2023-04-21 13:25:09 +00:00
{
2023-12-14 14:30:15 +00:00
"Event" : {
"analysis" : "2" ,
"date" : "2017-07-19" ,
"extends_uuid" : "" ,
"info" : "OSINT - Recent Winnti Infrastructure and Samples" ,
"publish_timestamp" : "1500477162" ,
"published" : true ,
"threat_level_id" : "3" ,
"timestamp" : "1500477123" ,
"uuid" : "596f75c0-9118-4b4c-958b-1921950d210f" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#ffffff" ,
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
} ,
{
"colour" : "#064800" ,
"local" : "0" ,
"name" : "misp-galaxy:tool=\"Winnti\"" ,
"relationship_type" : ""
}
] ,
"Attribute" : [
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "596f75fd-3e14-4f9c-9b22-4f12950d210f" ,
"value" : "On July 17, 2017, we detected a malicious document in VirusTotal exploiting CVE-2017-0199. By pivoting off of the infrastructure we learned that it is related to Winnti, a Chinese threat actor that is mostly targeting the gaming industry. Below we outline initial findings.\r\n\r\nThe malicious file, named curriculum vitae.rtf (58c66b3ddbc0df9810119bb688ea8fb0) was uploaded from Turkey."
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "596f7608-a51c-4471-a7cb-1921950d210f" ,
"value" : "http://www.clearskysec.com/winnti/"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-5e38-4179-b38d-463a950d210f" ,
"value" : "mess.googlerenewals.net"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-b8d4-4a5f-acd2-49a5950d210f" ,
"value" : "us.igooglefiles.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-7f48-4b52-bb47-41ee950d210f" ,
"value" : "signup.facebooknavigation.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-c40c-4fa3-ba53-417d950d210f" ,
"value" : "bot.new.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-92d8-4d90-a228-45d9950d210f" ,
"value" : "jp.googlerenewals.net"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-f05c-4dd0-81c8-4027950d210f" ,
"value" : "xn--360tmp-k02m.new.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-108c-4bae-becc-4d38950d210f" ,
"value" : "cdn.igooglefiles.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-1e60-4a7e-ae6f-4760950d210f" ,
"value" : "xn--360tmp-k02m.tmp.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-8030-4219-bd9f-419c950d210f" ,
"value" : "xn--360tmp-k02m.www.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-24cc-4a79-92c8-440d950d210f" ,
"value" : "ftp.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-bd8c-4e40-8c39-4184950d210f" ,
"value" : "game.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-6e60-4fb8-b145-4321950d210f" ,
"value" : "www.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-7fb0-4462-b7cf-4530950d210f" ,
"value" : "new.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-4258-4a32-b4de-4c83950d210f" ,
"value" : "bot.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-35f8-44f9-b173-4c59950d210f" ,
"value" : "vnew.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-baa8-4903-bb46-4c4f950d210f" ,
"value" : "tmp.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-8544-4b5b-811b-4d83950d210f" ,
"value" : "xn--360tmp-k02m.googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-890c-430f-8d55-42a0950d210f" ,
"value" : "hk.uk.igooglefiles.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-91e8-4f75-90ce-4843950d210f" ,
"value" : "us.uk.igooglefiles.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-7a58-447d-85a5-4448950d210f" ,
"value" : "www.uk.igooglefiles.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-24ac-48ff-87ec-4577950d210f" ,
"value" : "lead1.uk.igooglefiles.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-0c14-4477-885a-4d1d950d210f" ,
"value" : "cdn.uk.igooglefiles.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-ae98-4e9c-be52-4804950d210f" ,
"value" : "show.uk.igooglefiles.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-709c-4400-af3d-4b21950d210f" ,
"value" : "uk.uk.igooglefiles.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-4520-40e3-9e85-41c6950d210f" ,
"value" : "news.googlesoftservice.net"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-1af4-435b-ad98-4f37950d210f" ,
"value" : "news.facebooknavigation.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-acd0-4d76-8ecb-4c27950d210f" ,
"value" : "backup.aolonline.cc"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-3a3c-4cfd-bdc3-4e75950d210f" ,
"value" : "uk.igooglefiles.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "596f7628-77f8-454e-a5c0-4b68950d210f" ,
"value" : "news.aolonline.cc"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-d9b8-440f-ba05-4ae7950d210f" ,
"value" : "NSLS.dll"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-4da4-44fd-b644-449a950d210f" ,
"value" : "HelpPane.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-554c-4b80-ad04-4572950d210f" ,
"value" : "conf.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-cff8-44b0-b491-43c7950d210f" ,
"value" : "msimain17.sdb"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-f29c-4421-81d1-4cc3950d210f" ,
"value" : "shell.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-8a94-4675-8f54-4ee2950d210f" ,
"value" : "715578187~.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-fab4-4bc1-a5a6-4901950d210f" ,
"value" : "COMSysAppLauncher.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-8adc-473a-903d-4aaf950d210f" ,
"value" : "SysAppLauncher.dll"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-af34-4d5f-bff2-4ff1950d210f" ,
"value" : "curriculumvitae.rtf"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-4e74-408a-8298-446f950d210f" ,
"value" : "cryptbase.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-0868-42fc-a1ba-4c9c950d210f" ,
"value" : "sign.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-b320-4b8f-a99f-4f04950d210f" ,
"value" : "mess.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-3e98-4782-8f8a-462e950d210f" ,
"value" : "cryptbasesvc.dll"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-8e68-4af1-b6fc-49ff950d210f" ,
"value" : "video(20170201)_2.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-9f78-4939-ac5d-4f93950d210f" ,
"value" : "cryptbase.dll"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : false ,
"type" : "filename" ,
"uuid" : "596f763e-3854-402a-b7cd-4f9f950d210f" ,
"value" : "COMSystemApplicationLauncher.dll"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "596f7651-3758-4e1a-b72f-15a4950d210f" ,
"value" : "yytxconnecticut@gmail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "596f7651-8224-492c-9b12-15a4950d210f" ,
"value" : "sunware1@aol.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "596f7651-85c8-4ac5-a5a0-15a4950d210f" ,
"value" : "lileminnesota@hotmail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "596f7651-7244-45b8-ae61-15a4950d210f" ,
"value" : "dsfsaf@gmail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "596f7651-19dc-4af7-bfe1-15a4950d210f" ,
"value" : "13836469977@139.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "596f7651-7098-4c31-9b45-15a4950d210f" ,
"value" : "fuckccddeefff@gmail.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "596f765b-cc6c-4409-96e0-15a4950d210f" ,
"value" : "googlesoftservice.net"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "596f765b-1e9c-4018-aa04-15a4950d210f" ,
"value" : "igooglefiles.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "596f765b-f4f0-4766-875b-15a4950d210f" ,
"value" : "aolonline.cc"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "596f765b-d0e0-4dfe-abdb-15a4950d210f" ,
"value" : "facebooknavigation.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "596f765b-0518-420c-99ba-15a4950d210f" ,
"value" : "googlecustomservice.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "596f765b-15c4-4914-bcd1-15a4950d210f" ,
"value" : "find2find.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "596f765b-b334-4d4d-9991-15a4950d210f" ,
"value" : "tiwwter.net"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "596f765b-13b4-4ddd-abc8-15a4950d210f" ,
"value" : "luckhairs.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "596f765b-8050-4069-8070-15a4950d210f" ,
"value" : "googlerenewals.net"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "596f765b-7ab8-43ee-a96e-15a4950d210f" ,
"value" : "pornsee.tv"
} ,
{
"category" : "Payload delivery" ,
"comment" : "curriculum vitae.rtf" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "596f7674-ceb4-4a2a-9cdb-4309950d210f" ,
"value" : "58c66b3ddbc0df9810119bb688ea8fb0"
} ,
{
"category" : "Payload delivery" ,
"comment" : "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "596f768c-8644-4678-9cac-4702950d210f" ,
"value" : "a4b2a6883ba0451429df29506a1f6995"
} ,
{
"category" : "Network activity" ,
"comment" : "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) from" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477123" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "596f76b0-64f8-4079-8b95-19ef950d210f" ,
"value" : "http://54.245.195.101/shell.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) - Xchecked via VT: a4b2a6883ba0451429df29506a1f6995" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477124" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "596f76c4-cc14-4cc2-a849-442402de0b81" ,
"value" : "eee4b1c4621b0ca355dc677652dfd6449f1f230565da8cb5db59fa195e8f553f"
} ,
{
"category" : "Payload delivery" ,
"comment" : "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) - Xchecked via VT: a4b2a6883ba0451429df29506a1f6995" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477124" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "596f76c4-eff0-416f-8c82-4b0f02de0b81" ,
"value" : "79daceed3c07eaeac39c69b5c40e03cedcaaaced"
} ,
{
"category" : "External analysis" ,
"comment" : "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) - Xchecked via VT: a4b2a6883ba0451429df29506a1f6995" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477124" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "596f76c4-8b78-4bbf-8807-49d202de0b81" ,
"value" : "https://www.virustotal.com/file/eee4b1c4621b0ca355dc677652dfd6449f1f230565da8cb5db59fa195e8f553f/analysis/1500457177/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "curriculum vitae.rtf - Xchecked via VT: 58c66b3ddbc0df9810119bb688ea8fb0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477124" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "596f76c4-ddd0-4ed9-8610-472f02de0b81" ,
"value" : "1ada845dbf89024f4eee8409880ce21ece2262db3ad5129d2eed33a76d177d39"
} ,
{
"category" : "Payload delivery" ,
"comment" : "curriculum vitae.rtf - Xchecked via VT: 58c66b3ddbc0df9810119bb688ea8fb0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477124" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "596f76c4-7164-4eae-9ee1-486802de0b81" ,
"value" : "5486fd254451d90f2f6acdbfa3330444f98dde68"
} ,
{
"category" : "External analysis" ,
"comment" : "curriculum vitae.rtf - Xchecked via VT: 58c66b3ddbc0df9810119bb688ea8fb0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1500477124" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "596f76c4-0bc0-4aac-89f4-4dae02de0b81" ,
"value" : "https://www.virustotal.com/file/1ada845dbf89024f4eee8409880ce21ece2262db3ad5129d2eed33a76d177d39/analysis/1500445510/"
}
2023-04-21 13:25:09 +00:00
]
2023-12-14 14:30:15 +00:00
}
2023-04-21 13:25:09 +00:00
}
