2023-04-21 13:25:09 +00:00
{
2023-12-14 14:30:15 +00:00
"Event" : {
"analysis" : "2" ,
"date" : "2017-11-15" ,
"extends_uuid" : "" ,
"info" : "OSINT - Multi-stage malware sneaks into Google Play" ,
"publish_timestamp" : "1540544872" ,
"published" : true ,
"threat_level_id" : "3" ,
"timestamp" : "1540544859" ,
"uuid" : "5a26b513-1ffc-497b-8cac-c53a950d210f" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#004646" ,
2024-04-05 12:15:17 +00:00
"local" : false ,
2023-12-14 14:30:15 +00:00
"name" : "type:OSINT" ,
"relationship_type" : ""
} ,
{
"colour" : "#ffffff" ,
2024-04-05 12:15:17 +00:00
"local" : false ,
2023-12-14 14:30:15 +00:00
"name" : "tlp:white" ,
"relationship_type" : ""
} ,
{
"colour" : "#3a7300" ,
2024-04-05 12:15:17 +00:00
"local" : false ,
2023-12-14 14:30:15 +00:00
"name" : "circl:incident-classification=\"malware\"" ,
"relationship_type" : ""
} ,
{
"colour" : "#00223b" ,
2024-04-05 12:15:17 +00:00
"local" : false ,
2023-12-14 14:30:15 +00:00
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
}
] ,
"Attribute" : [
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512486183" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5a26b520-8974-4557-9ecb-4260950d210f" ,
"value" : "https://www.welivesecurity.com/2017/11/15/multi-stage-malware-sneaks-google-play/" ,
"Tag" : [
{
"colour" : "#00223b" ,
2024-04-05 12:15:17 +00:00
"local" : false ,
2023-12-14 14:30:15 +00:00
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Network activity" ,
"comment" : "Hardcoded domains hosting links to the third-stage payloads" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512983564" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5a2e4c0c-e20c-4386-bdc9-c566950d210f" ,
"value" : "loaderclientarea24.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "Hardcoded domains hosting links to the third-stage payloads" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512983564" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5a2e4c0c-5e7c-446d-979f-c566950d210f" ,
"value" : "loaderclientarea22.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "Hardcoded domains hosting links to the third-stage payloads" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512983565" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5a2e4c0d-6ec0-4617-b698-c566950d210f" ,
"value" : "loaderclientarea20.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "Hardcoded domains hosting links to the third-stage payloads" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512983565" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5a2e4c0d-0d90-4608-b0e4-c566950d210f" ,
"value" : "loaderclientarea15.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "Hardcoded domains hosting links to the third-stage payloads" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512983566" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5a2e4c0e-ae14-4d56-81da-c566950d210f" ,
"value" : "loaderclientarea13.ru"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512983689" ,
"to_ids" : false ,
"type" : "comment" ,
"uuid" : "5a2e4c7f-9ce8-418d-ae08-b401950d210f" ,
"value" : "Anti-detection features\r\n\r\nThese malware samples all employ a multi-stage architecture and encryption to stay under the radar.\r\n\r\nAfter being downloaded and installed, these apps do not request any suspicious permissions and even mimic the activity the user expects them to exhibit.\r\n\r\nAlong with this, the malicious app also decrypts and executes its payload \u00e2\u20ac\u201c that is, the first-stage payload. This payload decrypts and executes the second-stage payload, which is stored in the assets of the initial app downloaded from Google Play. These steps are invisible to the user and serve as obfuscatory measures." ,
"Tag" : [
{
"colour" : "#00223b" ,
2024-04-05 12:15:17 +00:00
"local" : false ,
2023-12-14 14:30:15 +00:00
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
}
]
}
] ,
"Object" : [
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "7" ,
"timestamp" : "1512980550" ,
"uuid" : "5a2e4046-8b60-456b-8b75-5467950d210f" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "filename" ,
"timestamp" : "1512980551" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5a2e4047-627c-4afe-ad93-5467950d210f" ,
"value" : "com.fleeeishei.erabladmounsem"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1512980551" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5a2e4047-c114-4e01-a486-5467950d210f" ,
"value" : "9ab5a05bc3c8f1931a3a49278e18d2116f529704"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "7" ,
"timestamp" : "1512981093" ,
"uuid" : "5a2e4265-81d0-44f3-ba7c-5daf950d210f" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "filename" ,
"timestamp" : "1512981093" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5a2e4265-a550-4765-9096-5daf950d210f" ,
"value" : "com.softmuiiurket.cleanerforandroid"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1512981093" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5a2e4265-101c-4d05-bc25-5daf950d210f" ,
"value" : "2e47c816a517548a0fbf809324d63868708d00d0"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "7" ,
"timestamp" : "1512981190" ,
"uuid" : "5a2e42c6-1420-41e4-8580-60de950d210f" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "filename" ,
"timestamp" : "1512981190" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5a2e42c7-e288-4015-9475-60de950d210f" ,
"value" : "com.expjhvjhertsoft.bestrambooster"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1512981191" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5a2e42c7-b2f4-48b0-aae7-60de950d210f" ,
"value" : "de64139e6e91ac0dde755d2ef49d60251984652f"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "7" ,
"timestamp" : "1512981250" ,
"uuid" : "5a2e4302-df2c-4db4-8bba-71d3950d210f" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "filename" ,
"timestamp" : "1512981250" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5a2e4302-2af4-4a8d-8dfc-71d3950d210f" ,
"value" : "gotov.games.toppro"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1512981251" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5a2e4303-e28c-4e2a-88ed-71d3950d210f" ,
"value" : "6ab844c8fd654aaec29dac095214f4430012ee0e"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "7" ,
"timestamp" : "1512982248" ,
"uuid" : "5a2e46e8-f488-40cd-a9ec-878d950d210f" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "filename" ,
"timestamp" : "1512982248" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5a2e46e8-f98c-4f05-97d2-878d950d210f" ,
"value" : "slots.forgame.vul"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1512982249" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5a2e46e9-0ab4-43e6-a86b-878d950d210f" ,
"value" : "c8dd6815f30367695938a7613c11e029055279a2"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "7" ,
"timestamp" : "1512982939" ,
"uuid" : "5a2e499b-4ccc-4e5c-ae67-bb07950d210f" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "filename" ,
"timestamp" : "1512982940" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5a2e499c-bd18-454a-8c41-bb07950d210f" ,
"value" : "com.bucholregaum.hampelpa"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1512982940" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5a2e499c-6844-42cf-a8a5-bb07950d210f" ,
"value" : "47442bfdfbc0fb350b8b30271c310fe44ffb119a"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "7" ,
"timestamp" : "1512983131" ,
"uuid" : "5a2e4a5b-b27c-4c2f-9112-ba38950d210f" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "filename" ,
"timestamp" : "1512983131" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5a2e4a5b-7ac0-4033-928f-ba38950d210f" ,
"value" : "com.peridesuramant.worldnews"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1512983132" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5a2e4a5c-16bc-4f0c-af79-ba38950d210f" ,
"value" : "604e6dcdf1fa1f7b5a85892ac3761bed81405bf6"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "7" ,
"timestamp" : "1512983191" ,
"uuid" : "5a2e4a97-e268-44ea-ada6-bbe1950d210f" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "filename" ,
"timestamp" : "1512983191" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5a2e4a97-4708-494b-bd75-bbe1950d210f" ,
"value" : "com.peridesurrramant.worldnews"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1512983192" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5a2e4a98-5a44-43ff-b3dd-bbe1950d210f" ,
"value" : "532079b31e3acef2d71c75b31d77480304b2f7b9"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1540544746" ,
"uuid" : "11c074b2-9ef5-468f-9a71-70ea7abb9d67" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1540544747" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "2ac16804-e560-4e29-ad01-27042587a12f" ,
"value" : "4e6183687717cf7d7adc906cf5450729"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1540544748" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "1154318f-99a1-4cec-a476-426edf64b4c5" ,
"value" : "c8dd6815f30367695938a7613c11e029055279a2"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1540544748" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "266765a1-c1ed-4aa0-8a18-0381c4874621" ,
"value" : "d6e48539252c4425bbb8f4b7e60f9ca6cbb703f324bbf1dde025a3d935b74cb9"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1540544749" ,
"uuid" : "df8032d7-cbe9-49fd-9747-63d74730df9f" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1540544749" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "72b61313-867c-48fe-afae-33879fda2b33" ,
"value" : "2018-10-04T21:24:43"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1540544750" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "4f384fe0-2a17-4c90-81bd-1eea46dcb4dc" ,
"value" : "https://www.virustotal.com/file/d6e48539252c4425bbb8f4b7e60f9ca6cbb703f324bbf1dde025a3d935b74cb9/analysis/1538688283/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1540544750" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "2fdf0dd7-f0e3-4a27-b288-fd731165a63b" ,
"value" : "30/61"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1540544750" ,
"uuid" : "475d3bb8-eb86-4c51-a3a3-15ab39d91ddf" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1540544750" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "4c10cead-648f-4430-85ac-c6658eebe39b" ,
"value" : "21af98ec1a99ae37367d2e71d16b85fa"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1540544751" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "bbc3978a-a6d2-49b8-b9cf-68df872f8f8c" ,
"value" : "de64139e6e91ac0dde755d2ef49d60251984652f"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1540544752" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "8824a4d3-611b-49c5-bb5e-cfe69f714fc9" ,
"value" : "f0c97217377ab0b4dd71baf5529d79e6349e477e69d4043a82f9c768ef46a932"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1540544758" ,
"uuid" : "94031eb7-4ff3-486e-b44f-eb4fa2ab0c1c" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1540544764" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "beace62d-a2d6-42ad-a1ff-0d85f7ccf447" ,
"value" : "2018-10-04T21:32:29"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1540544771" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "f5e4dc71-0ada-47da-9c85-dd7999b9fdb4" ,
"value" : "https://www.virustotal.com/file/f0c97217377ab0b4dd71baf5529d79e6349e477e69d4043a82f9c768ef46a932/analysis/1538688749/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1540544772" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "69190414-96bf-48ed-8a7c-2e002e4ef9eb" ,
"value" : "30/62"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1540544772" ,
"uuid" : "90b018c5-f3af-4ebf-9bb9-452b205d3038" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1540544772" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "ddc61b53-fbe7-4ba3-b256-83ffa0752eb2" ,
"value" : "f9617beec1b56eace79e870cb0925ffd"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1540544773" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "13871cc9-e679-4ca2-afa8-d96af64952cd" ,
"value" : "604e6dcdf1fa1f7b5a85892ac3761bed81405bf6"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1540544774" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "e5e884f8-79f2-45d4-a1b1-8950b7b1a4da" ,
"value" : "3fc104c7fb8f6419aa5b45a3abfcc545ddb8e225f1b6dcaf5824075cbdf5dddd"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1540544774" ,
"uuid" : "caa22be8-c2c9-465f-8aaa-c20e3eafec9f" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1540544774" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "f3bd1117-6b76-40f4-b890-3ff8c3a11b3a" ,
"value" : "2018-10-04T21:32:21"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1540544775" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "081c6e6e-4bcc-4223-9840-923e63ed044c" ,
"value" : "https://www.virustotal.com/file/3fc104c7fb8f6419aa5b45a3abfcc545ddb8e225f1b6dcaf5824075cbdf5dddd/analysis/1538688741/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1540544776" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "70e00152-a2f1-46fd-b7c7-55f38c1255a4" ,
"value" : "30/62"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1540544776" ,
"uuid" : "a62c5ce0-9e21-466e-b317-a0a00fef80ef" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1540544776" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "f8e88752-587f-4287-b7f9-90bdbe4ab467" ,
"value" : "c4acc83183ac0fabe92fc02ae5ef3ca4"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1540544782" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "56c7bb87-41d2-4a89-a85c-f3a11f396353" ,
"value" : "9ab5a05bc3c8f1931a3a49278e18d2116f529704"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1540544783" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "178d0135-a2a4-4460-a8d5-ffc3aa2c10d7" ,
"value" : "dd857e8505cedf84b316eb0f5cdcba1386fb8412bc630e671f474aeedfccb387"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1540544783" ,
"uuid" : "1263f071-0c4b-4d90-b6ef-81682679e425" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1540544784" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "8aa24a31-7fdd-4ed4-a632-705aa09205d3" ,
"value" : "2018-10-04T21:32:25"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1540544784" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "0cc5c304-cd11-41a5-9583-7e971aad4310" ,
"value" : "https://www.virustotal.com/file/dd857e8505cedf84b316eb0f5cdcba1386fb8412bc630e671f474aeedfccb387/analysis/1538688745/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1540544785" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5263a8d1-50e1-4f76-8f4b-d73cef90d7ed" ,
"value" : "34/62"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1540544785" ,
"uuid" : "959b41df-ba0f-4520-a633-f28b0d7e5b21" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1540544785" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "74fded8c-363d-4cce-a9ba-cf1e3cc79711" ,
"value" : "a0dcd9907a3726edfb8e7de48b3aa8f6"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1540544786" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "d1c9f224-f8bf-4f1b-ad39-10c17c45aa5f" ,
"value" : "6ab844c8fd654aaec29dac095214f4430012ee0e"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1540544786" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "95392806-aafd-4ed0-8961-2d113a91c471" ,
"value" : "e980dc97b0b63158e251e6055d0f4362bf0a105bd999146de048f13a8f4aadb7"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1540544787" ,
"uuid" : "9c3a68e0-2e10-46ad-adda-0237549ebcd1" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1540544787" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "fac591a5-dfe8-45be-994b-d62da1b2a50d" ,
"value" : "2018-10-04T21:24:52"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1540544788" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58702d62-de2f-4573-b03a-f18fd9513e2e" ,
"value" : "https://www.virustotal.com/file/e980dc97b0b63158e251e6055d0f4362bf0a105bd999146de048f13a8f4aadb7/analysis/1538688292/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1540544789" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "7a7627ca-a13a-48e8-8fad-142354ccfc99" ,
"value" : "29/62"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1540544789" ,
"uuid" : "973efe60-da30-4d60-aa15-6a1ee7f82e22" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1540544789" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "eebe66ee-cae3-4df9-bf37-57eb24bc39fe" ,
"value" : "327d37ad6391c674f2f5a96e08cbc95f"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1540544790" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "ae0d611b-4218-4a01-bb20-9264bb985b11" ,
"value" : "47442bfdfbc0fb350b8b30271c310fe44ffb119a"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1540544797" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "6d703e81-fa21-4eb7-a86e-377b41a9fe82" ,
"value" : "ef3dfcd3e1351f46ee3cbfb3f71fe9d06a445d8affe2e679f34d8bf4bb618849"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1540544803" ,
"uuid" : "6b985af4-f961-4f8d-b2f7-513b6ed1c140" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1540544807" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "1b0b2e29-f922-40e2-b9e7-e1138cc8cd16" ,
"value" : "2018-10-04T21:32:08"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1540544812" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "e48a740f-3a6a-4209-b09f-9ce33ca4d094" ,
"value" : "https://www.virustotal.com/file/ef3dfcd3e1351f46ee3cbfb3f71fe9d06a445d8affe2e679f34d8bf4bb618849/analysis/1538688728/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1540544817" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "6184c6e0-29e2-4165-8e42-ccf5bbb23b19" ,
"value" : "31/61"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1540544817" ,
"uuid" : "ae8d1770-da33-4160-92e5-bc56fe5781d5" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1540544817" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "df466324-c711-408a-9c41-57106454e24d" ,
"value" : "2d5b8b4a868cbb8947f869f789fef5ff"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1540544818" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "ae740bde-3aee-4fdf-8dae-fb41e1ecf2c2" ,
"value" : "532079b31e3acef2d71c75b31d77480304b2f7b9"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1540544819" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "2f95949f-0d9b-41f9-9737-30730cfc6e8f" ,
"value" : "d2a6cbe9acd4193188f7aa6d922c916999845da82171889526550790f5632b47"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1540544826" ,
"uuid" : "095999e8-cf65-4068-9aa8-111b4596ae64" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1540544834" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "9f46d30d-be05-4c45-be71-9d342e9a2fa1" ,
"value" : "2018-10-04T21:32:13"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1540544834" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5d3c8f72-90a2-466d-82ae-de692d5e9523" ,
"value" : "https://www.virustotal.com/file/d2a6cbe9acd4193188f7aa6d922c916999845da82171889526550790f5632b47/analysis/1538688733/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1540544835" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "4d7c5d08-44bb-456b-8b95-19a3c5f79d4c" ,
"value" : "28/60"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1540544835" ,
"uuid" : "01689a22-9fef-4b84-bc15-84a951d19e66" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1540544835" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "789b0449-1bb1-4388-8cda-eecdcc7f1e91" ,
"value" : "2ed45ea4f3b26adcc5eaa88b5234c997"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1540544836" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "c9cef300-9236-4344-ae2e-25ce759a513b" ,
"value" : "2e47c816a517548a0fbf809324d63868708d00d0"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1540544837" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "1e920e36-32ef-47ff-a121-17daaaa4467a" ,
"value" : "ab9f1a59fcae8374282a39f244f164b58dbed4d16c37366bf2272c9509a7502e"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1540544837" ,
"uuid" : "2f933552-e105-4559-9ba2-4adb53dde71b" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1540544837" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "973e093c-1a25-4961-9a70-1047fb6be0e7" ,
"value" : "2018-10-04T21:31:07"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1540544838" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "8f0d0a5f-9323-4973-b32a-adaf4007fe08" ,
"value" : "https://www.virustotal.com/file/ab9f1a59fcae8374282a39f244f164b58dbed4d16c37366bf2272c9509a7502e/analysis/1538688667/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1540544838" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "2367705e-c040-48af-8d75-755949bfadf7" ,
"value" : "30/60"
}
]
}
2023-04-21 13:25:09 +00:00
]
2023-12-14 14:30:15 +00:00
}
2023-04-21 13:25:09 +00:00
}
