdb\"   \n           $str2 = \"fake.cf\"   \n           $str3 = \"8.8.8.8\"   \n           $str4 = \"Processor(%d)\\\\\"   \n           $str5 = \"DbProtectSupport\"   \n           $str1 = \"dm1712/`jvpnpkte/bpl\"   \n           $str6 = \"InstallService NPF %d\"   \n           $str7 = \"68961\"   \n           $str8 = \"InstallService DbProtectSupport %d\"   \n           $str9 = \"C:\\\\Program Files\\\\DbProtectSupport\\\\npf.sys\"   \n         \n       condition:   \n           ($pdb1 or $pdb2) and 5 of ($str*)   \n   }",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  }
]