adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5742ea44-5ff4-4634-99c9-4b32950d210f.json

1875 lines
68 KiB
JSON
Raw Permalink Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"Event": {
"analysis": "2",
"date": "2016-05-23",
"extends_uuid": "",
"info": "OSINT - Operation Ke3chang Resurfaces With New TidePool Malware",
"publish_timestamp": "1518770959",
"published": true,
"threat_level_id": "2",
"timestamp": "1515812422",
"uuid": "5742ea44-5ff4-4634-99c9-4b32950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#ffffff",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#004646",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "type:OSINT",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1515750508",
"to_ids": false,
"type": "link",
"uuid": "5742ea80-3774-4bab-bcd8-4e5d950d210f",
"value": "http://researchcenter.paloaltonetworks.com/2016/05/operation-ke3chang-resurfaces-with-new-tidepool-malware/"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1515750509",
"to_ids": false,
"type": "comment",
"uuid": "5742ea8c-70f4-42b1-8703-4f17950d210f",
"value": "Little has been published on the threat actors responsible for Operation Ke3chang since the report was released more than two years ago. However, Unit 42 has recently discovered the actors have continued to evolve their custom malware arsenal. We\u00e2\u20ac\u2122ve discovered a new malware family we\u00e2\u20ac\u2122ve named TidePool. It has strong behavioral ties to Ke3chang and is being used in an ongoing attack campaign against Indian embassy personnel worldwide. This targeting is also consistent with previous attacker TTPs; Ke3chang historically targeted the Ministry of Affairs, and also conducted several prior campaigns against India.\r\nThough we don\u00e2\u20ac\u2122t have comprehensive targeting information, the spear phishing emails we found targeted several Indian embassies in different countries. One decoy references an annual report filed by over 30 Indian embassies across the globe. The sender addresses of the phishing emails spoof real people with ties to Indian embassies, adding legitimacy to the emails to prompt the recipients to open the attached file. Also noteworthy, the actors are exploiting a relatively new vulnerability in their attacks with TidePool, which is detailed below.\r\nIn this report we will highlight the reuse of the code responsible for a variety of registry changes and command and control traffic over time as the Ke3chang actor has evolved their codebase to TidePool since the 2013 report."
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1515750509",
"to_ids": false,
"type": "vulnerability",
"uuid": "5742eaa5-cfec-4091-aaea-4f08950d210f",
"value": "CVE-2015-2545"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1515750509",
"to_ids": false,
"type": "filename",
"uuid": "5742eac0-8830-4aa2-bd48-4aac950d210f",
"value": "%USERPROFILE%\\IEHelper\\mshtml.dll"
},
{
"category": "Network activity",
"comment": "TidePool",
"deleted": false,
"disable_correlation": false,
"timestamp": "1515750509",
"to_ids": true,
"type": "hostname",
"uuid": "5742ecbb-498c-480b-88ba-47f3950d210f",
"value": "goback.strangled.net"
},
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464003799",
"to_ids": true,
"type": "sha256",
"uuid": "5742ecd7-1e84-4225-b43b-4e9a950d210f",
"value": "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
},
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464003799",
"to_ids": true,
"type": "sha256",
"uuid": "5742ecd7-794c-4a74-9aa4-45b6950d210f",
"value": "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
},
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464003799",
"to_ids": true,
"type": "sha256",
"uuid": "5742ecd7-0b4c-477d-b70d-4795950d210f",
"value": "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
},
{
"category": "Payload delivery",
"comment": "TidePool Dropper",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464003816",
"to_ids": true,
"type": "sha256",
"uuid": "5742ece8-e8dc-40e1-99db-4251950d210f",
"value": "38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f"
},
{
"category": "Payload delivery",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464003833",
"to_ids": true,
"type": "sha256",
"uuid": "5742ecf9-31f0-4440-92ce-4d63950d210f",
"value": "785e8a39eb66e872ff5abee48b7226e99bed2e12bc0f68fc430145a00fe523db"
},
{
"category": "Payload delivery",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464003833",
"to_ids": true,
"type": "sha256",
"uuid": "5742ecf9-67a8-426a-a268-4549950d210f",
"value": "eea3f90db41f872da8ed542b37948656b1fb93b12a266e8de82c6c668e60e9fc"
},
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464003945",
"to_ids": true,
"type": "sha256",
"uuid": "5742ed69-d374-40b6-8f10-48ff950d210f",
"value": "4d5e0eddcd014c63123f6a46af7e53b5ac25a7ff7de86f56277fe39bff32c7b5"
},
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464003946",
"to_ids": true,
"type": "sha256",
"uuid": "5742ed6a-5da4-4e7b-948e-4fd9950d210f",
"value": "1896d190ed5c5d04d74f8c2bfe70434f472b43441be824e81a31b7257b717e51"
},
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464003946",
"to_ids": true,
"type": "sha256",
"uuid": "5742ed6a-5254-4448-b588-4908950d210f",
"value": "de5060b7e9aaaeb8d24153fe35b77c27c95dadda5a5e727d99f407c8703db649"
},
{
"category": "Payload delivery",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464004032",
"to_ids": true,
"type": "sha256",
"uuid": "5742edc0-5d9c-41a9-9a47-41d1950d210f",
"value": "71b548e09fd51250356111f394e5fc64ac54d5a07d9bc57852315484c2046093"
},
{
"category": "Payload installation",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464004063",
"to_ids": true,
"type": "sha256",
"uuid": "5742eddf-627c-4ff7-9423-4efd950d210f",
"value": "39fdcdf019c0fca350ec5bd3de31b6649456993b3f9642f966d610e0190f9297"
},
{
"category": "Payload delivery",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464004221",
"to_ids": true,
"type": "sha256",
"uuid": "5742ee7d-d4dc-43df-b653-4408950d210f",
"value": "25a3b374894cacd922e7ff870bb19c84a9abfd69405dded13c3a6ceb5abe4d27"
},
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464004276",
"to_ids": true,
"type": "sha256",
"uuid": "5742eeb4-4b48-4312-9290-4c47950d210f",
"value": "12cc0fdc4f80942f0ba9039a22e701838332435883fa62d0cefd3992867a9e88"
},
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464004276",
"to_ids": true,
"type": "sha256",
"uuid": "5742eeb4-6690-48fc-b6d1-4a7d950d210f",
"value": "a4fae981b687fe230364508a3324cf6e6daa45ecddd6b7c7b532cdc980679076"
},
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012",
"deleted": false,
"disable_correlation": false,
"timestamp": "1464004276",
"to_ids": true,
"type": "sha256",
"uuid": "5742eeb4-f0cc-48f9-b670-4a21950d210f",
"value": "c1a83a9600d69c91c19207a8ee16347202d50873b6dc4613ba4d6a6059610fa1"
}
],
"Object": [
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750512",
"uuid": "d36aca31-f8d7-4ac8-bf33-30fd88480de8",
"ObjectReference": [
{
"comment": "",
"object_uuid": "d36aca31-f8d7-4ac8-bf33-30fd88480de8",
"referenced_uuid": "4c3e5932-e6a1-4554-9610-4cc1725c0b76",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770958",
"uuid": "5a588471-1b68-47a1-8505-490002de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750509",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846d-0614-49d1-9ace-481a02de0b81",
"value": "8e633f9ddb7902c1945f04203ed09e30838e1e74"
},
{
"category": "Payload delivery",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750509",
"to_ids": true,
"type": "md5",
"uuid": "5a58846d-95f8-45fb-a5e8-4b9202de0b81",
"value": "5ee64f9e44cddaa7ed11d752a149484d"
},
{
"category": "Payload delivery",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750509",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846d-ef88-42a9-bef2-4d0202de0b81",
"value": "71b548e09fd51250356111f394e5fc64ac54d5a07d9bc57852315484c2046093"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750509",
"uuid": "4c3e5932-e6a1-4554-9610-4cc1725c0b76",
"Attribute": [
{
"category": "External analysis",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750509",
"to_ids": false,
"type": "link",
"uuid": "5a58846d-41c0-45db-940a-4c7302de0b81",
"value": "https://www.virustotal.com/file/71b548e09fd51250356111f394e5fc64ac54d5a07d9bc57852315484c2046093/analysis/1464602237/"
},
{
"category": "Other",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750509",
"to_ids": false,
"type": "text",
"uuid": "5a58846d-595c-43da-80b0-496902de0b81",
"value": "42/57"
},
{
"category": "Other",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750509",
"to_ids": false,
"type": "datetime",
"uuid": "5a58846d-05a0-469d-b6f7-40f502de0b81",
"value": "2016-05-30T09:57:17"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750512",
"uuid": "29317953-8a0f-4c20-9835-6cf7c4bdab52",
"ObjectReference": [
{
"comment": "",
"object_uuid": "29317953-8a0f-4c20-9835-6cf7c4bdab52",
"referenced_uuid": "abfa1b03-38a3-4cf7-9d5d-9bf1948898f4",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770958",
"uuid": "5a588471-26f8-4f54-83bd-48ec02de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750509",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846d-7b00-4e61-88b7-498402de0b81",
"value": "31b92f816c9f3f45aeb435d47b654cd02c07a633"
},
{
"category": "Payload delivery",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750509",
"to_ids": true,
"type": "md5",
"uuid": "5a58846d-74c8-422d-9abd-4c4202de0b81",
"value": "aebf03ceaef042a833ee5459016f5bde"
},
{
"category": "Payload delivery",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750509",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846d-d620-4252-a02b-4c7002de0b81",
"value": "785e8a39eb66e872ff5abee48b7226e99bed2e12bc0f68fc430145a00fe523db"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750509",
"uuid": "abfa1b03-38a3-4cf7-9d5d-9bf1948898f4",
"Attribute": [
{
"category": "External analysis",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750509",
"to_ids": false,
"type": "link",
"uuid": "5a58846d-eb44-4ec5-9e87-4c8e02de0b81",
"value": "https://www.virustotal.com/file/785e8a39eb66e872ff5abee48b7226e99bed2e12bc0f68fc430145a00fe523db/analysis/1505182043/"
},
{
"category": "Other",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750509",
"to_ids": false,
"type": "text",
"uuid": "5a58846d-0504-4231-b21f-4ac402de0b81",
"value": "26/58"
},
{
"category": "Other",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750509",
"to_ids": false,
"type": "datetime",
"uuid": "5a58846d-a1cc-4a40-a5cf-4a6002de0b81",
"value": "2017-09-12T02:07:23"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750512",
"uuid": "33819efb-eb82-4a95-b1bf-1f78fe34b6fa",
"ObjectReference": [
{
"comment": "",
"object_uuid": "33819efb-eb82-4a95-b1bf-1f78fe34b6fa",
"referenced_uuid": "72f41d65-1c52-4c37-a1d6-e5d684df9bd8",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770958",
"uuid": "5a588471-201c-4c5e-8698-44d102de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750509",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846d-c960-470a-9738-43f002de0b81",
"value": "4ec47f819c72a4618ef6426839709d9a2e060919"
},
{
"category": "Payload delivery",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750509",
"to_ids": true,
"type": "md5",
"uuid": "5a58846d-1434-497c-ba93-432502de0b81",
"value": "026936afbbbdd9034f0a24b4032bd2f8"
},
{
"category": "Payload delivery",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750509",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846d-8464-443e-8906-46fc02de0b81",
"value": "39fdcdf019c0fca350ec5bd3de31b6649456993b3f9642f966d610e0190f9297"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750509",
"uuid": "72f41d65-1c52-4c37-a1d6-e5d684df9bd8",
"Attribute": [
{
"category": "External analysis",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750510",
"to_ids": false,
"type": "link",
"uuid": "5a58846e-358c-4ff5-8734-494902de0b81",
"value": "https://www.virustotal.com/file/39fdcdf019c0fca350ec5bd3de31b6649456993b3f9642f966d610e0190f9297/analysis/1501706637/"
},
{
"category": "Other",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750510",
"to_ids": false,
"type": "text",
"uuid": "5a58846e-7b70-413d-9396-4f1202de0b81",
"value": "49/65"
},
{
"category": "Other",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012 (BS2005)",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750510",
"to_ids": false,
"type": "datetime",
"uuid": "5a58846e-445c-427f-bb00-45cf02de0b81",
"value": "2017-08-02T20:43:57"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750513",
"uuid": "f1715b9e-1213-45d0-b05e-89b657a557a9",
"ObjectReference": [
{
"comment": "",
"object_uuid": "f1715b9e-1213-45d0-b05e-89b657a557a9",
"referenced_uuid": "670070b9-6439-402d-b6ea-1224c3b9fea8",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770958",
"uuid": "5a588471-4de8-446b-9a5a-4ab302de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750510",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846e-57d8-4ec0-8e87-4a2f02de0b81",
"value": "8c248daec675cb873a9ee850336e871dd4642c5b"
},
{
"category": "Payload delivery",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750510",
"to_ids": true,
"type": "md5",
"uuid": "5a58846e-8cec-448c-9b02-40db02de0b81",
"value": "c591263d56b57dfadd06a68dd9657343"
},
{
"category": "Payload delivery",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750510",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846e-cc4c-46f6-a3fc-467a02de0b81",
"value": "eea3f90db41f872da8ed542b37948656b1fb93b12a266e8de82c6c668e60e9fc"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750510",
"uuid": "670070b9-6439-402d-b6ea-1224c3b9fea8",
"Attribute": [
{
"category": "External analysis",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750510",
"to_ids": false,
"type": "link",
"uuid": "5a58846e-51bc-42f7-9846-4fa902de0b81",
"value": "https://www.virustotal.com/file/eea3f90db41f872da8ed542b37948656b1fb93b12a266e8de82c6c668e60e9fc/analysis/1464690554/"
},
{
"category": "Other",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750510",
"to_ids": false,
"type": "text",
"uuid": "5a58846e-a788-4d48-9cfe-411b02de0b81",
"value": "21/56"
},
{
"category": "Other",
"comment": "Weaponized document attachment",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750510",
"to_ids": false,
"type": "datetime",
"uuid": "5a58846e-7f4c-43ae-aa0a-4da402de0b81",
"value": "2016-05-31T10:29:14"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750513",
"uuid": "38b19130-caab-4039-85c5-064242831cd4",
"ObjectReference": [
{
"comment": "",
"object_uuid": "38b19130-caab-4039-85c5-064242831cd4",
"referenced_uuid": "b7768dd0-8628-45a0-a1c0-30ff2c345300",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770958",
"uuid": "5a588471-b8bc-4783-81ef-4e7202de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750510",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846e-8324-46a4-8dc7-418a02de0b81",
"value": "24cf8ab0b6999ab88c234b16c211e9c296131dbd"
},
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750510",
"to_ids": true,
"type": "md5",
"uuid": "5a58846e-be7c-4c04-a794-403e02de0b81",
"value": "98f58f61f4510be9c531feb5f000172f"
},
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750510",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846e-a768-4c48-8a7e-4d5b02de0b81",
"value": "12cc0fdc4f80942f0ba9039a22e701838332435883fa62d0cefd3992867a9e88"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750510",
"uuid": "b7768dd0-8628-45a0-a1c0-30ff2c345300",
"Attribute": [
{
"category": "External analysis",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750510",
"to_ids": false,
"type": "link",
"uuid": "5a58846e-b074-40aa-a94e-4ffb02de0b81",
"value": "https://www.virustotal.com/file/12cc0fdc4f80942f0ba9039a22e701838332435883fa62d0cefd3992867a9e88/analysis/1480255582/"
},
{
"category": "Other",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750510",
"to_ids": false,
"type": "text",
"uuid": "5a58846e-cafc-4abd-948f-4cc502de0b81",
"value": "41/56"
},
{
"category": "Other",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750510",
"to_ids": false,
"type": "datetime",
"uuid": "5a58846e-4330-4878-b3c4-4aa502de0b81",
"value": "2016-11-27T14:06:22"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750513",
"uuid": "1acad919-6ce1-465a-9c60-a3ac588a180d",
"ObjectReference": [
{
"comment": "",
"object_uuid": "1acad919-6ce1-465a-9c60-a3ac588a180d",
"referenced_uuid": "7cdf00e3-c53f-40b4-b7cd-514c78f9c864",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770959",
"uuid": "5a588471-a890-46d9-a29a-49eb02de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "TidePool Dropper",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750510",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846e-c0d8-497c-ae39-42be02de0b81",
"value": "0246a237b281162059b84f1bc013d90bbb4104f7"
},
{
"category": "Payload delivery",
"comment": "TidePool Dropper",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750510",
"to_ids": true,
"type": "md5",
"uuid": "5a58846e-c1a0-4d4b-a5b4-406d02de0b81",
"value": "8ad9cb6b948bcf7f9211887e0cf6f02a"
},
{
"category": "Payload delivery",
"comment": "TidePool Dropper",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750510",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846e-a898-4fd3-9e79-4c6b02de0b81",
"value": "38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750510",
"uuid": "7cdf00e3-c53f-40b4-b7cd-514c78f9c864",
"Attribute": [
{
"category": "External analysis",
"comment": "TidePool Dropper",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750510",
"to_ids": false,
"type": "link",
"uuid": "5a58846e-aed0-459e-b461-422402de0b81",
"value": "https://www.virustotal.com/file/38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f/analysis/1513864598/"
},
{
"category": "Other",
"comment": "TidePool Dropper",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750510",
"to_ids": false,
"type": "text",
"uuid": "5a58846e-31ec-46e9-9a74-4c8b02de0b81",
"value": "41/68"
},
{
"category": "Other",
"comment": "TidePool Dropper",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750510",
"to_ids": false,
"type": "datetime",
"uuid": "5a58846e-d154-44e8-bfb4-48f602de0b81",
"value": "2017-12-21T13:56:38"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750513",
"uuid": "64cf2807-9421-4a99-bcdd-e82af40c7346",
"ObjectReference": [
{
"comment": "",
"object_uuid": "64cf2807-9421-4a99-bcdd-e82af40c7346",
"referenced_uuid": "0b830feb-b802-42b3-9c13-f90d67dc3095",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770959",
"uuid": "5a588472-02ec-4237-aa59-44f502de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750510",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846e-bfd4-439a-9207-43a702de0b81",
"value": "47a963e7588e9af060dfac62b94076f270d4008e"
},
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750510",
"to_ids": true,
"type": "md5",
"uuid": "5a58846e-ce00-4d07-80ef-430a02de0b81",
"value": "9469dd12136b6514d82c3b01d6082f59"
},
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750510",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846e-d1f4-4e16-8552-480902de0b81",
"value": "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750510",
"uuid": "0b830feb-b802-42b3-9c13-f90d67dc3095",
"Attribute": [
{
"category": "External analysis",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750510",
"to_ids": false,
"type": "link",
"uuid": "5a58846e-b3b4-44c8-8ba9-462402de0b81",
"value": "https://www.virustotal.com/file/2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18/analysis/1512091554/"
},
{
"category": "Other",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750510",
"to_ids": false,
"type": "text",
"uuid": "5a58846e-1ab8-41e1-a712-4e3702de0b81",
"value": "49/67"
},
{
"category": "Other",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750511",
"to_ids": false,
"type": "datetime",
"uuid": "5a58846f-1e7c-4eed-b934-4db002de0b81",
"value": "2017-12-01T01:25:54"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750514",
"uuid": "96db58ab-0377-4a31-871b-c96f4652500e",
"ObjectReference": [
{
"comment": "",
"object_uuid": "96db58ab-0377-4a31-871b-c96f4652500e",
"referenced_uuid": "ea777cda-e274-445b-9504-912fdaf5ec18",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770959",
"uuid": "5a588472-33bc-426e-a54f-449202de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750511",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846f-312c-4741-838a-406902de0b81",
"value": "6793228ee3b6bd1a4bc91f17460b89d12d347fc9"
},
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750511",
"to_ids": true,
"type": "md5",
"uuid": "5a58846f-d510-455d-b7ac-4b7b02de0b81",
"value": "1aefd1c30d1710f901c70be7f1366cae"
},
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750511",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846f-a67c-4ed3-8fb0-439802de0b81",
"value": "1896d190ed5c5d04d74f8c2bfe70434f472b43441be824e81a31b7257b717e51"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750511",
"uuid": "ea777cda-e274-445b-9504-912fdaf5ec18",
"Attribute": [
{
"category": "External analysis",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750511",
"to_ids": false,
"type": "link",
"uuid": "5a58846f-8bb8-4de7-82fd-450e02de0b81",
"value": "https://www.virustotal.com/file/1896d190ed5c5d04d74f8c2bfe70434f472b43441be824e81a31b7257b717e51/analysis/1474270852/"
},
{
"category": "Other",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750511",
"to_ids": false,
"type": "text",
"uuid": "5a58846f-9d80-48cd-8e1f-42fd02de0b81",
"value": "20/55"
},
{
"category": "Other",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750511",
"to_ids": false,
"type": "datetime",
"uuid": "5a58846f-eca0-41fa-88c7-463502de0b81",
"value": "2016-09-19T07:40:52"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750514",
"uuid": "ab660ec7-d756-4009-91c7-ef5ac5f7afcf",
"ObjectReference": [
{
"comment": "",
"object_uuid": "ab660ec7-d756-4009-91c7-ef5ac5f7afcf",
"referenced_uuid": "c4c4e9f6-4680-4789-b6a4-ec623a695c71",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770959",
"uuid": "5a588472-9948-41b6-a80f-44b402de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750511",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846f-3718-41f8-a605-4d5a02de0b81",
"value": "0e2c603e23219598dc3432d94df6dfae147cceab"
},
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750511",
"to_ids": true,
"type": "md5",
"uuid": "5a58846f-70bc-4cfb-9839-479502de0b81",
"value": "3ed40dec891fd48c7ec6fa49b1058d24"
},
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750511",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846f-bef8-4393-8c2a-419002de0b81",
"value": "de5060b7e9aaaeb8d24153fe35b77c27c95dadda5a5e727d99f407c8703db649"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750511",
"uuid": "c4c4e9f6-4680-4789-b6a4-ec623a695c71",
"Attribute": [
{
"category": "External analysis",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750511",
"to_ids": false,
"type": "link",
"uuid": "5a58846f-cddc-4ff7-9b1d-421302de0b81",
"value": "https://www.virustotal.com/file/de5060b7e9aaaeb8d24153fe35b77c27c95dadda5a5e727d99f407c8703db649/analysis/1464236275/"
},
{
"category": "Other",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750511",
"to_ids": false,
"type": "text",
"uuid": "5a58846f-b4b4-42f1-8f52-4a1502de0b81",
"value": "20/56"
},
{
"category": "Other",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750511",
"to_ids": false,
"type": "datetime",
"uuid": "5a58846f-582c-4af6-b645-436b02de0b81",
"value": "2016-05-26T04:17:55"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750514",
"uuid": "faaab687-1aa7-4f25-aab1-e4c6800a80ab",
"ObjectReference": [
{
"comment": "",
"object_uuid": "faaab687-1aa7-4f25-aab1-e4c6800a80ab",
"referenced_uuid": "b2e9a6ec-2c61-459b-9c48-a6d5b09d7fd6",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770959",
"uuid": "5a588472-6400-4a5b-9943-42e402de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750511",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846f-8cb4-4059-9093-49e002de0b81",
"value": "614ccb872e8feeab608a69d79c91bfeeb360ca9d"
},
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750511",
"to_ids": true,
"type": "md5",
"uuid": "5a58846f-f008-4475-aba0-4eaf02de0b81",
"value": "8c7cf7baaf20fe9bec63eb8928afdb41"
},
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750511",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846f-22ec-4f17-85b8-4ea102de0b81",
"value": "a4fae981b687fe230364508a3324cf6e6daa45ecddd6b7c7b532cdc980679076"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750511",
"uuid": "b2e9a6ec-2c61-459b-9c48-a6d5b09d7fd6",
"Attribute": [
{
"category": "External analysis",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750511",
"to_ids": false,
"type": "link",
"uuid": "5a58846f-1d68-41fa-a7b5-490b02de0b81",
"value": "https://www.virustotal.com/file/a4fae981b687fe230364508a3324cf6e6daa45ecddd6b7c7b532cdc980679076/analysis/1502697388/"
},
{
"category": "Other",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750511",
"to_ids": false,
"type": "text",
"uuid": "5a58846f-ce24-4e5d-9c03-47b402de0b81",
"value": "44/64"
},
{
"category": "Other",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012 - BS2005",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750511",
"to_ids": false,
"type": "datetime",
"uuid": "5a58846f-9260-43c4-adae-4c1702de0b81",
"value": "2017-08-14T07:56:28"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750514",
"uuid": "8ec4d47a-540f-4bbb-bac4-083f4f481aab",
"ObjectReference": [
{
"comment": "",
"object_uuid": "8ec4d47a-540f-4bbb-bac4-083f4f481aab",
"referenced_uuid": "3cd6bcdd-bbcf-45e1-9950-90c48d7756db",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770959",
"uuid": "5a588472-6150-4116-82d5-48cd02de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750511",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846f-218c-4484-8f8e-494402de0b81",
"value": "8bed9000c2f6347e683beadb1a5d4dedaccbd21f"
},
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750511",
"to_ids": true,
"type": "md5",
"uuid": "5a58846f-464c-4ee4-adc5-4e6802de0b81",
"value": "aae962611da956a26a76d185455f1d44"
},
{
"category": "Payload delivery",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750511",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846f-b8b8-4726-8d59-47d602de0b81",
"value": "4d5e0eddcd014c63123f6a46af7e53b5ac25a7ff7de86f56277fe39bff32c7b5"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750511",
"uuid": "3cd6bcdd-bbcf-45e1-9950-90c48d7756db",
"Attribute": [
{
"category": "External analysis",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750511",
"to_ids": false,
"type": "link",
"uuid": "5a58846f-7198-409e-929f-429e02de0b81",
"value": "https://www.virustotal.com/file/4d5e0eddcd014c63123f6a46af7e53b5ac25a7ff7de86f56277fe39bff32c7b5/analysis/1474272871/"
},
{
"category": "Other",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750511",
"to_ids": false,
"type": "text",
"uuid": "5a58846f-8398-4582-8767-42cc02de0b81",
"value": "18/55"
},
{
"category": "Other",
"comment": "Phishing email",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750511",
"to_ids": false,
"type": "datetime",
"uuid": "5a58846f-6240-47e0-98b2-4ceb02de0b81",
"value": "2016-09-19T08:14:31"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750514",
"uuid": "29618e84-7d70-49ea-8c5e-d888d51f24ab",
"ObjectReference": [
{
"comment": "",
"object_uuid": "29618e84-7d70-49ea-8c5e-d888d51f24ab",
"referenced_uuid": "88f47bd4-e874-45e1-9c95-941a7cb0f52f",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770959",
"uuid": "5a588472-b71c-427b-a0b4-44c302de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750511",
"to_ids": true,
"type": "sha1",
"uuid": "5a58846f-37e0-42a7-a36c-4a6002de0b81",
"value": "a8fa7f331329bb6b0018b5663961f50f60372dfc"
},
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750511",
"to_ids": true,
"type": "md5",
"uuid": "5a58846f-e4ac-49a3-ac90-475402de0b81",
"value": "6bd64b291f2855bbdb011a0af1fab2fc"
},
{
"category": "Payload delivery",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750511",
"to_ids": true,
"type": "sha256",
"uuid": "5a58846f-0edc-4720-8bf5-4a4a02de0b81",
"value": "c1a83a9600d69c91c19207a8ee16347202d50873b6dc4613ba4d6a6059610fa1"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750511",
"uuid": "88f47bd4-e874-45e1-9c95-941a7cb0f52f",
"Attribute": [
{
"category": "External analysis",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750511",
"to_ids": false,
"type": "link",
"uuid": "5a58846f-fdb4-4ae5-ae96-481202de0b81",
"value": "https://www.virustotal.com/file/c1a83a9600d69c91c19207a8ee16347202d50873b6dc4613ba4d6a6059610fa1/analysis/1477459761/"
},
{
"category": "Other",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750512",
"to_ids": false,
"type": "text",
"uuid": "5a588470-026c-4325-bca5-415202de0b81",
"value": "39/56"
},
{
"category": "Other",
"comment": "Group 2: 6/1/2012 \u00e2\u20ac\u201c 7/10/2012",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750512",
"to_ids": false,
"type": "datetime",
"uuid": "5a588470-5850-4dc3-bc6a-453d02de0b81",
"value": "2016-10-26T05:29:21"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750515",
"uuid": "0756b913-74c9-432d-819b-a421d08d375d",
"ObjectReference": [
{
"comment": "",
"object_uuid": "0756b913-74c9-432d-819b-a421d08d375d",
"referenced_uuid": "ecd39cdd-ca7c-48fd-b0e5-ad1d6abbce67",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770959",
"uuid": "5a588472-b670-44cf-9b6c-490502de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750512",
"to_ids": true,
"type": "sha1",
"uuid": "5a588470-2acc-44af-8977-465a02de0b81",
"value": "1a14cfdf652bcd1df572e47ed261abe453a41399"
},
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750512",
"to_ids": true,
"type": "md5",
"uuid": "5a588470-1d60-4979-910c-40e102de0b81",
"value": "be0cc8411c066eac246097045b73c282"
},
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750512",
"to_ids": true,
"type": "sha256",
"uuid": "5a588470-3ef0-44a4-8a69-429b02de0b81",
"value": "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750512",
"uuid": "ecd39cdd-ca7c-48fd-b0e5-ad1d6abbce67",
"Attribute": [
{
"category": "External analysis",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750512",
"to_ids": false,
"type": "link",
"uuid": "5a588470-c0e4-4c3b-8361-437102de0b81",
"value": "https://www.virustotal.com/file/9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba/analysis/1512091725/"
},
{
"category": "Other",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750512",
"to_ids": false,
"type": "text",
"uuid": "5a588470-29dc-4540-804f-48f002de0b81",
"value": "48/67"
},
{
"category": "Other",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750512",
"to_ids": false,
"type": "datetime",
"uuid": "5a588470-c608-4829-a0d1-477202de0b81",
"value": "2017-12-01T01:28:45"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750515",
"uuid": "2404272c-a873-48c4-bc1f-2af5dde7d96e",
"ObjectReference": [
{
"comment": "",
"object_uuid": "2404272c-a873-48c4-bc1f-2af5dde7d96e",
"referenced_uuid": "6a5caeb6-3bcf-454d-85ea-96e9e13142d9",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770959",
"uuid": "5a588472-4f6c-4f77-9331-4c2102de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750512",
"to_ids": true,
"type": "sha1",
"uuid": "5a588470-9038-484d-860b-4c5d02de0b81",
"value": "f1f895aa6bdb7369525abfb86b4475241e9dbfbb"
},
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750512",
"to_ids": true,
"type": "md5",
"uuid": "5a588470-bff4-4898-81b7-48fd02de0b81",
"value": "bae673964e9bc2a45ebcc667895104ef"
},
{
"category": "Payload delivery",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750512",
"to_ids": true,
"type": "sha256",
"uuid": "5a588470-9558-4a6c-960f-45c302de0b81",
"value": "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750512",
"uuid": "6a5caeb6-3bcf-454d-85ea-96e9e13142d9",
"Attribute": [
{
"category": "External analysis",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750512",
"to_ids": false,
"type": "link",
"uuid": "5a588470-d520-4bdf-a8cd-4b5002de0b81",
"value": "https://www.virustotal.com/file/67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed/analysis/1512091712/"
},
{
"category": "Other",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750512",
"to_ids": false,
"type": "text",
"uuid": "5a588470-5f84-413e-992a-4b8202de0b81",
"value": "49/66"
},
{
"category": "Other",
"comment": "TidePool DLL",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750512",
"to_ids": false,
"type": "datetime",
"uuid": "5a588470-eaf8-4911-8673-4ac302de0b81",
"value": "2017-12-01T01:28:32"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1515750515",
"uuid": "1bed7c4f-08df-4dce-8a44-b45a17fac214",
"ObjectReference": [
{
"comment": "",
"object_uuid": "1bed7c4f-08df-4dce-8a44-b45a17fac214",
"referenced_uuid": "2cc94589-3349-4fad-b8a0-f90063b03212",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1518770959",
"uuid": "5a588472-901c-4b11-ab8a-4e5c02de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1515750512",
"to_ids": true,
"type": "sha1",
"uuid": "5a588470-7fcc-4e61-a88b-4ea702de0b81",
"value": "1178ddd92e0121e2ede7e1091661a324d31f0de0"
},
{
"category": "Payload delivery",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1515750512",
"to_ids": true,
"type": "md5",
"uuid": "5a588470-efe0-4e1f-a7cb-450902de0b81",
"value": "50611814ad2a843a8f998c57786abad7"
},
{
"category": "Payload delivery",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1515750512",
"to_ids": true,
"type": "sha256",
"uuid": "5a588470-3f9c-4d62-800f-427702de0b81",
"value": "25a3b374894cacd922e7ff870bb19c84a9abfd69405dded13c3a6ceb5abe4d27"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1515750512",
"uuid": "2cc94589-3349-4fad-b8a0-f90063b03212",
"Attribute": [
{
"category": "External analysis",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1515750513",
"to_ids": false,
"type": "link",
"uuid": "5a588471-14f8-4028-b391-41de02de0b81",
"value": "https://www.virustotal.com/file/25a3b374894cacd922e7ff870bb19c84a9abfd69405dded13c3a6ceb5abe4d27/analysis/1464323932/"
},
{
"category": "Other",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1515750513",
"to_ids": false,
"type": "text",
"uuid": "5a588471-59e0-419e-854d-43bf02de0b81",
"value": "43/57"
},
{
"category": "Other",
"comment": "Group 1: 3/1/2012 \u00e2\u20ac\u201c 3/22/2012",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1515750513",
"to_ids": false,
"type": "datetime",
"uuid": "5a588471-c3b4-4b8c-8e72-40e002de0b81",
"value": "2016-05-27T04:38:52"
}
]
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
chg: [gen] updated
2023-12-14 14:30:15 +00:00
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
}
Reference in a new issue Copy permalink