2023-12-14 14:30:15 +00:00
|
|
|
{"Event": {"info": "M2M - Trickbot 2017-11-14 : \"mac1\" : \"Invoice\n AXBY1234567\" - \"InvoiceAXBY1234567.doc\"", "Tag": [{"colour": "#ffffff", "exportable": true, "name": "tlp:white"}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:tool=\"Trick Bot\""}], "publish_timestamp": "0", "timestamp": "1510937098", "analysis": "1", "Attribute": [{"comment": "", "category": "Artifacts dropped", "uuid": "5a0f0f65-6728-417b-be96-b831950d210f", "timestamp": "1510937091", "to_ids": true, "value": "37e5976ed01f8bcf6b814e58a847d294", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f65-e4a0-42ca-9876-5911950d210f", "timestamp": "1510937091", "to_ids": true, "value": "http://hubalon.de/FGdhbr5", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f65-96d4-4d8a-8978-4dfd950d210f", "timestamp": "1510937091", "to_ids": true, "value": "hubalon.de", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "hubalon.de", "category": "Network activity", "uuid": "5a0f0f66-9440-48cd-9f29-5dfc950d210f", "timestamp": "1510937091", "to_ids": false, "value": "212.72.171.130", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f66-2ab8-4fc9-9500-b41d950d210f", "timestamp": "1510937091", "to_ids": true, "value": "http://infoweb.cfpsdevweb.ch/FGdhbr5", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f66-69f8-44b9-8975-b59f950d210f", "timestamp": "1510937091", "to_ids": true, "value": "infoweb.cfpsdevweb.ch", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "infoweb.cfpsdevweb.ch", "category": "Network activity", "uuid": "5a0f0f66-54f4-4c11-9a39-4bb6950d210f", "timestamp": "1510937091", "to_ids": false, "value": "213.221.153.22", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f67-e470-4ef3-9ec9-5e08950d210f", "timestamp": "1510937091", "to_ids": true, "value": "http://kb.schuttesystems.net/FGdhbr5", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f67-e778-4c79-9bfc-5d86950d210f", "timestamp": "1510937091", "to_ids": true, "value": "kb.schuttesystems.net", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "kb.schuttesystems.net", "category": "Network activity", "uuid": "5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f", "timestamp": "1510937091", "to_ids": false, "value": "194.151.161.144", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f67-d570-4688-b052-5d51950d210f", "timestamp": "1510937091", "to_ids": true, "value": "http://kipshagen-ol.de/FGdhbr5", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f67-d120-4b45-bc25-b831950d210f", "timestamp": "1510937091", "to_ids": true, "value": "kipshagen-ol.de", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "kipshagen-ol.de", "category": "Network activity", "uuid": "5a0f0f68-9a20-4b25-8e06-5911950d210f", "timestamp": "1510937091", "to_ids": false, "value": "82.165.155.25", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f68-294c-492e-bb55-41c0950d210f", "timestamp": "1510937091", "to_ids": true, "value": "http://nc.skyrunner.net/FGdhbr5", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f68-dba0-41a1-9e33-5d86950d210f", "timestamp": "1510937091", "to_ids": true, "value": "nc.skyrunner.net", "disable_correlation": false,
|
