2023-04-21 13:25:09 +00:00
{
2023-12-14 14:30:15 +00:00
"Event" : {
"analysis" : "2" ,
"date" : "2017-01-19" ,
"extends_uuid" : "" ,
"info" : "OSINT - Uncovering the Inner Workings of EyePyramid" ,
"publish_timestamp" : "1484813235" ,
"published" : true ,
"threat_level_id" : "3" ,
"timestamp" : "1484812427" ,
"uuid" : "58806a6c-14a4-49a9-8d6c-49e6950d210f" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#0088cc" ,
"local" : "0" ,
"name" : "misp-galaxy:tool=\" EyePyramid Malware\"" ,
"relationship_type" : ""
} ,
{
"colour" : "#ffffff" ,
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
}
] ,
"Attribute" : [
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484810875" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "58806a7b-5040-4706-8eaf-4e44950d210f" ,
"value" : "Two Italians referred to as the \u00e2\u20ac\u0153Occhionero brothers\u00e2\u20ac\u009d have been arrested and accused of using malware and a carefully-prepared spear-phishing scheme to spy on high-profile politicians and businessmen. This case has been called \u00e2\u20ac\u0153EyePyramid\u00e2\u20ac\u009d, which we first discussed last week. (Conspiracy theories aside, the name came from a domain name and directory path that was found during the research.)\r\n\r\nThe court order was published by AGI, an Italian news agency, around noon on January 11. It (surprisingly) contains multiple technical details which we used to bootstrap our initial analysis. This post builds on the details of the case to provide a more complete and in-depth view of the activities of this campaign.\r\n\r\nScope of this analysis\r\n\r\nWe have analyzed nearly 250 distinct samples, with new batches of EyePryramid-related samples seen and identified daily. Right after our initial analysis, about a dozen suspicious samples were uploaded to VirusTotal and tagged as \u00e2\u20ac\u0153#eyepyramid\u00e2\u20ac\u009d. We believe that these samples are \u00e2\u20ac\u0153false flags,\u00e2\u20ac\u009d because the samples do not resemble any of the samples that we were able to definitely relate to the EyePyramid case. Although we are not able to say with 100% certainty that there are no relationships between these \u00e2\u20ac\u0153false flags\u00e2\u20ac\u009d and the original EyePyramid samples, we purposely did not focus on these uploaded samples."
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484810892" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58806a8c-4008-48f2-8de3-4842950d210f" ,
"value" : "http://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-inner-workings-eyepyramid"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "paths or library names indicating code reuse of specific components" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811291" ,
"to_ids" : true ,
"type" : "pdb" ,
"uuid" : "58806c1b-a244-41a1-9bbf-4532950d210f" ,
"value" : ":\\Projects\\VS2005\\ChromePass\\Release\\ChromePass.pdb"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "paths or library names indicating code reuse of specific components" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811292" ,
"to_ids" : true ,
"type" : "pdb" ,
"uuid" : "58806c1c-bb6c-40f4-92d0-433b950d210f" ,
"value" : ":\\Projects\\VS2005\\MyLastSearch\\release\\MyLastSearch.pdb"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "paths or library names indicating code reuse of specific components" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811293" ,
"to_ids" : true ,
"type" : "pdb" ,
"uuid" : "58806c1d-49cc-4664-8c7d-428d950d210f" ,
"value" : ":\\Projects\\VS2005\\NK2View\\Release\\NK2View.pdb"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "paths or library names indicating code reuse of specific components" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811294" ,
"to_ids" : true ,
"type" : "pdb" ,
"uuid" : "58806c1e-0a40-4830-bdb0-424b950d210f" ,
"value" : ":\\Projects\\VS2005\\ProduKey\\Release\\ProduKey.pdb"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "paths or library names indicating code reuse of specific components" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811295" ,
"to_ids" : true ,
"type" : "pdb" ,
"uuid" : "58806c1f-b1a8-4261-b7a8-4a08950d210f" ,
"value" : ":\\Projects\\VS2005\\RecentFilesView\\Release\\RecentFilesView.pdb"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "paths or library names indicating code reuse of specific components" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811295" ,
"to_ids" : true ,
"type" : "pdb" ,
"uuid" : "58806c1f-95b8-4c6d-b981-4e0a950d210f" ,
"value" : ":\\Projects\\VS2005\\USBDeview\\Release\\USBDeview.pdb"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "paths or library names indicating code reuse of specific components" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811296" ,
"to_ids" : true ,
"type" : "pdb" ,
"uuid" : "58806c20-91b0-45df-b625-412c950d210f" ,
"value" : ":\\Projects\\VS2005\\WirelessKeyView\\Release\\WirelessKeyView.pdb"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "paths or library names indicating code reuse of specific components" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811297" ,
"to_ids" : true ,
"type" : "pdb" ,
"uuid" : "58806c21-2540-48fd-b445-40b4950d210f" ,
"value" : ":\\Projects\\VS2005\\mspass\\Release\\mspass.pdb"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "paths or library names indicating code reuse of specific components" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811298" ,
"to_ids" : true ,
"type" : "pdb" ,
"uuid" : "58806c22-0390-488d-bfb9-415e950d210f" ,
"value" : ":\\Projects\\VS2005\\netpass\\Release\\netpass.pdb"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "paths or library names indicating code reuse of specific components" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811299" ,
"to_ids" : true ,
"type" : "pdb" ,
"uuid" : "58806c23-9c98-4b91-9120-454d950d210f" ,
"value" : ":\\projects\\VS2005\\iepv\\Release\\iepv.pdb"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "paths or library names indicating code reuse of specific components" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811300" ,
"to_ids" : true ,
"type" : "pdb" ,
"uuid" : "58806c24-4134-4bc3-9c5a-4fe7950d210f" ,
"value" : ":\\projects\\vs2005\\shortcutsman\\release\\shman.pdb"
} ,
{
"category" : "Attribution" ,
"comment" : "Both the 2010 and 2012 versions share the infamous MN600-D8102F401003102110C5114F1F18-0E8C MailBee license key, which was either purchased by Giulio Occhionero, or purchased using his name." ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811351" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "58806c57-ddb0-4a50-851d-454c950d210f" ,
"value" : "MN600-D8102F401003102110C5114F1F18-0E8C"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Although used for debugging only, we found that the malware author was playing around with email-based cross-site scripting, as can be seen from the following code snippet" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811446" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58806cb6-2af8-4192-90f9-4f10950d210f" ,
"value" : "21b6f2584485b8bbfffdefd45c1c72dc2133290fd8cefb235eb39cf015550316"
} ,
{
"category" : "External analysis" ,
"comment" : "Analysis Methodology" ,
"data" : " / 9 j / 4 A A Q S k Z J R g A B A g E A k A C Q A A D / 7 Q A s U G h v d G 9 z a G 9 w I D M u M A A 4 Q k l N A + 0 A A A A A A B A A k A A A A A E A A Q C Q A A A A A Q A B / + F m m m h 0 d H A 6 L y 9 u c y 5 h Z G 9 i Z S 5 j b 20 v e G F w L z E u M C 8 A P D 94 c G F j a 2 V 0 I G J l Z 2 l u P S L v u 78 i I G l k P S J X N U 0 w T X B D Z W h p S H p y Z V N 6 T l R j e m t j O W Q i P z 4 K P H g 6 e G 1 w b W V 0 Y S B 4 b W x u c z p 4 P S J h Z G 9 i Z T p u c z p t Z X R h L y I g e D p 4 b X B 0 a z 0 i Q W R v Y m U g W E 1 Q I E N v c m U g N S 4 z L W M w M T E g N j Y u M T Q 1 N j Y x L C A y M D E y L z A y L z A 2 L T E 0 O j U 2 O j I 3 I C A g I C A g I C A i P g o g I C A 8 c m R m O l J E R i B 4 b W x u c z p y Z G Y 9 I m h 0 d H A 6 L y 93 d 3 c u d z M u b 3 J n L z E 5 O T k v M D I v M j I t c m R m L X N 5 b n R h e C 1 u c y M i P g o g I C A g I C A 8 c m R m O k R l c 2 N y a X B 0 a W 9 u I H J k Z j p h Y m 91 d D 0 i I g o g I C A g I C A g I C A g I C B 4 b W x u c z p k Y z 0 i a H R 0 c D o v L 3 B 1 c m w u b 3 J n L 2 R j L 2 V s Z W 1 l b n R z L z E u M S 8 i P g o g I C A g I C A g I C A 8 Z G M 6 Z m 9 y b W F 0 P m l t Y W d l L 2 p w Z W c 8 L 2 R j O m Z v c m 1 h d D 4 K I C A g I C A g I C A g P G R j O n R p d G x l P g o g I C A g I C A g I C A g I C A 8 c m R m O k F s d D 4 K I C A g I C A g I C A g I C A g I C A g P H J k Z j p s a S B 4 b W w 6 b G F u Z z 0 i e C 1 k Z W Z h d W x 0 I j 5 k Z 20 t Y X B r L W Z p b G U 8 L 3 J k Z j p s a T 4 K I C A g I C A g I C A g I C A g P C 9 y Z G Y 6 Q W x 0 P g o g I C A g I C A g I C A 8 L 2 R j O n R p d G x l P g o g I C A g I C A 8 L 3 J k Z j p E Z X N j c m l w d G l v b j 4 K I C A g I C A g P H J k Z j p E Z X N j c m l w d G l v b i B y Z G Y 6 Y W J v d X Q 9 I i I K I C A g I C A g I C A g I C A g e G 1 s b n M 6 e G 1 w P S J o d H R w O i 8 v b n M u Y W R v Y m U u Y 29 t L 3 h h c C 8 x L j A v I g o g I C A g I C A g I C A g I C B 4 b W x u c z p 4 b X B H S W 1 n P S J o d H R w O i 8 v b n M u Y W R v Y m U u Y 29 t L 3 h h c C 8 x L j A v Z y 9 p b W c v I j 4 K I C A g I C A g I C A g P H h t c D p D c m V h d G 9 y V G 9 v b D 5 B Z G 9 i Z S B J b G x 1 c 3 R y Y X R v c i B D U z Y g K F d p b m R v d 3 M p P C 94 b X A 6 Q 3 J l Y X R v c l R v b 2 w + C i A g I C A g I C A g I D x 4 b X A 6 Q 3 J l Y X R l R G F 0 Z T 4 y M D E 3 L T A x L T E 4 V D I y O j I y O j M 5 K z A 4 O j A w P C 94 b X A 6 Q 3 J l Y X R l R G F 0 Z T 4 K I C A g I C A g I C A g P H h t c D p N b 2 R p Z n l E Y X R l P j I w M T c t M D E t M T h U M T Q 6 M j I 6 N D B a P C 94 b X A 6 T W 9 k a W Z 5 R G F 0 Z T 4 K I C A g I C A g I C A g P H h t c D p N Z X R h Z G F 0 Y U R h d G U + M j A x N y 0 w M S 0 x O F Q y M j o y M j o z O S s w O D o w M D w v e G 1 w O k 1 l d G F k Y X R h R G F 0 Z T 4 K I C A g I C A g I C A g P H h t c D p U a H V t Y m 5 h a W x z P g o g I C A g I C A g I C A g I C A 8 c m R m O k F s d D 4 K I C A g I C A g I C A g I C A g I C A g P H J k Z j p s a S B y Z G Y 6 c G F y c 2 V U e X B l P S J S Z X N v d X J j Z S I + C i A g I C A g I C A g I C A g I C A g I C A g I D x 4 b X B H S W 1 n O n d p Z H R o P j I 1 N j w v e G 1 w R 0 l t Z z p 3 a W R 0 a D 4 K I C A g I C A g I C A g I C A g I C A g I C A g P H h t c E d J b W c 6 a G V p Z 2 h 0 P j E 5 M j w v e G 1 w R 0 l t Z z p o Z W l n a H Q + C i A g I C A g I C A g I C A g I C A g I C A g I D x 4 b X B H S W 1 n O m Z v c m 1 h d D 5 K U E V H P C 94 b X B H S W 1 n O m Z v c m 1 h d D 4 K I C A g I C A g I C A g I C A g I C A g I C A g P H h t c E d J b W c 6 a W 1 h Z 2 U + L z l q L z R B Q V F T a 1 p K U m d B Q k F n R U F r Q U N R Q U F E L z d R Q X N V R 2 h 2 Z E c 5 e m F H O X d J R E 11 T U F B N F F r b E 5 B K z B B Q U F B Q U F C Q U F r Q U F B Q U F F Q S Y j e E E 7 Q V F D U U F B Q U F B U U F C L y t J T V d F b E R R M T l R V W s 5 R 1 N V e E Z B Q U V C Q U F B T V N F e H B i b T h D R U F B Q W J X N T B j b E p I U W l C W V d W b 2 d C O D R B Q W d B S i Y j e E E 7 Q U F Z Q U 1 R Q U F Z V 0 56 Y 0 U x V F J s U U F B Q U F B U 1 V W R E l I T l N S M E l B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F Q Y l d B Q U V B Q U F B Q T B 5 M U l V Q 0 F n Q U F B Q S Y j e E E 7 Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F S W T N C e W R B Q U F B V k F B Q U F B e i Y j e E E 7 W k d W e l l 3 Q U F B W V F B Q U F C c 2 Q z U n d k Q U F B Q W Z B Q U F B Q V V Z b X R 3 Z E F B Q U F n U U F B Q U F V Y 2 x o W l d n Q U F B a G d B Q U F B V V o x a F p X Z 0 F B Q W l 3 Q S Y j e E E 7 Q U F B V V l s a F p X Z 0 F B Q W t B Q U F B Q V V a R z F 1 W k F B Q U F s U U F B Q U J 3 W k c x a 1 p B Q U F B c 1 F B Q U F D S W R u V m x a Q U F B Q T B 3 Q U F B Q 0 d k b W x s Z H d B Q S Y j e E E 7 Q T l R Q U F B Q W t i S F Z 0 Y V F B Q U E v Z 0 F B Q U F V Y l d W a G N 3 Q U F C Q X d B Q U F B a 2 R H V m p h Q U F B Q k R B Q U F B Q U 1 j b F J T U X d B Q U J E d 0 F B Q W d N W j F S U y Y j e E E 7 U X d B Q U J E d 0 F B Q W d N W W x S U 1 F 3 Q U F C R H d B Q U F n T W R H V j R k Q U F B Q U F C R G I z Q j V j b W x u Y U h R Z 0 t H T X B J R E U 1 T 1 R n Z 1 N H V j N i R 1 Y w Z E M x U S Y j e E E 7 W V d O c l l Y S m t J R U 52 Y l h C a G J u a 0 F B R 1 J s Y z J N Q U F B Q U F B Q U F B R W 5 O U 1 I w S W d T V V Z E T m p F N U 5 q W X R N a T R 4 Q U F B Q U F B Q U F B Q U F B Q U F B U y Y j e E E 7 Y z F K S F F p Q k p S V U 0 y T V R r M k 5 p M H l M a k V B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q S Y j e E E 7 Q U F B Q U F B Q U F B Q U F B Q U Z o W l d p Q U F B Q U F B Q U F E e l V R Q U J B Q U F B Q V J i T V d G b G F J Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q l l X V m 9 n Q U F B Q S Y j e E E 7 Q U F B Q W I 2 S U F B R G o x Q U F B R G t G a F p X a U F B Q U F B Q U F B Q m l t U U F B d D R V Q U F C a m F X R m x h S U F B Q U F B Q U F B Q 1 N n Q U F B U G h B Q U F 0 c z l r W l h O a i Y j e E E 7 Q U F B Q U F B Q U F B Q l p K U l V N Z 2 F I U j B j R G 92 T D N k M 2 R 5 N X B a V 0 11 W T J n Q U F B Q U F B Q U F B Q U F B Q U F C W k p S V U 1 n Y U h S M G N E b 3 Z M M 2 Q z Z H k 1 c C Y j e E E 7 W l d N d V k y Z 0 F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F a R 1 Z 6 W X d B Q S Y j e E E 7 Q U F B Q U F B Q X V T V V Z E S U R Z e E 9 U W T J M V E l 1 T V N C R V p X W m h k V 3 g w S U Z K S F F p Q m p i M n h 2 Z F h J Z 2 M z Q m h Z M l V n T F N C e l V r Z E N B Q U F B Q U F B Q S Y j e E E 7 Q U F B Q U F B Q X V T V V Z E S U R Z e E 9 U W T J M V E l 1 T V N C R V p X W m h k V 3 g w S U Z K S F F p Q m p i M n h 2 Z F h J Z 2 M z Q m h Z M l V n T F N C e l V r Z E N B Q U F B Q U F B Q S Y j e E E 7 Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B R 1 J s Y z J N Q U F B Q U F B Q U F B T E Z K b F p t V n l a V z V q W l N C V 2 F X V j N h V z V u S U V O d m J t U n B k R 2 x 2 Y m l C c C Y j e E E 7 Y m l C S l J V T T J N V G s y T m k w e U x q R U F B Q U F B Q U F B Q U F B Q U F B Q 3 h T W l d a b G N t V n V Z M l V n V m 1 s b G Q y b H V a e U J E Y j I 1 a 2 F Y U n B i M j R n Y V c 0 Z y Y j e E E 7 U 1 V W R E 5 q R T V O a l l 0 T W k 0 e E F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F B Q U F C M m F X V j N B Q U F B Q U F B V H B Q N E F G R j h 1 Q U J E U C Y j e E E 7 R k F B R D d j d 0 F C Q k 1 M Q U F O Y 25 n Q U F B Q U Z Z V 1 Z v Z 0 F B Q U F B Q U J N Q 1 Z Z Q V V B Q U F B R m N m N T I x b F l Y T U F B Q U F B Q U F B Q U F R Q U F B Q U F B Q U F B Q S Y j e E E 7 Q U F B Q U F B Q U F B Q U F B Q U F L U E F B Q U F B b k 5 w W n l B Q U F B Q U F R M U p V S U d O M W N u W U F B Q U F B Q U F B R U F B Q U F B Q V V B Q 2 d B U E F C U U
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811513" ,
"to_ids" : false ,
"type" : "attachment" ,
"uuid" : "58806cf9-7a5c-467f-bea2-41ab950d210f" ,
"value" : "EyePyramid_15-01.jpg"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811686" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58806da6-5f00-4e00-871d-4cdd950d210f" ,
"value" : "d3ad32bcb255e56cd2a768b3cbf6bafda88233288fc6650d0dfa3810be75f74c"
} ,
{
"category" : "External analysis" ,
"comment" : "Appendix" ,
"data" : " J V B E R i 0 x L j U N C i W 1 t b W 1 D Q o x I D A g b 2 J q D Q o 8 P C 9 U e X B l L 0 N h d G F s b 2 c v U G F n Z X M g M i A w I F I v T G F u Z y h l b i 1 V U y k g L 1 N 0 c n V j d F R y Z W V S b 290 I D Q x I D A g U i 9 N Y X J r S W 5 m b z w 8 L 0 1 h c m t l Z C B 0 c n V l P j 4 + P g 0 K Z W 5 k b 2 J q D Q o y I D A g b 2 J q D Q o 8 P C 9 U e X B l L 1 B h Z 2 V z L 0 N v d W 50 I D g v S 2 l k c 1 s g M y A w I F I g M T A g M C B S I D E 5 I D A g U i A y M y A w I F I g M j U g M C B S I D I 3 I D A g U i A y O S A w I F I g M z Y g M C B S X S A + P g 0 K Z W 5 k b 2 J q D Q o z I D A g b 2 J q D Q o 8 P C 9 U e X B l L 1 B h Z 2 U v U G F y Z W 50 I D I g M C B S L 1 J l c 291 c m N l c z w 8 L 1 h P Y m p l Y 3 Q 8 P C 9 J b W F n Z T U g N S A w I F I + P i 9 G b 250 P D w v R j E g N i A w I F I v R j I g O C A w I F I + P i 9 Q c m 9 j U 2 V 0 W y 9 Q R E Y v V G V 4 d C 9 J b W F n Z U I v S W 1 h Z 2 V D L 0 l t Y W d l S V 0 g P j 4 v T W V k a W F C b 3 h b I D A g M C A 2 M T I g N z k y X S A v Q 29 u d G V u d H M g N C A w I F I v R 3 J v d X A 8 P C 9 U e X B l L 0 d y b 3 V w L 1 M v V H J h b n N w Y X J l b m N 5 L 0 N T L 0 R l d m l j Z V J H Q j 4 + L 1 R h Y n M v U y 9 T d H J 1 Y 3 R Q Y X J l b n R z I D A + P g 0 K Z W 5 k b 2 J q D Q o 0 I D A g b 2 J q D Q o 8 P C 9 G a W x 0 Z X I v R m x h d G V E Z W N v Z G U v T G V u Z 3 R o I D c z O T 4 + D Q p z d H J l Y W 0 N C n i c l Z Z L b 9 s w D M f v A f I d e J Q O U f S 0 L K A o k L 6 G F h 3 Q d R 52 S H v w X D c x 2 t i Z 627 L t x / l J I O d x Z 6 H A I o f 4 k 9 / U i R l m N 7 B y c n 0 4 / n 1 B f D T U z i 7 O I f v 41 E g N J M K O P 6 s M 0 w Z 4 D h w H s K E M 6 G d D S F Z j U f T 61 W 8 S A 1 c F P B p P I L L j + c w n Z V V 9 h w n l c f O q i p O l u k T z K d R s X 6 c R p t 1 O r 2 L F 1 k e V 1 m R 79 Y 7 i 5 B 0 J c A x F 0 D 0 P B 6 J e m E B K g C r A 2 b x K S 5 W L w y L / c W H 8 W h O Z l S T 9 Z p O L E l z v H y i E 0 c y a s g v + g j R z X h 0 i W i P 3 x O t Z T b U T e q c Q G N u 7 Q I 0 Y i I O N E p 7 K N J K x q W G w C k W y q 3 Q W u R W Y C 9 c N u C H O K 8 w H K J Q t R R K U L w t z z G J P G M w u p 1 h / J L T i S R J 8 S M t M Y p Z v o C K K r J M 4 T q v 36 Q l 4 P 3 X o n z B d 2 / Q F d z d U t I w r X b S i 2e43 K R 3 m z J e Z f U G H T e V o W W B a 5 v 2 e q 0 P v B b m r 33 Z q t E m Y M L t k D M q D M F 0 2 Q 2 p T 5 z 8 y b v c l T D C 4 H 4 E b U q v M H O Q M E I w r o 8 l j F a c S f t / C R N 0 J 4 z m h t l B C m 0 3 R I V i o J t h D w R j F Q y C u B 6 I w v 9 B E M F 7 K B z T S g y i i G 6 K D B X j w y g 9 F S 1 N y P Q w i u q h K M X c o A o R u o f C H V P D K K a b I k K 9 b 3 n / o v Q k r g i w D o Z R 7 G H R y 1 Z h S S e Z V R g + z f a Z E 5 V Y 4 w p r / D b + 9 u a v 4 D O t 616 R x A / v Z V b R S U g 2 V A Y E r u u 5 F f a D e s b r q x + z B d 5 o k i f U b h / D 2 W u x 6 G g X h m s m W g r 6 P T p W R l L V m y M k 1 u I O c l W U V A j y E 3 u x I D E N S N n d S I M 6 B g 3 j S d d U x 32 d N q f e F s V L 5 h s + n g D R 0 s d O 4 n L o c w X 36 d s + c v W T M v F R W X p Z 8 E C u o n t 8 + 0 A h S m P f W V f 98 W k s 2 R + f Y x 1 i x 8 D S H p T B 8 l h / 0 P 4 c d 4 B n t v H d u a b c / P E t f 49 L O h E S 0 + K 4 G 9 p i F Y Z t 865 T U e M 3 h 9 L N u f g t x T W e 7 c m c S C 66 z J x l p m 1 V W 9 j e y H Y q q s P y G 1 p M C N s N C m V u Z H N 0 c m V h b Q 0 K Z W 5 k b 2 J q D Q o 1 I D A g b 2 J q D Q o 8 P C 9 U e X B l L 1 h P Y m p l Y 3 Q v U 3 V i d H l w Z S 9 J b W F n Z S 9 X a W R 0 a C A x M j c 1 L 0 h l a W d o d C A x N j U w L 0 N v b G 9 y U 3 B h Y 2 U v R G V 2 a W N l U k d C L 0 J p d H N Q Z X J D b 21 w b 25 l b n Q g O C 9 G a W x 0 Z X I v R E N U R G V j b 2 R l L 0 l u d G V y c G 9 s Y X R l I H R y d W U v T G V u Z 3 R o I D Y x N T c 5 P j 4 N C n N 0 c m V h b Q 0 K / 9 j / 4 A A Q S k Z J R g A B A Q E A l g C W A A D / 4 Q B c R X h p Z g A A T U 0 A K g A A A A g A B A M C A A I A A A A W A A A A P l E Q A A E A A A A B A Q A A A F E R A A Q A A A A B A A A X E l E S A A Q A A A A B A A A X E g A A A A B Q a G 90 b 3 N o b 3 A g S U N D I H B y b 2 Z p b G U A / + I M W E l D Q 19 Q U k 9 G S U x F A A E B A A A M S E x p b m 8 C E A A A b W 50 c l J H Q i B Y W V o g B 84 A A g A J A A Y A M Q A A Y W N z c E 1 T R l Q A A A A A S U V D I H N S R 0 I A A A A A A A A A A A A A A A E A A P b W A A E A A A A A 0 y 1 I U C A g A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A R Y 3 B y d A A A A V A A A A A z Z G V z Y w A A A Y Q A A A B s d 3 R w d A A A A f A A A A A U Y m t w d A A A A g Q A A A A U c l h Z W g A A A h g A A A A U Z 1 h Z W g A A A i w A A A A U Y l h Z W g A A A k A A A A A U Z G 1 u Z A A A A l Q A A A B w Z G 1 k Z A A A A s Q A A A C I d n V l Z A A A A 0 w A A A C G d m l l d w A A A 9 Q A A A A k b H V t a Q A A A / g A A A A U b W V h c w A A B A w A A A A k d G V j a A A A B D A A A A A M c l R S Q w A A B D w A A A g M Z 1 R S Q w A A B D w A A A g M Y l R S Q w A A B D w A A A g M d G V 4 d A A A A A B D b 3 B 5 c m l n a H Q g K G M p I D E 5 O T g g S G V 3 b G V 0 d C 1 Q Y W N r Y X J k I E N v b X B h b n k A A G R l c 2 M A A A A A A A A A E n N S R 0 I g S U V D N j E 5 N j Y t M i 4 x A A A A A A A A A A A A A A A S c 1 J H Q i B J R U M 2 M T k 2 N i 0 y L j E A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A F h Z W i A A A A A A A A D z U Q A B A A A A A R b M W F l a I A A A A A A A A A A A A A A A A A A A A A B Y W V o g A A A A A A A A b 6 I A A D j 1 A A A D k F h Z W i A A A A A A A A B i m Q A A t 4 U A A B j a W F l a I A A A A A A A A C S g A A A P h A A A t s 9 k Z X N j A A A A A A A A A B Z J R U M g a H R 0 c D o v L 3 d 3 d y 5 p Z W M u Y 2 g A A A A A A A A A A A A A A B Z J R U M g a H R 0 c D o v L 3 d 3 d y 5 p Z W M u Y 2 g A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A Z G V z Y w A A A A A A A A A u S U V D I D Y x O T Y 2 L T I u M S B E Z W Z h d W x 0 I F J H Q i B j b 2 x v d X I g c 3 B h Y 2 U g L S B z U k d C A A A A A A A A A A A A A A A u S U V D I D Y x O T Y 2 L T I u M S B E Z W Z h d W x 0 I F J H Q i B j b 2 x v d X I g c 3 B h Y 2 U g L S B z U k d C A A A A A A A A A A A A A A A A A A A A A A A A A A A A A G R l c 2 M A A A A A A A A A L F J l Z m V y Z W 5 j Z S B W a W V 3 a W 5 n I E N v b m R p d G l v b i B p b i B J R U M 2 M T k 2 N i 0 y L j E A A A A A A A A A A A A A A C x S Z W Z l c m V u Y 2 U g V m l l d 2 l u Z y B D b 25 k a X R p b 24 g a W 4 g S U V D N j E 5 N j Y t M i 4 x A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A B 2 a W V 3 A A A A A A A T p P 4 A F F 8 u A B D P F A A D 7 c w A B B M L A A N c n g A A A A F Y W V o g A A A A A A B M C V Y A U A A A A F c f 521 l Y X M A A A A A A A A A A Q A A A A A A A A A A A A A A A A A A A A A A A A K P A A A A A n N p Z y A A A A A A Q 1 J U I G N 1 c n Y A A A A A A A A E A A A A A A U A C g A P A B Q A G Q A e A C M A K A A t A D I A N w A 7 A E A A R Q B K A E 8 A V A B Z A F 4 A Y w B o A G 0 A c g B 3 A H w A g Q C G A I s A k A C V A J o A n w C k A K k A r g C y A L c A v A D B A M Y A y w D Q A N U A 2 w D g A O U A 6 w D w A P Y A + w E B A Q c B D Q E T A R k B H w E l A S s B M g E 4 A T 4 B R Q F M A V I B W Q F g A W c B b g F 1 A X w B g w G L A Z I B m g G h A a k B s Q G 5 A c E B y Q H R A d k B 4 Q H p A f I B + g I D A g w C F A I d A i Y C L w I 4 A k E C S w J U A l 0 C Z w J x A n o C h A K O A p g C o g K s A r Y C w Q L L A t U C 4 A L r A v U D A A M L A x Y D I Q M t A z g D Q w N P A 1 o D Z g N y A 34 D i g O W A 6 I D r g O 6 A 8 c D 0 w P g A + w D + Q Q G B B M E I A Q t B D s E S A R V B G M E c Q R + B I w E m g S o B L Y E x A T T B O E E 8 A T + B Q 0 F H A U r B T o F S Q V Y B W c F d w W G B Z Y F p g W 1 B c U F 1 Q X l B f Y G B g Y W B i c G N w Z I B l k G a g Z 7 B o w G n Q a v B s
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811762" ,
"to_ids" : false ,
"type" : "attachment" ,
"uuid" : "58806df2-9f50-44e7-85e2-42a5950d210f" ,
"value" : "Appendix_uncovering-the-inner-workings-of-eyepyramid.pdf"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811850" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e4a-0990-4e82-b7d2-4b14950d210f" ,
"value" : "http://guess515.fastmail.fm/files/jobs/44dc7eceb"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811851" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e4b-0acc-4f4c-8073-43d1950d210f" ,
"value" : "http://guess515.fastmail.fm/files/jobs/3261cc389"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811851" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e4b-25ac-4bd6-a0b9-46c8950d210f" ,
"value" : "http://guess515.fastmail.fm/files/run"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811852" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e4c-3f68-409f-aa6a-4b33950d210f" ,
"value" : "http://guess515.fastmail.fm/files/ghk"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811853" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e4d-148c-4308-b2e1-4d98950d210f" ,
"value" : "http://guess515.fastmail.fm/files/co"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811854" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e4e-b3e4-4f18-9a79-4931950d210f" ,
"value" : "http://guess515.fastmail.fm/files/bin/ghk"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811855" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e4f-db9c-42ca-9ff4-4ff5950d210f" ,
"value" : "http://guess515.fastmail.fm/files/obj/decepk"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811856" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e50-a450-4989-8cc0-4f48950d210f" ,
"value" : "http://guess515.fastmail.fm/files/tasks"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811857" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e51-89e4-463c-b283-4703950d210f" ,
"value" : "http://guess515.fastmail.fm/files/decepk"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811857" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e51-886c-4da1-87d3-4032950d210f" ,
"value" : "http://guess515.fastmail.fm/files/bin/run"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811858" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e52-d2d0-4a2b-9cb9-428f950d210f" ,
"value" : "http://guess515.fastmail.fm/files/jobs"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811859" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e53-07f8-4bdc-b554-46c6950d210f" ,
"value" : "http://guess515.fastmail.fm/files/replace"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811860" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e54-beb0-45c1-81af-4638950d210f" ,
"value" : "http://guess515.fastmail.fm/files/fail"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811861" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e55-0568-4c64-b4cd-4782950d210f" ,
"value" : "http://guess515.fastmail.fm/files/obj"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811862" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e56-72e0-4602-81cb-4356950d210f" ,
"value" : "http://guess515.fastmail.fm/files/obj/tasks"
} ,
{
"category" : "Network activity" ,
"comment" : "2010 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811862" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e56-400c-4f3c-b727-4b4e950d210f" ,
"value" : "http://guess515.fastmail.fm/files/bin"
} ,
{
"category" : "Network activity" ,
"comment" : "2012 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811903" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e7f-11e0-411a-adf0-497a950d210f" ,
"value" : "ftp://ftp1.storegate.com/home/jiwoku375"
} ,
{
"category" : "Network activity" ,
"comment" : "2012 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811904" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e80-ee2c-48e1-b25c-494d950d210f" ,
"value" : "https://webdav1.storegate.com/jiwoku375/home/jiwoku375"
} ,
{
"category" : "Network activity" ,
"comment" : "2012 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811905" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e81-ba68-4cfb-a12c-4edc950d210f" ,
"value" : "http://webdav1.storegate.com/jiwoku375/home/jiwoku375"
} ,
{
"category" : "Network activity" ,
"comment" : "2012 sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484811905" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806e81-4664-4964-9817-4847950d210f" ,
"value" : "ftp1.storegate.com/home/jiwoku375"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812244" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fd4-f158-41a6-bad8-46c3950d210f" ,
"value" : "https://webdav.hidrive.strato.com/users/oncole3991"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812245" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fd5-ae40-4b64-a154-4c7b950d210f" ,
"value" : "http://webdav.cloudme.com/imin1399/xios"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812246" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fd6-af4c-4467-86bf-429d950d210f" ,
"value" : "http://webdav1.storegate.com/oldi4006/home/oldi4006"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812247" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fd7-424c-45a5-b1c3-4e88950d210f" ,
"value" : "https://webdav1.storegate.com/oldi4006/home/oldi4006"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812247" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fd7-18c0-4ca5-b2e2-4e88950d210f" ,
"value" : "http://webdav1.storegate.com/uwiq175/home/uwiq175"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812248" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fd8-85c4-4455-903a-47b7950d210f" ,
"value" : "https://webdav1.storegate.com/enzevu888/home/enzevu888"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812249" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fd9-a310-4e87-b4fb-4eaa950d210f" ,
"value" : "https://webdav1.storegate.com/ordu1337/home/ordu1337"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812250" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fda-01c4-473b-aaf6-4d45950d210f" ,
"value" : "http://webdav1.storegate.com/oqokul68646/home/oqokul68646"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812251" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fdb-168c-4c83-8e3c-4c92950d210f" ,
"value" : "http://webdav1.storegate.com/enzevu888/home/enzevu888"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812252" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fdc-a3f4-4be0-8fb3-4a8f950d210f" ,
"value" : "https://webdav.cloudme.com/imin1399/xios"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812253" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fdd-3744-4672-bd97-40df950d210f" ,
"value" : "https://webdav1.storegate.com/uwiq175/home/uwiq175"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812254" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fde-249c-4132-ad29-4cfe950d210f" ,
"value" : "http://webdav.hidrive.strato.com/users/oncole3991"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812254" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fde-85e0-4f67-b8dd-4355950d210f" ,
"value" : "http://webdav1.storegate.com/ordu1337/home/ordu1337"
} ,
{
"category" : "Network activity" ,
"comment" : "2014 - sample C&C" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812255" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58806fdf-1b18-4b72-8947-4979950d210f" ,
"value" : "https://webdav1.storegate.com/oqokul68646/home/oqokul68646"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Although used for debugging only, we found that the malware author was playing around with email-based cross-site scripting, as can be seen from the following code snippet - Xchecked via VT: 21b6f2584485b8bbfffdefd45c1c72dc2133290fd8cefb235eb39cf015550316" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812277" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58806ff5-5330-4f91-8468-42f602de0b81" ,
"value" : "b5f08add2745bbed9ae4573fc9f16431cefa13f1"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Although used for debugging only, we found that the malware author was playing around with email-based cross-site scripting, as can be seen from the following code snippet - Xchecked via VT: 21b6f2584485b8bbfffdefd45c1c72dc2133290fd8cefb235eb39cf015550316" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812278" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58806ff6-1afc-4b7c-b9c9-47de02de0b81" ,
"value" : "f3802442727c0b614482455d6ad9edc2"
} ,
{
"category" : "External analysis" ,
"comment" : "Although used for debugging only, we found that the malware author was playing around with email-based cross-site scripting, as can be seen from the following code snippet - Xchecked via VT: 21b6f2584485b8bbfffdefd45c1c72dc2133290fd8cefb235eb39cf015550316" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812278" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58806ff6-889c-407f-b3b2-401902de0b81" ,
"value" : "https://www.virustotal.com/file/21b6f2584485b8bbfffdefd45c1c72dc2133290fd8cefb235eb39cf015550316/analysis/1423753823/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: d3ad32bcb255e56cd2a768b3cbf6bafda88233288fc6650d0dfa3810be75f74c" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812279" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58806ff7-2504-4521-bbb3-4a3d02de0b81" ,
"value" : "b61633975206c58df648df144c78bb3e20051d93"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: d3ad32bcb255e56cd2a768b3cbf6bafda88233288fc6650d0dfa3810be75f74c" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812280" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58806ff8-0868-4e2b-959a-42e402de0b81" ,
"value" : "b39a673a5d2ceaa1fb5571769097ca77"
} ,
{
"category" : "External analysis" ,
"comment" : "- Xchecked via VT: d3ad32bcb255e56cd2a768b3cbf6bafda88233288fc6650d0dfa3810be75f74c" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812280" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58806ff8-af9c-47f3-882f-4ace02de0b81" ,
"value" : "https://www.virustotal.com/file/d3ad32bcb255e56cd2a768b3cbf6bafda88233288fc6650d0dfa3810be75f74c/analysis/1484353398/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812420" ,
"to_ids" : true ,
"type" : "email-dst" ,
"uuid" : "58807084-6eec-49b2-b5bb-4715950d210f" ,
"value" : "tip848@gmail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812420" ,
"to_ids" : true ,
"type" : "email-dst" ,
"uuid" : "58807084-8600-417b-9bf2-47fb950d210f" ,
"value" : "deliver@hostpenta.com.xml"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812421" ,
"to_ids" : true ,
"type" : "email-dst" ,
"uuid" : "58807085-f248-4cf5-9a5f-4666950d210f" ,
"value" : "archive@hostpenta.com.xml"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812422" ,
"to_ids" : true ,
"type" : "email-dst" ,
"uuid" : "58807086-775c-4aeb-a65a-4898950d210f" ,
"value" : "tim11235@gmail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812422" ,
"to_ids" : true ,
"type" : "email-dst" ,
"uuid" : "58807086-53a0-4a37-bf8f-4b83950d210f" ,
"value" : "guess515@fastmail.fm"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812423" ,
"to_ids" : true ,
"type" : "email-dst" ,
"uuid" : "58807087-4370-4e79-b2ee-4bce950d210f" ,
"value" : "tim11235@googlemail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812424" ,
"to_ids" : true ,
"type" : "email-dst" ,
"uuid" : "58807088-8d4c-4489-9df2-4d14950d210f" ,
"value" : "dude626@gmail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812425" ,
"to_ids" : true ,
"type" : "email-dst" ,
"uuid" : "58807089-4074-41eb-ad4b-4e1e950d210f" ,
"value" : "octo424@gmail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812425" ,
"to_ids" : true ,
"type" : "email-dst" ,
"uuid" : "58807089-8f08-4b3b-9ac0-403c950d210f" ,
"value" : "plars575@gmail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1484812426" ,
"to_ids" : true ,
"type" : "email-dst" ,
"uuid" : "5880708a-3e68-48f3-8aba-4df5950d210f" ,
"value" : "purge626@gmail.com"
}
2023-04-21 13:25:09 +00:00
]
2023-12-14 14:30:15 +00:00
}
2023-04-21 13:25:09 +00:00
}
