2023-04-21 13:25:09 +00:00
|
|
|
{
|
|
|
|
|
"Event": {
|
|
|
|
|
"analysis": "0",
|
|
|
|
|
"date": "2017-01-13",
|
|
|
|
|
"extends_uuid": "",
|
|
|
|
|
"info": "OSINT - shadow-brokers-windows",
|
|
|
|
|
"publish_timestamp": "1484313915",
|
|
|
|
|
"published": true,
|
|
|
|
|
"threat_level_id": "3",
|
|
|
|
|
"timestamp": "1484292745",
|
|
|
|
|
"uuid": "58787bf0-bf68-41ce-b679-457a950d210f",
|
|
|
|
|
"Orgc": {
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
|
|
|
},
|
|
|
|
|
"Tag": [
|
|
|
|
|
{
|
|
|
|
|
"colour": "#ffffff",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "tlp:white",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#11d000",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "admiralty-scale:information-credibility=\"3\"",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#00497f",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "osint:source-type=\"source-code-repository\"",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#0088cc",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "misp-galaxy:threat-actor=\"Equation Group\"",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291105",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58787c21-0e9c-43ea-af81-404a950d210f",
|
|
|
|
|
"value": "https://github.com/shadowbrokers2017/shadow-brokers-windows"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291311",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cef-1840-4808-b22c-4b27950d210f",
|
|
|
|
|
"value": "DoubleFeatureDll.dll.unfinalized|515374423b8b132258bd91acf6f29168dcc267a3f45ecb9d1fe18ee3a253195b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291313",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cf1-df0c-4e97-8d54-48d4950d210f",
|
|
|
|
|
"value": "DuplicateToken_Implant.dll|94c4733eebf19013df3b42d76c11ed5d153a56bdab57e1c748e07cc7da38f3ba"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291314",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cf2-8780-42dc-b391-45d4950d210f",
|
|
|
|
|
"value": "DuplicateToken_Lp.dll|694be2698bcc5c7a1cce11f8ef65c1c96a883d14b98148c36b32888fb58b6a7e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291316",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cf4-02e4-41ee-b176-4b1b950d210f",
|
|
|
|
|
"value": "DXGHLP16.SYS|fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291318",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cf6-2c3c-4e4c-ba6b-41db950d210f",
|
|
|
|
|
"value": "EventLogEdit_Implant.dll|0bb750195fbd93d174c2a8e20bcbcae4efefc881f7961fdca8fa6ebd68ac1edf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cf7-c69c-4484-b1fa-42f0950d210f",
|
|
|
|
|
"value": "EventLogEdit_Lp.dll|73d1d55493886639c619e9f5e312daab93e4feeb74f24dbe51593842baac8d15"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291321",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cf9-2240-497e-9dee-44d1950d210f",
|
|
|
|
|
"value": "GetAdmin_Implant.dll|c8b354793ad5a16744cf1d4efdc5fe48d5a0cf0657974eb7145e0088fcf609ff"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cfa-28a4-41f7-a0d8-417f950d210f",
|
|
|
|
|
"value": "GetAdmin_Lp.dll|e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cfb-2cf8-447d-ba73-41d4950d210f",
|
|
|
|
|
"value": "kill_Implant9x.dll|53ecd7b9879f12d17c88089fcf796c85ca29ea4639e34b8ca96819517c2a059a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291325",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cfd-1064-420f-b3a5-424c950d210f",
|
|
|
|
|
"value": "kill_Implant.dll|c3d8ffbb4ecdf6486da175e5381e855d8224acd339199c1057846bd5b74badac"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291326",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cfe-deb4-43ce-80c7-4624950d210f",
|
|
|
|
|
"value": "LSADUMP_Implant.dll|5f06ec411f127f23add9f897dc165eaa68cbe8bb99da8f00a4a360f108bb8741"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291327",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787cff-af20-43ce-bf8c-4299950d210f",
|
|
|
|
|
"value": "LSADUMP_Lp.dll|c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291329",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d01-6744-4a7c-9fa6-4d70950d210f",
|
|
|
|
|
"value": "modifyAudit_Implant.dll|b7902809a15c4c3864a14f009768693c66f9e9234204b873d29a87f4c3009a50"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291330",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d02-7a2c-41af-8514-43e8950d210f",
|
|
|
|
|
"value": "modifyAudit_Lp.dll|2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291331",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d03-78a8-46b3-99d0-4eb1950d210f",
|
|
|
|
|
"value": "modifyAuthentication_Implant.dll|e1dff24af5bfc991dca21b4e3a19ffbc069176d674179eef691afc6b1ac6f805"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291333",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d05-0b8c-487f-a26f-408b950d210f",
|
|
|
|
|
"value": "modifyAuthentication_Lp.dll|8f5b97124de9fce16e2cfecb7dd2e171824c9e07546db7b3bee7c5f2c92ceda9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291335",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d07-7cec-4d48-9a21-4a22950d210f",
|
|
|
|
|
"value": "ModifyGroup_Implant.dll|d382e598544a739dd17b407466a536070203cbe375c56c54792b6d0eded678cd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291336",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d08-5c20-4b2f-868b-418f950d210f",
|
|
|
|
|
"value": "ModifyGroup_Lp.dll|dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291338",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d0a-3430-4faa-8eb2-4a62950d210f",
|
|
|
|
|
"value": "ModifyPrivilege_Implant.dll|104c466732154ec25eb8b81efa88c74cec0a5baeaba76f6fd6eaa30c285c212b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291339",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d0b-3a00-487b-a2f3-492f950d210f",
|
|
|
|
|
"value": "ModifyPrivilege_Lp.dll|d92928a867a685274b0a74ec55c0b83690fca989699310179e184e2787d47f48"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291340",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d0c-8fcc-4d1b-844c-4615950d210f",
|
|
|
|
|
"value": "msgkd.ex_|25eec68fc9f0d8d1b5d72c9eae7bee29035918e9dcbeab13e276dec4b2ad2a56"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291342",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d0e-6c98-416e-ac56-4d09950d210f",
|
|
|
|
|
"value": "msgki.ex_|9191e9bc8b64af9545b0e6e2ac022ad20b7905a6b327f768d822ff62233f3726"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291343",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d0f-19a8-4852-b312-4207950d210f",
|
|
|
|
|
"value": "msgks.ex_|7b4986aee8f5c4dca255431902907b36408f528f6c0f7d7fa21f079fa0a42e09"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291345",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d11-9aa0-4da0-a855-4839950d210f",
|
|
|
|
|
"value": "msgku.ex_|ef906b8a8ad9dca7407e0a467b32d7f7cf32814210964be2bfb5b0e6d2ca1998"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291346",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d12-17d4-49f4-8697-46ba950d210f",
|
|
|
|
|
"value": "mssld.dll|69dcc150468f7707cc8ef618a4cea4643a817171babfba9290395ada9611c63c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291348",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d14-cdf8-4b85-bc44-412b950d210f",
|
|
|
|
|
"value": "msslu.dll|9022a6ece80e75a58a7e41b44aa27497ea3f8e4713c0af5e0887d60cde1fe3ba"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291349",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d15-fc70-4639-ba02-4adb950d210f",
|
|
|
|
|
"value": "mstcp32.sys|26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291351",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d17-9d70-48be-aab3-47f2950d210f",
|
|
|
|
|
"value": "nethide_Implant.dll|b2daf9058fdc5e2affd5a409aebb90343ddde4239331d3de8edabeafdb3a48fa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d18-8bc8-48de-850e-4a53950d210f",
|
|
|
|
|
"value": "nethide_Lp.dll|137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291354",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d1a-af18-497b-b4ac-4d2e950d210f",
|
|
|
|
|
"value": "ntevt.sys|45e5e1ea3456d7852f5c610c7f4447776b9f15b56df7e3a53d57996123e0cebf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291355",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d1b-c370-40f0-97d2-46fc950d210f",
|
|
|
|
|
"value": "ntevtx64.sys|4254ee5e688fc09bdc72bcc9c51b1524a2bb25a9fb841feaf03bc7ec1a9975bf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d1d-5a74-4a67-a4bc-4e1b950d210f",
|
|
|
|
|
"value": "ntfltmgr.sys|f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d1e-7ba4-4e30-8811-40a2950d210f",
|
|
|
|
|
"value": "PassFreely_Implant.dll|c68f420b5a5e085a508a2529ac001284a255090920a0236df1b5656d010966e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291360",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d20-f544-4fed-98a7-4e55950d210f",
|
|
|
|
|
"value": "PassFreely_Lp.dll|fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291361",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d21-9564-4aae-a379-4860950d210f",
|
|
|
|
|
"value": "PC_Legacy_dll|0cbc5cc2e24f25cb645fb57d6088bcfb893f9eb9f27f8851503a1b33378ff22d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291363",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d23-9a1c-45ff-a685-46f6950d210f",
|
|
|
|
|
"value": "PC_Level3_dll|e44fe9432c5e11b51660efc37bf9b553260ad4130651a604ad11ca784d7f9238"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291365",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d25-bb74-4b92-b069-4b06950d210f",
|
|
|
|
|
"value": "PC_Level3_dll_x64|339855618fb3ef53987b8c14a61bd4519b2616e766149e0c21cbd7cbe7a632c9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291366",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d26-3278-4a2c-82f0-4359950d210f",
|
|
|
|
|
"value": "PC_Level3_flav_dll|412efa09d71223208f3d24a661b8539d98aad6b61157707e865e288a96cda806"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291368",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d28-3834-4ecd-b157-4c6e950d210f",
|
|
|
|
|
"value": "PC_Level3_flav_dll_x64|7352bece317e6e6896d7667faa2b38bb4f1a38112821567136d60369a91bcbef"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291369",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d29-6b6c-434a-8459-4ffc950d210f",
|
|
|
|
|
"value": "PC_Level3_http_dll|4ebfc1f6ec6a0e68e47e5b231331470a4483184cf715a578191b91ba7c32094d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291371",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d2b-8b10-4e7b-af3d-4cca950d210f",
|
|
|
|
|
"value": "PC_Level3_http_dll_x64|fb693eb9612d5e039a7a0fc5a183d0407cc2bce5617e7e22d2bd56caa5191e5f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291372",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d2c-8af0-49a1-97a4-4b65950d210f",
|
|
|
|
|
"value": "PC_Level3_http_flav_dll|27972d636b05a794d17cb3203d537bcf7c379fafd1802792e7fb8e72f130a0c4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291374",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d2e-5b14-4fb9-8e6b-4944950d210f",
|
|
|
|
|
"value": "PC_Level3_http_flav_dll_x64|4e0209b4f5990148f5d6dee47dbc7021bf78a782b85cef4d6c8be22d698b884f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291375",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d2f-d128-4ee1-bd14-4578950d210f",
|
|
|
|
|
"value": "PC_Level4_flav_dll|227faeb770ba538fb85692b3dfcd00f76a0a5205d1594bd0969a1e535ee90ee1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291377",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d31-0cb0-4217-b2e4-49c5950d210f",
|
|
|
|
|
"value": "PC_Level4_flav_dll_x64|25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291378",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d32-0bf4-4850-b515-4064950d210f",
|
|
|
|
|
"value": "PC_Level4_flav_exe|33ba9f103186b6e52d8d69499512e7fbac9096e7c5278838127488acc3b669a9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291380",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d34-28fc-443e-aee5-4a38950d210f",
|
|
|
|
|
"value": "PC_Level4_http_flav_dll|0df9d223d6bf3e1c4ba8fec7522dceb63902d1f9ddd7c26da1560da54dce2f3b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291381",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d35-0168-4be6-9a14-4357950d210f",
|
|
|
|
|
"value": "PC_Level4_http_flav_dll_x64|7a6488dd13936e505ec738dcc84b9fec57a5e46aab8aff59b8cfad8f599ea86a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291382",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d36-d77c-4824-ab55-433d950d210f",
|
|
|
|
|
"value": "PortMap_Implant.dll|964762416840738b1235ed4ae479a4b117b8cdcc762a6737e83bc2062c0cf236"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291384",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d38-6d48-4ad2-a76c-4a33950d210f",
|
|
|
|
|
"value": "PortMap_Lp.dll|2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291386",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d3a-8af4-4e81-a294-4358950d210f",
|
|
|
|
|
"value": "ProcessHide_Implant.dll|28a9a86f0f0a3cc4383c9f6632ee0129309afe4102d0cee1a110702a95dc0022"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291387",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d3b-bd94-4023-80f0-4219950d210f",
|
|
|
|
|
"value": "ProcessHide_Lp.dll|cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291388",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d3c-62a0-4ee3-a4ae-45ac950d210f",
|
|
|
|
|
"value": "processinfo_Implant9x.dll|00f782e2d4b901f0d860c3da00e154d5f0ccaf2fe758c61a27b1c0a85a927a34"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d3e-23cc-4710-9f77-4e48950d210f",
|
|
|
|
|
"value": "processinfo_Implant.dll|aadfa0b1aec4456b10e4fb82f5cfa918dbf4e87d19a02bcc576ac499dda0fb68"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d3f-0ec0-49c4-b00a-400b950d210f",
|
|
|
|
|
"value": "ProcessOptions_Implant.dll|03f22bf2f33d1032959ca68aad78ccecc201a4e5f07f446f9d1284a60fbe3361"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291393",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d41-a160-4726-847f-4dbf950d210f",
|
|
|
|
|
"value": "ProcessOptions_Lp.dll|31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d42-3b90-4e23-942a-4664950d210f",
|
|
|
|
|
"value": "pwdump_Implant.dll|dfd5768a4825d1c7329c2e262fde27e2b3d9c810653585b058fcf9efa9815964"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d44-585c-42ce-984b-425f950d210f",
|
|
|
|
|
"value": "pwdump_Lp.dll|fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d45-fc2c-4518-bd56-42d9950d210f",
|
|
|
|
|
"value": "RunAsChild_Implant.dll|7d51e97251917d5def89d77aa318f82603548afc8bde906efc1b445a47585c7b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291399",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d47-cd9c-4ff4-978f-4222950d210f",
|
|
|
|
|
"value": "RunAsChild_Lp.dll|1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291400",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "58787d48-83cc-4a3c-8f72-47ff950d210f",
|
|
|
|
|
"value": "tdi6.sys|12c082f74c0916a0e926488642236de3a12072a18d29c97bead15bb301f4b3f8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291457",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d81-edc8-4075-91cc-493e950d210f",
|
|
|
|
|
"value": "DoubleFeatureDll.dll.unfinalized|c53e46d77ff1293940344ce10d930355bfea57a1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291459",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d83-9704-478d-b6d2-49ef950d210f",
|
|
|
|
|
"value": "DuplicateToken_Implant.dll|d0741be473aad45e74c92af6cc27920be00eaf1e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291460",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d84-59d8-4390-a260-4c5f950d210f",
|
|
|
|
|
"value": "DuplicateToken_Lp.dll|a98c5a6fccca1c2e622c426c88cf9983fc4d497b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291462",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d86-1c50-45ee-82ef-4726950d210f",
|
|
|
|
|
"value": "DXGHLP16.SYS|99244fa9fbab44c896a89e58d64ef57ad3ec8833"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291463",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d87-d138-47d6-9191-4eeb950d210f",
|
|
|
|
|
"value": "EventLogEdit_Implant.dll|2f7e8262aa8cdf4c805895bbf8071540f97c5343"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291465",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d89-0ee8-437d-a6db-412f950d210f",
|
|
|
|
|
"value": "EventLogEdit_Lp.dll|3b2d0abe170efe1d7ec9a6675c731d92968c165e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291466",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d8a-1f4c-436d-bff0-4304950d210f",
|
|
|
|
|
"value": "GetAdmin_Implant.dll|d02c6d88db9828b44b0148f96b8407f7b238f844"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291468",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d8c-7b78-4eee-bcc1-40f4950d210f",
|
|
|
|
|
"value": "GetAdmin_Lp.dll|ce21c2bc0097bb1b6dc128421af5a2b838c11771"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291469",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d8d-dcdc-43f1-9401-4ac8950d210f",
|
|
|
|
|
"value": "kill_Implant9x.dll|2c044ecb4b18f13c2c7ea259bb1942da2347ec02"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291471",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d8f-8610-4bef-b58f-4d0a950d210f",
|
|
|
|
|
"value": "kill_Implant.dll|8180e2945687920e76a691a89ab3aa8cf7b5e379"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291472",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d90-1980-4156-a722-47e0950d210f",
|
|
|
|
|
"value": "LSADUMP_Implant.dll|7d25e03171dd3852d4283ecab7824845fe68c2dc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291474",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d92-d29c-4755-901f-4a2b950d210f",
|
|
|
|
|
"value": "LSADUMP_Lp.dll|b415a5d0092395a5795e6f86b7dc2568cfac69b1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291475",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d93-5fbc-4138-90fe-46e5950d210f",
|
|
|
|
|
"value": "modifyAudit_Implant.dll|bf535071da4d99d92c62702d99d260961ac675cd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291477",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d95-97d8-4eae-91f6-4483950d210f",
|
|
|
|
|
"value": "modifyAudit_Lp.dll|58bd1d927094737cbd03b03a5aa9e971fa68a17a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291478",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d96-e274-4f35-bc9c-4c84950d210f",
|
|
|
|
|
"value": "modifyAuthentication_Implant.dll|91fd653da569240f5affeab496134c497bd16030"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291480",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d98-da98-4038-9acd-4e0a950d210f",
|
|
|
|
|
"value": "modifyAuthentication_Lp.dll|af93d04155377f06ed5c47959e4c74b68e1f11f4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291481",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d99-3ab0-4191-b330-40eb950d210f",
|
|
|
|
|
"value": "ModifyGroup_Implant.dll|698b3db33fac7937803721253a58840a5ec778d8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291482",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d9a-0ac4-4ae1-991c-4fba950d210f",
|
|
|
|
|
"value": "ModifyGroup_Lp.dll|68f0b95c2d5d1d9ea8e14a6659432c8cd38b5534"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291484",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d9c-fcb4-4fea-8e16-45d1950d210f",
|
|
|
|
|
"value": "ModifyPrivilege_Implant.dll|4f8e2729aa82454a460405135430a990a798c93b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291485",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d9d-6edc-4ff8-859a-4300950d210f",
|
|
|
|
|
"value": "ModifyPrivilege_Lp.dll|67a28adba8d6454463d469bc5c1b82a069fd0320"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291487",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787d9f-a9fc-4687-b2cd-42da950d210f",
|
|
|
|
|
"value": "msgkd.ex_|d200eeafa2ad7c0674f003d3bdc42b27abfb16e0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291488",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787da0-6bc0-4bc7-add8-4e4a950d210f",
|
|
|
|
|
"value": "msgki.ex_|a489966dddc9941d00c7a6e31675ff9cd67c911d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291489",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787da1-3bbc-4b34-9632-4cf1950d210f",
|
|
|
|
|
"value": "msgks.ex_|f2cdb7878c4b56e7137345b87edf89b142863ecc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291491",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787da3-9494-4e4a-8284-434c950d210f",
|
|
|
|
|
"value": "msgku.ex_|76d69713f79b475d58925a74d33ededb56703d0a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291492",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787da4-fb4c-40aa-94f5-4e0a950d210f",
|
|
|
|
|
"value": "mssld.dll|3fec5724f67e76d0864d407e9e3687b4ad85f2cd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291494",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787da6-18b4-4cc3-8e1c-471a950d210f",
|
|
|
|
|
"value": "msslu.dll|d7c26a63b4c2d7677c5938c3ddd09249a35da32b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291495",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787da7-6054-4dcb-88e6-4f06950d210f",
|
|
|
|
|
"value": "mstcp32.sys|26e787997a338d8111d96c9a4c103cf8ff0201ce"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291497",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787da9-9274-4778-a13c-43d4950d210f",
|
|
|
|
|
"value": "nethide_Implant.dll|805a0e34b76231625cccf9f61f021cf6febbdcc0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291498",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787daa-10c0-4316-b25d-4dfb950d210f",
|
|
|
|
|
"value": "nethide_Lp.dll|f83c07663f5e72a81a18c0e8da6a265d6d96b050"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291499",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dab-50e4-495f-a40d-4d9d950d210f",
|
|
|
|
|
"value": "ntevt.sys|ada66fa6f56bbb75f52b704078705d722db2adf7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291501",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dad-f98c-4438-8c1c-4ef7950d210f",
|
|
|
|
|
"value": "ntevtx64.sys|a86fa83d589dbc730c0a963b6aec9fccb6662d23"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291502",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dae-dd7c-411c-8500-4d1b950d210f",
|
|
|
|
|
"value": "ntfltmgr.sys|21fb290118943b97555f7b90c30603cf8c4f8b41"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291504",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787db0-9084-4d1e-96c9-40b4950d210f",
|
|
|
|
|
"value": "PassFreely_Implant.dll|b54b96345fb893dead150ec9bcc408c7d71331b6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291505",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787db1-339c-4457-a3fb-4cbb950d210f",
|
|
|
|
|
"value": "PassFreely_Lp.dll|4099f10dad59b8fe49e248e90072e26da998085e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291507",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787db3-2c5c-4b3c-8847-4b9e950d210f",
|
|
|
|
|
"value": "PC_Legacy_dll|9635dd3a41eb58c30180afb1ec94c72929b0837e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291508",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787db4-f2a8-4a27-981d-459a950d210f",
|
|
|
|
|
"value": "PC_Level3_dll|183285faa67d75b63469cf0082a33196a73799eb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787db5-4cbc-43ef-9bef-41e7950d210f",
|
|
|
|
|
"value": "PC_Level3_dll_x64|ee1c1b31a2e4098dd49fa6fecd85bb296151f275"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787db7-e460-4f38-b687-4caf950d210f",
|
|
|
|
|
"value": "PC_Level3_flav_dll|407e5ff021877f4dedf95b51050738f89b448904"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291513",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787db9-2834-4016-bbb9-44d6950d210f",
|
|
|
|
|
"value": "PC_Level3_flav_dll_x64|e71591fff218e5f1e32f891983efef31fa1d1f9d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291514",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dba-87dc-44a4-8849-40de950d210f",
|
|
|
|
|
"value": "PC_Level3_http_dll|4b2e190b472d110ba1f9d45e76fae2c3a98cc7b9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291516",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dbc-8228-47cc-b2b7-45dc950d210f",
|
|
|
|
|
"value": "PC_Level3_http_dll_x64|dbfab7c040fd812bdce7533eb41ef40a0719e940"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291517",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dbd-f264-4b27-aecd-4ff2950d210f",
|
|
|
|
|
"value": "PC_Level3_http_flav_dll|ea7e1ae365f2c4f0430990f1deda230dbdd7f324"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291519",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dbf-e858-4031-b347-491a950d210f",
|
|
|
|
|
"value": "PC_Level3_http_flav_dll_x64|3160d8781cd22a4eacad42c17777948e5f2b7a40"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291520",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dc0-fdd8-4b99-8f26-4205950d210f",
|
|
|
|
|
"value": "PC_Level4_flav_dll|fafdbc45f9d91dbe603755e77652e2f26aa74ddf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291521",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dc1-78b8-447b-9148-46d9950d210f",
|
|
|
|
|
"value": "PC_Level4_flav_dll_x64|0a74f4bbefa8784d82bb4d7f70cc762d059ed282"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291523",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dc3-159c-449d-a8e5-416b950d210f",
|
|
|
|
|
"value": "PC_Level4_flav_exe|0b9ba306c6861f990d6219dbd815cc2e25262061"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291524",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dc4-3e38-4baf-9846-4c15950d210f",
|
|
|
|
|
"value": "PC_Level4_http_flav_dll|7df59549f0b94a4d8fb7079d7f5e792863e72a79"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291526",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dc6-fbb0-4454-b0f9-49e1950d210f",
|
|
|
|
|
"value": "PC_Level4_http_flav_dll_x64|c11c5c9faac8c04c7f3155799f9d78407a4cf793"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291528",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dc8-0514-4d3c-ba52-45cc950d210f",
|
|
|
|
|
"value": "PortMap_Implant.dll|c739a883197642b32074f03fb4454a99ec8bb31f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dc9-98ac-442f-871a-479a950d210f",
|
|
|
|
|
"value": "PortMap_Lp.dll|fae0ba5eb512461b307118a8f63ea4cd626af182"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291531",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dcb-00ec-4036-8f66-4d4c950d210f",
|
|
|
|
|
"value": "ProcessHide_Implant.dll|920439ce68fe1e234ae90165e00e8aa02ab76e06"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291532",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dcc-4db0-4dac-a05a-40de950d210f",
|
|
|
|
|
"value": "ProcessHide_Lp.dll|f6f31c39bdec2e313c7dd686f31e142b9430643d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291534",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dce-0844-402b-9ee5-4015950d210f",
|
|
|
|
|
"value": "processinfo_Implant9x.dll|f98735393d6cf47deed940e7fc4b663523b033ab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291535",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dcf-0600-45c7-9a92-4150950d210f",
|
|
|
|
|
"value": "processinfo_Implant.dll|3671a43edecd1c4cd04dc43d3630fe7f64ae7cf5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291536",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dd0-9bd8-4778-ba6c-4151950d210f",
|
|
|
|
|
"value": "ProcessOptions_Implant.dll|b0146f5d8e12585220b070dd24f0ece55a8c457f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291538",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dd2-7744-4c66-93a0-47dc950d210f",
|
|
|
|
|
"value": "ProcessOptions_Lp.dll|a885c20e1e177ce03e9815b5356c8369659648c0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291540",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dd4-3f48-4b97-8a7b-4ef3950d210f",
|
|
|
|
|
"value": "pwdump_Implant.dll|8252f8dea7dd7e6d88029f7fd3b7093f43cbd927"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291541",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dd5-7ce4-48ac-92e7-41a6950d210f",
|
|
|
|
|
"value": "pwdump_Lp.dll|e270394943929a932d08fd11b6e372432f8cb84b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291543",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dd7-7564-4d05-bb51-447c950d210f",
|
|
|
|
|
"value": "RunAsChild_Implant.dll|c71f6d2a0f5380d95c68e6ff72a1c6d2d1133286"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291544",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dd8-1e78-4bfe-b976-4d32950d210f",
|
|
|
|
|
"value": "RunAsChild_Lp.dll|fad53d58adcf4194ba71affe8f7588999a4a24af"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291546",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "58787dda-5594-47b3-ba73-41be950d210f",
|
|
|
|
|
"value": "tdi6.sys|8f9d7787ff05b6b393f8a5484701f78e886dcf53"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e14-ce3c-4fe3-b452-40e7950d210f",
|
|
|
|
|
"value": "DoubleFeatureDll.dll.unfinalized|61110bea272972903985d5d5e452802c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291606",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e16-31ac-48cb-a77e-4123950d210f",
|
|
|
|
|
"value": "DuplicateToken_Implant.dll|997ba8c988340a1c644cf9a5f67e4177"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291607",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e17-744c-4eb0-9081-4db6950d210f",
|
|
|
|
|
"value": "DuplicateToken_Lp.dll|a33f13f57ab2ce36a29796996c5e58e4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e19-1d88-4aca-b963-4222950d210f",
|
|
|
|
|
"value": "DXGHLP16.SYS|4a184a987d297e6b1d578d5c25a4980c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e1a-4b24-4035-a71e-4454950d210f",
|
|
|
|
|
"value": "EventLogEdit_Implant.dll|425fb612ba62fc1ecad9fb24d10f9bfa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291612",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e1c-ba78-4f7b-a93c-41c5950d210f",
|
|
|
|
|
"value": "EventLogEdit_Lp.dll|2b8d4a2f9e28f4fb84cbecdfa7858e43"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291613",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e1d-4b38-4df6-ba8f-4a89950d210f",
|
|
|
|
|
"value": "GetAdmin_Implant.dll|c11142caa3013f852ccb698cc6008b51"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291615",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e1f-c1cc-4463-beff-41aa950d210f",
|
|
|
|
|
"value": "GetAdmin_Lp.dll|a5d04eada9c99ea2d110ce5d4bfa1d21"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291617",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e21-7e14-49b5-8e3e-4f3c950d210f",
|
|
|
|
|
"value": "kill_Implant9x.dll|b10035b584fd0aa353ff05f3998546f0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291618",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e22-5fd4-4ee4-b452-4754950d210f",
|
|
|
|
|
"value": "kill_Implant.dll|bdd2b462e050ef2fa7778526ea4a2a58"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291620",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e24-61f0-41a8-b063-48f8950d210f",
|
|
|
|
|
"value": "LSADUMP_Implant.dll|199796e3f413074d5fdef7fe8334eccf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291622",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e26-fee0-459b-8f5f-41f7950d210f",
|
|
|
|
|
"value": "LSADUMP_Lp.dll|530edfca04227e4a0abe2ea6aa0d372a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291623",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e27-ea70-425a-9986-49ba950d210f",
|
|
|
|
|
"value": "modifyAudit_Implant.dll|cf5b0d82d39669f584258389f4307b82"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291625",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e29-f1e0-48c5-9fc8-4ae9950d210f",
|
|
|
|
|
"value": "modifyAudit_Lp.dll|f9f26a2ee950abc1cd4e768dd03a0671"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291626",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e2a-88cc-41c1-ba63-44ef950d210f",
|
|
|
|
|
"value": "modifyAuthentication_Implant.dll|8187650eb74ccb3f0fb647335fd54d30"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291628",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e2c-5838-4aa2-8a81-4ca6950d210f",
|
|
|
|
|
"value": "modifyAuthentication_Lp.dll|09445eebba047f25e36fed573d0db4fc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291629",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e2d-5864-4bbe-a21f-4d6a950d210f",
|
|
|
|
|
"value": "ModifyGroup_Implant.dll|b46df0dbe9774125cdc6f3b2befee900"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291631",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e2f-639c-4d80-9088-40f4950d210f",
|
|
|
|
|
"value": "ModifyGroup_Lp.dll|a1923d73b0488e0ab174bf759580f7ef"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291632",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e30-a9fc-411e-be44-472c950d210f",
|
|
|
|
|
"value": "ModifyPrivilege_Implant.dll|fbd7816d2e3e36f8976e18dcf0301ce8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291634",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e32-ae80-457d-8a93-4bcb950d210f",
|
|
|
|
|
"value": "ModifyPrivilege_Lp.dll|0d5b61f7f515a3b7a9d5566b6f4a7be5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291635",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e33-31b0-4a3b-9f4a-4a07950d210f",
|
|
|
|
|
"value": "msgkd.ex_|ecb7174bafed0c53cdc1227e301cf003"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291636",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e34-976c-480e-b267-4c77950d210f",
|
|
|
|
|
"value": "msgki.ex_|2f0cd139c60ae484de4b076d34b8b39e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291638",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e36-1314-40ea-afe9-4d82950d210f",
|
|
|
|
|
"value": "msgks.ex_|9dab2f84eb817aab4ccf8c237f88b422"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291639",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e37-2250-4556-a1da-4659950d210f",
|
|
|
|
|
"value": "msgku.ex_|a54f0112500c956c21dc13285f43fc7e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291641",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e39-96cc-4180-a453-461c950d210f",
|
|
|
|
|
"value": "mssld.dll|88c6980345e31fb53df122348985c13d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291642",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e3a-07ac-41b4-8dd7-489e950d210f",
|
|
|
|
|
"value": "msslu.dll|d05a64df9a4aded3c5906764b2f69476"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291643",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e3b-4690-4183-9d56-48d7950d210f",
|
|
|
|
|
"value": "mstcp32.sys|74de13b5ea68b3da24addc009f84baee"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291645",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e3d-35c4-47a5-ba87-469f950d210f",
|
|
|
|
|
"value": "nethide_Implant.dll|1aea840c3ec3ebaeeebd20a6a8d7e03f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291646",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e3e-4194-494f-816b-417f950d210f",
|
|
|
|
|
"value": "nethide_Lp.dll|e8a2645855578188e57fccf74026aa6a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291648",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e40-8ddc-4862-a0f3-46d6950d210f",
|
|
|
|
|
"value": "ntevt.sys|48496c7db1c66656e054cccbc01930cc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291649",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e41-ab5c-44c9-a0a1-4d6d950d210f",
|
|
|
|
|
"value": "ntevtx64.sys|f9fdc58c2a3ea2c00d0caa3c33d6a575"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291650",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e42-9200-494e-a468-41b1950d210f",
|
|
|
|
|
"value": "ntfltmgr.sys|0d81f9972863c6d8c90100a73b0600ab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291652",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e44-f3f4-4d07-9e12-491e950d210f",
|
|
|
|
|
"value": "PassFreely_Implant.dll|13031e736ee4698b8c4813a8f2ae1848"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291653",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e45-8f9c-4484-9c0a-493d950d210f",
|
|
|
|
|
"value": "PassFreely_Lp.dll|3a63d2a31f60db565c61ee5307076980"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291655",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e47-656c-4ef4-a54f-43b8950d210f",
|
|
|
|
|
"value": "PC_Legacy_dll|b91c125ee67eccb5843000fd22be0935"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291656",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e48-66d4-4a07-89df-4b5a950d210f",
|
|
|
|
|
"value": "PC_Level3_dll|164f2f1132a8ae98a4ffa070eb2ac8ae"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291657",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e49-a440-455b-994e-4d20950d210f",
|
|
|
|
|
"value": "PC_Level3_dll_x64|22e03cff8f2f6bc56e61196fa98b19e1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291659",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e4b-0518-45ac-85bf-452c950d210f",
|
|
|
|
|
"value": "PC_Level3_flav_dll|d2effa60a83e6fc5533e6ba5a3c306d4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291660",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e4c-376c-4e48-a375-4ab5950d210f",
|
|
|
|
|
"value": "PC_Level3_flav_dll_x64|2ece5c84446a46f80bb7701ae922c8d7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291662",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e4e-615c-42b5-a785-4bbf950d210f",
|
|
|
|
|
"value": "PC_Level3_http_dll|6f55a9c081989468043c1e9887d45aea"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291663",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e4f-088c-4aee-a488-4806950d210f",
|
|
|
|
|
"value": "PC_Level3_http_dll_x64|2c6cee802cfe8a7489d4782b123ec7ca"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291665",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e51-1e38-41a1-869a-4815950d210f",
|
|
|
|
|
"value": "PC_Level3_http_flav_dll|42e2e64e897606eb936372a8ee616ab0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291666",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e52-8cc4-42ac-a58a-45b3950d210f",
|
|
|
|
|
"value": "PC_Level3_http_flav_dll_x64|d962749f06e24167c61e67a7c1bc1abd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291668",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e54-e130-4a6b-8347-4528950d210f",
|
|
|
|
|
"value": "PC_Level4_flav_dll|7a3e60615f2b3283fe95e80719e901a3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291669",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e55-d004-4aba-9d07-4680950d210f",
|
|
|
|
|
"value": "PC_Level4_flav_dll_x64|d093db7f175af28d6e7492918d38234f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e57-d830-4585-9242-454d950d210f",
|
|
|
|
|
"value": "PC_Level4_flav_exe|43406f7487979e55751d9f8a1174b33c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e58-5698-4727-8f2f-4d66950d210f",
|
|
|
|
|
"value": "PC_Level4_http_flav_dll|609f9d1b05d217e8b05feab6ebf6fc52"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e59-b44c-4838-844e-41f9950d210f",
|
|
|
|
|
"value": "PC_Level4_http_flav_dll_x64|fb97f8b8535de1e2cb7eac6177226cca"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291675",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e5b-f9b8-4e1a-be2b-4146950d210f",
|
|
|
|
|
"value": "PortMap_Implant.dll|eb6aece07b1a2e2dce95a1faa2657bf2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e5c-edb4-47e0-8cc8-4047950d210f",
|
|
|
|
|
"value": "PortMap_Lp.dll|4ae51c9701d8a910f37591cb45215ca5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291678",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e5e-4b30-4cf6-9171-486c950d210f",
|
|
|
|
|
"value": "ProcessHide_Implant.dll|0be1b2fa181721aff98b0bc05b814734"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291679",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e5f-8e7c-44ed-97d5-4f31950d210f",
|
|
|
|
|
"value": "ProcessHide_Lp.dll|a7bd6d21e3dded0f6342f170ce9613a7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291681",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e61-f848-4534-ba39-4a4a950d210f",
|
|
|
|
|
"value": "processinfo_Implant9x.dll|6042ea9707316784fbc77a8b450e0991"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291682",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e62-7004-4f53-a896-49f8950d210f",
|
|
|
|
|
"value": "processinfo_Implant.dll|0c93eee98a5a389ca7ac14064a2445b9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291684",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e64-45e8-4eca-916f-4c23950d210f",
|
|
|
|
|
"value": "ProcessOptions_Implant.dll|b3ecaf9399df17a5dcddb45e9556beff"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291685",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e65-3a94-43a9-a373-490a950d210f",
|
|
|
|
|
"value": "ProcessOptions_Lp.dll|aea3434d75fb81373ff275006686043c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291687",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e67-9a74-4977-b276-488b950d210f",
|
|
|
|
|
"value": "pwdump_Implant.dll|dec51cf04be82ed22948a3275ef541f9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291688",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e68-5158-47ab-8019-4ea2950d210f",
|
|
|
|
|
"value": "pwdump_Lp.dll|6d8454150934d75fd0506f1d5a2d227f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291689",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e69-ac70-44f2-b31c-4fb0950d210f",
|
|
|
|
|
"value": "RunAsChild_Implant.dll|ba1711b9cd87a10f2ad1816fb55c10b8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291691",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e6b-695c-4dda-822b-4305950d210f",
|
|
|
|
|
"value": "RunAsChild_Lp.dll|97e3baee87b396716f647fe41d03f218"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484291692",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "58787e6c-73d0-471b-81b8-4bfa950d210f",
|
|
|
|
|
"value": "tdi6.sys|e14ab6e6ae835792979ff50e647b89c8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 12c082f74c0916a0e926488642236de3a12072a18d29c97bead15bb301f4b3f8",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292745",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788289-7f48-463e-bc85-401c02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/12c082f74c0916a0e926488642236de3a12072a18d29c97bead15bb301f4b3f8/analysis/1484237932/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292745",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788289-f178-47e4-89b8-420f02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464/analysis/1484235970/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 7d51e97251917d5def89d77aa318f82603548afc8bde906efc1b445a47585c7b",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292746",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878828a-feb4-467a-a844-4f9c02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7d51e97251917d5def89d77aa318f82603548afc8bde906efc1b445a47585c7b/analysis/1484248912/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292747",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878828b-39d8-4995-9ede-468f02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5/analysis/1484236025/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: dfd5768a4825d1c7329c2e262fde27e2b3d9c810653585b058fcf9efa9815964",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292748",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878828c-35a4-4a20-84fe-4f2602de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/dfd5768a4825d1c7329c2e262fde27e2b3d9c810653585b058fcf9efa9815964/analysis/1484248910/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292748",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878828c-e328-49b6-a170-4d4102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a/analysis/1484290313/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 03f22bf2f33d1032959ca68aad78ccecc201a4e5f07f446f9d1284a60fbe3361",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292749",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878828d-00a4-4abf-a756-409102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/03f22bf2f33d1032959ca68aad78ccecc201a4e5f07f446f9d1284a60fbe3361/analysis/1484248908/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: aadfa0b1aec4456b10e4fb82f5cfa918dbf4e87d19a02bcc576ac499dda0fb68",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292750",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878828e-b350-47e1-be89-441d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/aadfa0b1aec4456b10e4fb82f5cfa918dbf4e87d19a02bcc576ac499dda0fb68/analysis/1484248906/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 00f782e2d4b901f0d860c3da00e154d5f0ccaf2fe758c61a27b1c0a85a927a34",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292751",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878828f-1f2c-49b2-9d4f-485502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/00f782e2d4b901f0d860c3da00e154d5f0ccaf2fe758c61a27b1c0a85a927a34/analysis/1484248907/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292751",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878828f-9b18-4683-8008-476e02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66/analysis/1484248905/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 28a9a86f0f0a3cc4383c9f6632ee0129309afe4102d0cee1a110702a95dc0022",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292752",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788290-cf10-4b30-bcfe-4f2f02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/28a9a86f0f0a3cc4383c9f6632ee0129309afe4102d0cee1a110702a95dc0022/analysis/1484291076/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292753",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788291-2130-4578-b7cd-4ac102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6/analysis/1484256258/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 964762416840738b1235ed4ae479a4b117b8cdcc762a6737e83bc2062c0cf236",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292753",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788291-4ce8-422b-a6ae-47ae02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/964762416840738b1235ed4ae479a4b117b8cdcc762a6737e83bc2062c0cf236/analysis/1484239672/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 7a6488dd13936e505ec738dcc84b9fec57a5e46aab8aff59b8cfad8f599ea86a",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292754",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788292-33f0-4130-a0e6-4f5c02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7a6488dd13936e505ec738dcc84b9fec57a5e46aab8aff59b8cfad8f599ea86a/analysis/1484248901/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 0df9d223d6bf3e1c4ba8fec7522dceb63902d1f9ddd7c26da1560da54dce2f3b",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292755",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788293-1444-4dff-bcaa-455e02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0df9d223d6bf3e1c4ba8fec7522dceb63902d1f9ddd7c26da1560da54dce2f3b/analysis/1484238342/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 33ba9f103186b6e52d8d69499512e7fbac9096e7c5278838127488acc3b669a9",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292756",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788294-491c-49c8-bf08-441902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/33ba9f103186b6e52d8d69499512e7fbac9096e7c5278838127488acc3b669a9/analysis/1484238360/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292756",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788294-a134-42da-8a3e-4f3a02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c/analysis/1484248899/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 227faeb770ba538fb85692b3dfcd00f76a0a5205d1594bd0969a1e535ee90ee1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292757",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788295-1bfc-419e-b0d4-4aed02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/227faeb770ba538fb85692b3dfcd00f76a0a5205d1594bd0969a1e535ee90ee1/analysis/1484248898/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 4e0209b4f5990148f5d6dee47dbc7021bf78a782b85cef4d6c8be22d698b884f",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292758",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788296-ef38-44c4-baab-4b4c02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4e0209b4f5990148f5d6dee47dbc7021bf78a782b85cef4d6c8be22d698b884f/analysis/1484248897/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 27972d636b05a794d17cb3203d537bcf7c379fafd1802792e7fb8e72f130a0c4",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292759",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788297-7790-49c2-8e67-419c02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/27972d636b05a794d17cb3203d537bcf7c379fafd1802792e7fb8e72f130a0c4/analysis/1484239323/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: fb693eb9612d5e039a7a0fc5a183d0407cc2bce5617e7e22d2bd56caa5191e5f",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292759",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788297-a9a8-4a84-b1d6-49bc02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/fb693eb9612d5e039a7a0fc5a183d0407cc2bce5617e7e22d2bd56caa5191e5f/analysis/1484248892/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 4ebfc1f6ec6a0e68e47e5b231331470a4483184cf715a578191b91ba7c32094d",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292760",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788298-9b7c-4e56-9c50-44c202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4ebfc1f6ec6a0e68e47e5b231331470a4483184cf715a578191b91ba7c32094d/analysis/1484248890/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 7352bece317e6e6896d7667faa2b38bb4f1a38112821567136d60369a91bcbef",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292761",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788299-2b04-46bd-a2d7-444302de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7352bece317e6e6896d7667faa2b38bb4f1a38112821567136d60369a91bcbef/analysis/1484248888/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 412efa09d71223208f3d24a661b8539d98aad6b61157707e865e288a96cda806",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292761",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "58788299-0ee4-474f-9048-4eb802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/412efa09d71223208f3d24a661b8539d98aad6b61157707e865e288a96cda806/analysis/1484248888/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 339855618fb3ef53987b8c14a61bd4519b2616e766149e0c21cbd7cbe7a632c9",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292762",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878829a-1df4-4960-afb2-499e02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/339855618fb3ef53987b8c14a61bd4519b2616e766149e0c21cbd7cbe7a632c9/analysis/1484248886/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: e44fe9432c5e11b51660efc37bf9b553260ad4130651a604ad11ca784d7f9238",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292763",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878829b-60d8-45f3-af61-4d2d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e44fe9432c5e11b51660efc37bf9b553260ad4130651a604ad11ca784d7f9238/analysis/1484248885/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 0cbc5cc2e24f25cb645fb57d6088bcfb893f9eb9f27f8851503a1b33378ff22d",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292764",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878829c-8b58-4c24-9907-495202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0cbc5cc2e24f25cb645fb57d6088bcfb893f9eb9f27f8851503a1b33378ff22d/analysis/1484248884/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292764",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878829c-f090-4bfc-99e9-4b2c02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb/analysis/1484239433/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: c68f420b5a5e085a508a2529ac001284a255090920a0236df1b5656d010966e8",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292765",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878829d-9e3c-4247-b728-442002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c68f420b5a5e085a508a2529ac001284a255090920a0236df1b5656d010966e8/analysis/1484248882/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292766",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878829e-a1fc-4ad9-a160-43d402de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5/analysis/1484248880/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 4254ee5e688fc09bdc72bcc9c51b1524a2bb25a9fb841feaf03bc7ec1a9975bf",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292767",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878829f-aa3c-42ed-9a0e-4a0702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4254ee5e688fc09bdc72bcc9c51b1524a2bb25a9fb841feaf03bc7ec1a9975bf/analysis/1484248879/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 45e5e1ea3456d7852f5c610c7f4447776b9f15b56df7e3a53d57996123e0cebf",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292767",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5878829f-7a1c-4f46-ae6d-49da02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/45e5e1ea3456d7852f5c610c7f4447776b9f15b56df7e3a53d57996123e0cebf/analysis/1484238600/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292768",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a0-1510-434a-9541-427102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d/analysis/1484248877/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: b2daf9058fdc5e2affd5a409aebb90343ddde4239331d3de8edabeafdb3a48fa",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292769",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a1-b54c-45f6-b553-412802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b2daf9058fdc5e2affd5a409aebb90343ddde4239331d3de8edabeafdb3a48fa/analysis/1484248876/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292770",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a2-c1a8-4b88-9894-4e4e02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6/analysis/1484232443/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 9022a6ece80e75a58a7e41b44aa27497ea3f8e4713c0af5e0887d60cde1fe3ba",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292770",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a2-c758-4569-865a-4c2902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9022a6ece80e75a58a7e41b44aa27497ea3f8e4713c0af5e0887d60cde1fe3ba/analysis/1484248874/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 69dcc150468f7707cc8ef618a4cea4643a817171babfba9290395ada9611c63c",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292771",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a3-646c-4d26-ab34-4eeb02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/69dcc150468f7707cc8ef618a4cea4643a817171babfba9290395ada9611c63c/analysis/1484248873/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: ef906b8a8ad9dca7407e0a467b32d7f7cf32814210964be2bfb5b0e6d2ca1998",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292772",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a4-a00c-4be4-8796-4a9702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/ef906b8a8ad9dca7407e0a467b32d7f7cf32814210964be2bfb5b0e6d2ca1998/analysis/1484239546/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 7b4986aee8f5c4dca255431902907b36408f528f6c0f7d7fa21f079fa0a42e09",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292773",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a5-e214-4a3f-b2d7-426c02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7b4986aee8f5c4dca255431902907b36408f528f6c0f7d7fa21f079fa0a42e09/analysis/1484248871/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 9191e9bc8b64af9545b0e6e2ac022ad20b7905a6b327f768d822ff62233f3726",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292773",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a5-2c20-4859-856e-4d6002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9191e9bc8b64af9545b0e6e2ac022ad20b7905a6b327f768d822ff62233f3726/analysis/1484248870/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 25eec68fc9f0d8d1b5d72c9eae7bee29035918e9dcbeab13e276dec4b2ad2a56",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292774",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a6-2dd8-4602-af38-460d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/25eec68fc9f0d8d1b5d72c9eae7bee29035918e9dcbeab13e276dec4b2ad2a56/analysis/1484248868/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: d92928a867a685274b0a74ec55c0b83690fca989699310179e184e2787d47f48",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292775",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a7-da70-41b9-89c3-454302de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/d92928a867a685274b0a74ec55c0b83690fca989699310179e184e2787d47f48/analysis/1484238779/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 104c466732154ec25eb8b81efa88c74cec0a5baeaba76f6fd6eaa30c285c212b",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292776",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a8-1678-4f4d-a681-416a02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/104c466732154ec25eb8b81efa88c74cec0a5baeaba76f6fd6eaa30c285c212b/analysis/1484248866/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292776",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a8-ba4c-496f-8f64-412602de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520/analysis/1484248866/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: d382e598544a739dd17b407466a536070203cbe375c56c54792b6d0eded678cd",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292777",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882a9-5834-4f38-9a23-402002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/d382e598544a739dd17b407466a536070203cbe375c56c54792b6d0eded678cd/analysis/1484248864/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 8f5b97124de9fce16e2cfecb7dd2e171824c9e07546db7b3bee7c5f2c92ceda9",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292778",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882aa-b0cc-45f5-9b81-41aa02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/8f5b97124de9fce16e2cfecb7dd2e171824c9e07546db7b3bee7c5f2c92ceda9/analysis/1484248863/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: e1dff24af5bfc991dca21b4e3a19ffbc069176d674179eef691afc6b1ac6f805",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292778",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882aa-dd68-4b82-82a0-441302de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e1dff24af5bfc991dca21b4e3a19ffbc069176d674179eef691afc6b1ac6f805/analysis/1484248859/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292779",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882ab-6b84-4d91-8cc2-4e4c02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad/analysis/1484248858/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: b7902809a15c4c3864a14f009768693c66f9e9234204b873d29a87f4c3009a50",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292780",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882ac-15a8-4135-9c7c-462002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b7902809a15c4c3864a14f009768693c66f9e9234204b873d29a87f4c3009a50/analysis/1484248857/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292781",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882ad-4b10-4945-a173-485002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194/analysis/1484248856/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 5f06ec411f127f23add9f897dc165eaa68cbe8bb99da8f00a4a360f108bb8741",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292782",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882ae-0914-4d43-b093-4bf102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5f06ec411f127f23add9f897dc165eaa68cbe8bb99da8f00a4a360f108bb8741/analysis/1484248854/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: c3d8ffbb4ecdf6486da175e5381e855d8224acd339199c1057846bd5b74badac",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292782",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882ae-a4b8-4a45-be25-4f6802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c3d8ffbb4ecdf6486da175e5381e855d8224acd339199c1057846bd5b74badac/analysis/1484235110/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292783",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882af-f4fc-46c9-9c69-462202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78/analysis/1484248853/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: c8b354793ad5a16744cf1d4efdc5fe48d5a0cf0657974eb7145e0088fcf609ff",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292784",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882b0-cdbc-47d9-bae9-45b002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c8b354793ad5a16744cf1d4efdc5fe48d5a0cf0657974eb7145e0088fcf609ff/analysis/1484248852/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 73d1d55493886639c619e9f5e312daab93e4feeb74f24dbe51593842baac8d15",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292785",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882b1-0fe0-4731-ba6b-49af02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/73d1d55493886639c619e9f5e312daab93e4feeb74f24dbe51593842baac8d15/analysis/1484235679/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 0bb750195fbd93d174c2a8e20bcbcae4efefc881f7961fdca8fa6ebd68ac1edf",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292785",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882b1-c034-4d22-b4a5-4c3102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0bb750195fbd93d174c2a8e20bcbcae4efefc881f7961fdca8fa6ebd68ac1edf/analysis/1484235541/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292786",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882b2-3a24-4622-aaad-429d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665/analysis/1484235929/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 694be2698bcc5c7a1cce11f8ef65c1c96a883d14b98148c36b32888fb58b6a7e",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292787",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882b3-44c8-4b93-8e85-406702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/694be2698bcc5c7a1cce11f8ef65c1c96a883d14b98148c36b32888fb58b6a7e/analysis/1484248848/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 94c4733eebf19013df3b42d76c11ed5d153a56bdab57e1c748e07cc7da38f3ba",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292788",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882b4-e360-4189-8307-49a902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/94c4733eebf19013df3b42d76c11ed5d153a56bdab57e1c748e07cc7da38f3ba/analysis/1484235878/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "- Xchecked via VT: 515374423b8b132258bd91acf6f29168dcc267a3f45ecb9d1fe18ee3a253195b",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484292789",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "587882b5-01a8-4f5a-8106-432002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/515374423b8b132258bd91acf6f29168dcc267a3f45ecb9d1fe18ee3a253195b/analysis/1484248847/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "Sample released by shadow brokers",
|
|
|
|
|
"data": "UEsDBBQACQAIABprLUrAHO7F+0ItACBKLQAgABwANjAxNDFkMjdhZDNjYmZiODRiY2ZhZTQwMTQyMWE1NWRVVAkAAyPVeFgj1XhYdXgLAAEEIQAAAAQhAAAArOBaGx6ZpiGUe86GrZih35tQpsZ4BuhqcdGqy8iOwHWMmSiHSW4sHF689ID3fSdiAw10CVFA9Pr/jeUpG4z1rSZ9UAC4dgArPC6vZbP7huefZfUFf18KDZceObm+5RWcrhwQ227RODAEKBfsg+TVqKRM42G0zInX9cbRf5vFlnLZ+RC2kUD+bLvN8ocnVWd+Tf9TOILDnlMkx8s8b8kRMeA9Y/PF3kA3rXLLycBHfy+xG6eoLfgAYDVj0JsN8TRTpxwioyODsvc1SQ22WNg64V57vu+LlCMhfvCYzzX8NoxkIcbQ/yd53ZUdAqMdnVs9dQE/E5ylGHQI17Ik9rviY+rAxvfo5oY1q8iPyJoOeDougvfvrL2R7uaeVln05JQkfxPXbZiOtWkej1TOJbPEyZJ5Bbh59244gz+ZW2ZSQ1n3TcGLK0eUoL+jFQR6DfMKF2vXuTspfLttRM0ERp4fTefmIk0+l3gqzudl7JJ36KfMNmCGdV5p4uAuXiS1CEdqOJXlrJQqtz3mtRTlUn+ievLyKYYN2WzGKtoXO/IsNrZyLipJOwJIbcz28oz1xs14gT5uRKMRkfbU2frGcuhX8zHWNnvn7GqWUWVOH5G5BK2ltBrwQOqdHy4UmLYEolY5rceir09De92FGoKiKsfberjngBbIITjuYclMWwAXW9HDHfxKERi1O6Zui8WA9+dSFbzOKP3UdbbkQk4nI8vmlATIB8y58z4MRvYjPKXXGGapxpa7K/fXEB9MqJB817zXg5jOREwP/Z2J+5OxdSILNl1gAm80DlkqMUpDuubRBkJc9xRSoztfqtttyE/Vt01ilO3RcGXKh11YMYcJ6JRnlggGOwcjAmayP+IeyiG6qLl0RrT6lATWRyxP2QxH0re/1Ikmn8aaz7kyYaLfFz1IDLyjTH0CHWgGq0fg9AHBbzBGI84Yu6RA0hGODnBvpRiyF2RMqukmFNk50zCvxMQZw9YRNdMBE4vUX5UoT/791qrIFFjukzhoAn7+XT1tB4Cp7jlWu3f9fLYVaojp5S+qgFnIxNKTvdG1FyVPEfVb/9hDeQeLrppizliqwNbt54H1R4ifDis8P8UTzpv1xrIDWCmtngWZKLI3mWbG91xqJZG4lSNAcj6ydcYUtnG1tYITMmRSU/ZY0beoJc+06ZT7s0pVhz5JhGpTX3blOMMujks8J1ChWeUIwNBynSH3NNTfYfT/p1nMQngNTJOQ4zVNirA8bUCGEnQlLclAnHGwidSBRBdGYW42I5zERf9nqAG5C4pf9maXV/H0GY71kLB9WbajDlOZTlsgbO2y65g5iYBhhS+1dhUyV1j8uHEjb1JlMUANrashEdOR/5tXHr0Wmu53lCMkEol8ZdGII017DTc+8r8R+59XmDTEaIkxmHQ3c2aYFf4twvS+rzlwqgE0UUzRw7on7We2/w3J9Es1hx7ICn3gcF540o4yu5+bPpa4qH3mcU851wm7hZV3WoDoN2V5fPg5f15WQLyeEBgRfiaaH/kcOlzB+p1G+/KTBfQmuiYixBqYNEZNnw9vUSSZh8ofoodbMM2imNvzxx4+AMfy/GQH1bXgXlXbaPFT8Z84j7kWTe6LSznJCH9HccNCVmhNlufuM0NQdf7CIJB0PoK+0h3nwFK5HlfQVjfbEAoNDhD9Dogc23s2TgxeAMkJmgu6l26N0psYHmtgJjepVgCZiclOfQQhYIb38xGGwfoALAt/kzCod1mm2W1SF2h2n5mcSdSiCc/y1b+fdnFyfiVjSwWlJ5St3TZHyk7quepArIGyWpCBPKKqs/W2WtULZbUnks+RMXBOdpDutVJgCTfPoRbDkkNGu3arqPsva+ttolHXG8/Zmg1WhERjhjUmNJbYhjJ55mvHe+eWQbfzYMGKVsyRa7gYJZXUekwf1VokmsmQguGf+oF3EBB3o++0F/EqwlyX5uoM4eyZQ0o7RFUb4iMwUEMGt19dy8OxnCCvTdV/rRdOIZWqjdP6rwcCpeUvaKTzvvR+Gy7DmZDWoGEWJmKWWhd4ee7gfgNoHBTP1IVs38JmYKP4mouyqe6OC2Xptw262hr47tvLijGEihsKiS1eoBvwcmHdTYPtJcvzM5cHpoCLRBasUVWVXTkl71iADFV2jtMyrJtLDAwa2x4rRgke/8Bln5HcKWZSB69bcNair5RATTYyQrBLhyS0LZl3ScV4zoPS9VkI8WRAx5O4ZflmtOpmEwOC9YwV2Xz5gbDxP2zCa7lX2+093GmYNyKIrGEkfLnT6VFHcKHWPTNqTgIsAbGOMlrWfUafUPCFIT7GNiDK8OXvz42wdTZ/codO1nwrSPKZ1peHMxXR9n3toRtWLVCnC2t55XWthRQU01nA/6oRrqzCn8r7oj9/M8tYsSedCetNm9Wi0WorZj+eXZ1cKlr7hne23nB+shw7yFkg9RlTiSjBTMO/snhcRXnuiQMMBpN51TSelgCrtSoRQGz1Y+PYFLfO9frQPRJpJlTh8LmWsaknwPmENdArsHCPXDUmM09VpWFxz5caUVyT9ofNgisOlW1kCXfyWLU3W9dWOdKgbhqOvmCJ6igHrHpokEZ8Pjvz5BXp8h5GE6f0ftDVwVwIwbdyo8fqAKHuAgSwGqJC65eO5ur/GMqakgDP1msyQlcy7admZLjR+DymS9Tu3R+HVw5HAXnmMy1JTOV0Uy/J2oJI9BsMyI80swm1tTcxTiuYLQ51JKTs2TTSZWcLfXqDFzcdxD8US7QA0fxdnKKO6yth/bZKEZvE9DILkaqKAbJT+/h7G7FeZoFO+ruxNeSiY+cGKsDOo1AFE3SCjmPXcz7Zn3bIW4HalBcYDS98IjyvLWQK5SZb1o/Pb0gUnqgY1eyxUUWTVFZ36JJoujhvH1nMk3P5JUMuGQsXuJIuzUliioEmh1Xvf6cgsbbfpfUe0u0uRv5bP6uVUqtN2IGUK5wKQhogN5KoPnDdvU07NjQmh2a6jAMgTU4CecWjlCvV8ibTMzcX/Nphvl360flGrebEIFCFnzXc2t0E8ZGtnVPYBmBYZhM1F76mLdCWpVc4Ezonf5hsmRPQ0ifaGWtJv5M7/9TheCnIrmqF6AZJOer2fcaNwutJMbnItV6NZfvc14LEUSQaV9Xtjenpk8HMPKoKJD8Kmh7Juq7YybME2kcvQnET0LPkuJnCKO7Lv1Kxyx4kEjI8Q6nWfaUCUci5D6XzqG+RQ1zLE4Fqk9oJwjFTthdMp+Hhk5CzIA3Eb10/ZN1oV2ybsOy4VXLMomkB9MgD1KJQwYS+6Rg8ymfOF59+jaNzMQL/gZny1vbpjVCDZ9yTtsJW4I4Sjo7RlZe7qv+ancAvQ7ognexMBiAD4WDQ2BTljQHrLWXkqrm5qkZ29BOP5NNxHgDfn+Ti8lVOk0ynzmjkux8kDs5Rk07HGh6tjkkQ1cYRKD4LqwLLADCervJIrvcY3QeYGv3XFiafgA/xaZvrA8iGvyGFBlIPsEJHgM7N+OTMshleaCtHdaeJJDzh71KPLp8NGy/mh33ty14rlQlYB2djfVk2KGb4RU9NslhLcy6m82D52vw3gWmo9wG8sCFjaNb9GGr/uS1NTE1Q1gpRT+jZXKzbNPJjvRqmvHNUXLw13lEai87Ym2WgPgh9dW+BIPq/5oZx3/Hsm5Nr6kk9QxRYzh4FKBdAd0x2lC8YidTJ0EyZf9yElKGKlc+04zzzKepqHPTUy9s1HKsTCrMgOHJD9yLNpfBItwjETyIE1Zh7jERWPyVbA1ttVisLTRc8V8nt0Gj5gS9NdTMkclLH/rGuvxhtmdkoRoy2z6AyoYV35oMsvuiL80I6VKaDcUHTpVmjx/FKQFpd6/wdkpwtUZK5eCQ3i6Wi0CI14X15TtfqcsgAPhSFTPdHNB0+WM85Cf14OA9v897fYjXXZT3pLjopxgONk39CJEbg+HohN38zdTaRpZN27SAEQy
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484313891",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5878d523-883c-4ed7-924b-eb83950d210f",
|
|
|
|
|
"value": "equation_drug.tar.gz|60141d27ad3cbfb84bcfae401421a55d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "Sample released by shadow brokers",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484313893",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "5878d525-edf4-4d19-843c-eb83950d210f",
|
|
|
|
|
"value": "equation_drug.tar.gz|b3c39554cb909d5280837398c6f2effc65a87518"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload installation",
|
|
|
|
|
"comment": "Sample released by shadow brokers",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1484313894",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha256",
|
|
|
|
|
"uuid": "5878d526-be98-4ee1-86eb-eb83950d210f",
|
|
|
|
|
"value": "equation_drug.tar.gz|3d60ecef6990cddd6114c82bd92a8aa39c7929d9f8b66292e47d51f8aa81c67a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
}
|
