2023-04-21 13:25:09 +00:00
|
|
|
{
|
|
|
|
|
"Event": {
|
|
|
|
|
"analysis": "2",
|
|
|
|
|
"date": "2018-01-24",
|
|
|
|
|
"extends_uuid": "",
|
|
|
|
|
"info": "Fake Job Application incl. Macro",
|
|
|
|
|
"publish_timestamp": "1516976583",
|
|
|
|
|
"published": true,
|
|
|
|
|
"threat_level_id": "3",
|
|
|
|
|
"timestamp": "1516976580",
|
|
|
|
|
"uuid": "5a6869a1-1bbc-4a25-ad96-a8fd950d210f",
|
|
|
|
|
"Orgc": {
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
|
|
|
},
|
|
|
|
|
"Tag": [
|
|
|
|
|
{
|
|
|
|
|
"colour": "#3b7500",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "circl:incident-classification=\"malware\"",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#006262",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "ecsirt:malicious-code=\"malware\"",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#0088cc",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "misp-galaxy:tool=\"Smoke Loader\"",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1516792376",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "email-subject",
|
|
|
|
|
"uuid": "5a686a38-1e18-4fd1-8dcc-4c3c950d210f",
|
|
|
|
|
"value": "Website Job Application"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Office file with VBA",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1516792464",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|md5",
|
|
|
|
|
"uuid": "5a686a90-7ed4-4766-93f1-ff60950d210f",
|
|
|
|
|
"value": "resume.doc|13cc8d0857ee50cbd9fdc38484dc32f2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Office file with VBA",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1516792762",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename|sha1",
|
|
|
|
|
"uuid": "5a686bba-6270-4d9d-b3f0-abee950d210f",
|
|
|
|
|
"value": "resume.doc|f5a0e53dda360c372067d8aa9091f80451ee9eb5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Stage 2 executable",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1516796020",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5a686c19-3960-4f6e-b20d-aba6950d210f",
|
|
|
|
|
"value": "http://80.82.67.217/poop.jpg"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1516793000",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5a686ca8-650c-46b3-b28f-ff92950d210f",
|
|
|
|
|
"value": "80.82.67.217"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Internal reference",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1516795482",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "comment",
|
|
|
|
|
"uuid": "5a68765a-0b08-4fac-a1d7-4cfd950d210f",
|
|
|
|
|
"value": "Smokeloader"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1516795503",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5a68766f-23fc-4446-b1c6-48c1950d210f",
|
|
|
|
|
"value": "954e8e88740fd3e659fd4ad0502982dd173db2d90cfca0718bfc739bf886d51c"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Object": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "9",
|
|
|
|
|
"timestamp": "1516792911",
|
|
|
|
|
"uuid": "5a686c4f-bc24-4956-8c70-4492950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIALpaOEy9BDhUajsCAABwBAAgABwAODJhYmU2NGM4NGU5MDY3ODllYTRmZGU4NTNlYmI5ZmNVVAkAA09saFpPbGhadXgLAAEEIQAAAAQhAAAAygYXQyEssccBN9dtM8WsWgUGi8OgXhHtXkm09Sa/b9+SLwdaQCqZv03C1H+VfwvGSYjjZjeFhHqrnkCUPgwYmcy8rm4N37D1GO12aQ1x/Ep6whWpgNYtoW6gO7Tkj7e7PNi8zCeV9ZIfYzyN8svAZ27rwpjiadXsieuu7RMOzXPlTlV3BRp7mYqZcHdQSsjmVyjLbgvEi0E7eKL4Zck3DSroPjLaklzFv2t9nAQq2Wkwvs/svFN/hB52oQD1H+EmeXvQaHj/3jk/1z4PCwQOedq+s56o2AMO4H6XeuGXG22Jdyet5IsiR02sQVKcUUISEcQciJCFOVv1ILyY57MM964jbSuVJxWkwmV8YLcNB3xTK4s5SgoCKozaD2hVagvh9NDIX1mT3R9rbdgLN/al39PyGbR7Ga0WuMvna1rPvi8AygSwZMOnj2SRPfALknnuHKyxdEZheiEWQvJpM9sFSbKU5JmQ4uQiaDhR7yTwCaD5Ug7WZQoLmLaWjvMGQAytdMSdX1C5yAjvPkRql64M3E3mcaaIhkS+5ZeR19rhh5lC6YxiM8KEB162CxWmn214miJcX+9rRoEFcwV6l1Bo1cCR3VUtXs89UyXJsJErOgWlOa0Kg1rjRBado9NrZ/aAl32P/UzE8n83SXnC/9ZVbz9Eo97ovnm2O0VWxuncjTpDz5pT/pbW3v8mgd/XhbYc3MdO7Wop260MsVJYFwNHF9+sGPOPKwCYcvrj1WJagNs7TuFM+1744SDRVr1wxQoShuZujk0tcB8utHlskVorIraelWHLVNcRKHa029MrjFDuSChtDzClOLlDuavaO2kNY7IpZjO9mBPYvdoSLe2ilnXOcMdf++5lcz3BUpAsXV+tPifWNDezW6YiBfCFU/Rnjn52FrbvnbhWqQ+gLHmntl4MyRmMXSG3h/TkPlpbM2cDOFeu6Iwep1xI298sToyQzrK5XVGJOizxo7l8Iaq0XtqPjLBMKmjOFsbvMRGAEYOHc3lOVNH9PKF3yAkt+0wTJ/Ik3IB4pty+Q3h2jlYEwmOsHAUvjma4wLpAqOk9zTOvjN8CcOdjLLwZARaHM3Ji3iPUk0PofONtok3Q37CoWoRQKy88Nx+4bTTKnjtCQ4lqxH2uTQpL6Ua4mIpVBQ2KvHWyoQhlkF7bHHEdXp8swDLEdAhk03Gu8h0/mJel505sAMLluEp7ZF4tOutwaoMsxn8sG+ZbwylKRBdKEvKF66ZGyEgfU9sWpJf6L/PyyGGRXPwlAUdMlpYnmnXaQR0aIO2JFPanWGN63JeHPVM/eBmbz1k7kLAtxd8xpI5e9jm0eTkd8tro0d08dg/FwTT7PgMA6YymUiIcDznItmvDGVXXu8FvR4+YfYav4nGsVotr7jnZaOByRIRMbsoBqtSwlCsAU/il0NioFqujFYWe583/BFMc+GONiccSsRkO8yHlBtHFgNu27MozPRnsyZZd4eiVlPldpBZhFrmCOaeVXVOhmrOlIHP03Pw2Q1uCyZfVR0pkLxHaRmmqB5HRuJlbPEgmvvpcmNh3wDoI6J2VVzuVpMAwmNQkCo5ULKil/8wg/mpt8Pd8WypjqSV+Yhl+fCijodvIqlsXQpMt8CA2b5VU1GkYH+yUWXEmv0ulHCs5yL1VrcX4bdUT8tAhBkc7b7zVa52+eKuiYCy0Dcmj0cQ2Loh1dWYMXwZvBHkORNvPxBPSSLiuu1HA5e4UGOKnkbpZvauzwqUzO2slfxUNzf5aZsBzjiWzmMbBqDReM5dE1IaO7BLiDcLjhto1PlTlZ9Cp99TBuE2v2xWMZrSc0iXfztU5z3kf3mPDntx7x4Dk/KAicUmrVFVbsC3XLS0c8ERMRIVS1OzLuFfFI01RwTUcvixhP0hTIrE7u4WaG7745mwcIc+bm65AB/RgVW2SzAsHt/ecykVHoDiNwRQYY+0uQfmyAQd9UTlHSwhtqenlm6d77ujTTMlTvYIhZbTCX10rrpHWmAgHUZS0CgP+MBRiRYgehSl4mb7Me61H9IysvOLkDzSLQd96h+xzMyRLxnswksAjdWpzksc0+XrWCxwy2ehkXtXEAsAoGMuQc+uzD9Q281hUXq2ounsBtLFhASaBEOeJsgCgYdIN1Fl7PBZhRHx/p8iYxI36C/e2PbHyEgGabkhez81K1J5/nu1ly2zDoxZ5wFaN2wyIP9pqbI2+QfbuqniptXoHcO+aP17phUYgAo6SweqF6rNNutXrPxVrICmr4U42NIWEBvNa4sBgjGVg1by213MvXyLftnkOLSaOAs5GUwZtAN4Gos52OiL4W0O18x2OxSDKOISp4R5MDvki+JxmlhLzfehEImYuAm4xJeinv3FGkCnlCtuOPtyr3O45aSZf5xN8S2QDwqCu4mTpAldYOoZVz3cCzjJ2CBNAsMoEXhH8LJJnld1PJBKCoSW0o00oSy43HLdVhAyl0qbOpNwqsizD8Xukl4P0sWZ6SfzY4AwPx6AvnRF8CXTmYMCYBY8rMBBqKugTRJueCBEUR8CUZkW5M0FBfdT9+0D5rQ48W9g+m8RP8khdb9DnM5TQwTe5NUZdlPNFtn3a73ZOJ3ZXXarSTKvYcgPOhlnKYsZulsj3pJ71ybkyaXUix8MhDpo9OzbUEkUKJpEdK9qVN5BkQjvBXqcIKZBdZPXXeGkfBWW8+exfVFxFt765JUoBUpbhPdq1Qq2ZdN3Ux62DdLW7F+fiu7CbmE1g0WCzjnarQScf7jHmnxlNEoz6X+/Y9wWmhcQxJZSrdN2lH74n0rJRBKbtMYdSeA+oBuMDYUxIfVsvLsEvDSexUl717a/e/A+4LKKQGQhkClq34fSGfBKoZaBQSGPZ7gdXxx4VovSRZtlGMKhPZXnlCUjZeA/SjXPNrPNG039Ot5p2jLSXSftSmS4b7UN6JEBWMOFPjmw4SYvK5GOOfs3mvD3cvR3TdRSeoMmuJhTPEbAaUUp3fIQ7KC9CNvqnk7/zB/23dLTOb242kJ+03M60HV7KdPoRvvJ7I/J2FrmTLTauWaPOw1gkBahQsoKTqT/5CcMriSX777dX8MD1q0OTCYwOsLLINQKbfL74cdkndhUNdN13DWF6hVncC/cWvj1x+vDerIt5VxVN3RNs8zqluGmpxnkeYVTKyAgJkh9lDdN5VKk9t3POYpNDFLqJlnpaYyT8zXeZBcZIW2T/nn+fVM6EaMIhBfjiosx9zX2AfqTSHM1tkGt+J28pFW5L6zXzC7TQTgo3wrVjI1BhVohBXkhqfON5u83e8xKIZZCHrwPYRa6h6HRdnrCw6LEsLlmzq4sYkVfg/lG4zmdZnrVWzd9nb9fqimVbBY7+sd1KWCpnmbzqumOMUzLP5QHBetPLuUwdiNAB6ZAWqDfemUZqk8ut2n3bfRUWweZfVEC8FR4cAJDSDrQ3ja5bK/d0eg08fpFiGxc3/DVcOrNnnLGt4tX53nHTCusrqeIk1HGCFJT7PxOOM3Y2IdEFHGSKWLnV3I4kghGav665bEnF6M9Bv1D7b2fAQMFrxMMsqP96iR5QDSb4saFXVURI7kK61Sqxkij8M0oX6/OlJjtdZFfqi9Bx/5rEnXVH/FV14/XsZxZKCdcluLj2QqOUR+/k+Tb/xVTp/gZ4nbQsuOt2kPJbmjJwY502KNvZJPaU+xPHXoGTZ1eD2Sdz1Vn0gbw5EtXXoecRDsqxtCkL/bipRJw1fLripD+rRHq+r3bSRk+X7KOMJ9Owr+VatypdX3xucX2F/uug7RL2G6WKhmlOuIlU1qFn08c8APX8f3SppXYloRwsaKPYBJnfeM92QUhopUMbQQILbli+pZUCbyjBgPur3TXU3KgaNqb1/lBDUK9agGa7WDZS2TtgBvnjmxDzENvmivXZvpwuANwGGSKjkLYNfxYfqvfRNB0NfrXhtT5aKhjKP3RS4dQ7ReDnKs+VkyWlg2uaqd
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1516792911",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5a686c4f-0f74-4626-9e20-4d57950d210f",
|
|
|
|
|
"value": "poop.jpg|82abe64c84e906789ea4fde853ebb9fc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1516792912",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5a686c50-c110-4f52-904a-4717950d210f",
|
|
|
|
|
"value": "poop.jpg"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1516792913",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5a686c51-f818-4e83-9486-476e950d210f",
|
|
|
|
|
"value": "82abe64c84e906789ea4fde853ebb9fc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1516792913",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5a686c51-d5c4-4d4f-96f3-497b950d210f",
|
|
|
|
|
"value": "3ef1633d5c068dfeda66d2906daa9ac07715933a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1516792913",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5a686c51-6d20-443e-963d-4508950d210f",
|
|
|
|
|
"value": "c53dd04cb0ddfd82076cecdcc38dca16163f2b3d843708e448bd3d8b822ed27d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1516792914",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5a686c52-6b60-4307-9a7e-4150950d210f",
|
|
|
|
|
"value": "290816"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
}
|
