2023-04-21 13:25:09 +00:00
{
2023-12-14 14:30:15 +00:00
"Event" : {
"analysis" : "2" ,
"date" : "2017-10-25" ,
"extends_uuid" : "" ,
"info" : "OSINT - Return of Not Petya as Bad Rabbit Diskcoder, yes those two are the same!" ,
"publish_timestamp" : "1514467209" ,
"published" : true ,
"threat_level_id" : "3" ,
"timestamp" : "1511385575" ,
"uuid" : "59f04995-3b8c-4cf0-b555-4b26950d210f" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#004646" ,
"local" : "0" ,
"name" : "type:OSINT" ,
"relationship_type" : ""
} ,
{
"colour" : "#ffffff" ,
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
} ,
{
"colour" : "#2c4f00" ,
"local" : "0" ,
"name" : "malware_classification:malware-category=\"Ransomware\"" ,
"relationship_type" : ""
} ,
{
"colour" : "#00223b" ,
"local" : "0" ,
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
} ,
{
"colour" : "#0088cc" ,
"local" : "0" ,
"name" : "misp-galaxy:ransomware=\"Bad Rabbit\"" ,
"relationship_type" : ""
} ,
{
"colour" : "#0088cc" ,
"local" : "0" ,
"name" : "misp-galaxy:preventive-measure=\"Backup and Restore Process\"" ,
"relationship_type" : ""
} ,
{
"colour" : "#0088cc" ,
"local" : "0" ,
"name" : "misp-galaxy:preventive-measure=\"Restrict Workstation Communication\"" ,
"relationship_type" : ""
}
] ,
"Attribute" : [
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "59f0499f-b1d4-4da8-898e-4056950d210f" ,
"value" : "https://mjolnirsecurity.com/return-of-not-petya-as-bad-rabbit-diskcoder-yes-those-two-are-the-same/" ,
"Tag" : [
{
"colour" : "#00223b" ,
"local" : "0" ,
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : false ,
"type" : "comment" ,
"uuid" : "59f05077-adb0-40d3-a7f1-406b950d210f" ,
"value" : "After Wannacry and Petya/Not Petya/GoldenEye, its clear that Ukraine is a testing ground for everyone to try out their malware, program different variants and perfect before launching to target their final destination.\r\n\r\nToday, we have BadRabbit and DiskCoder. When we first read about them this morning, we thought they are two separate malwares. On deeper analysis, they are both the same." ,
"Tag" : [
{
"colour" : "#00223b" ,
"local" : "0" ,
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "59f0509f-97d4-477e-9349-4cd1950d210f" ,
"value" : "185.149.120.3"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508922539" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "59f054ab-fda4-41b0-98bb-457a950d210f" ,
"value" : "dispci.exe"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59f056b0-0130-4778-a935-4593950d210f" ,
"value" : "1dnscontrol.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59f056b0-ad74-4138-b75d-4100950d210f" ,
"value" : "an-crimea.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59f056b0-9f1c-4216-ad97-4547950d210f" ,
"value" : "ankerch-crimea.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59f056b0-dc48-4b00-964c-425e950d210f" ,
"value" : "argumenti.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59f056b0-c98c-4630-8693-4131950d210f" ,
"value" : "argumentiru.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59f056b0-ba70-439d-832f-49f9950d210f" ,
"value" : "caforssztxqzf2nm.onion"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59f056b0-0534-45e3-8533-4f37950d210f" ,
"value" : "da.id"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b0-86a8-4522-b0b7-4f39950d210f" ,
"value" : "i24.com.ua"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59f056b0-1820-4e76-bf84-4b93950d210f" ,
"value" : "most-dnepr.info"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b0-dc18-40b2-b1d1-4f5a950d210f" ,
"value" : "osvitaportal.com.ua"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59f056b0-bb20-4ef8-ac04-4d30950d210f" ,
"value" : "spbvoditel.ru"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "59f056b0-e7a4-4620-8d32-4243950d210f" ,
"value" : "xhr.open"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-b8c8-4c02-8cf2-4f33950d210f" ,
"value" : "http://185.149.120.3/scholargoogle/"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-4198-4cc7-ba10-4044950d210f" ,
"value" : "http://1dnscontrol.com/flash_install.php"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-0de0-4ffa-b43c-42dd950d210f" ,
"value" : "http://an-crimea.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-50e0-4b30-bb61-444b950d210f" ,
"value" : "http://ankerch-crimea.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-5458-4721-a46f-4f16950d210f" ,
"value" : "http://argumenti.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-f094-46b2-b59c-4237950d210f" ,
"value" : "http://argumentiru.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-1ba4-48c5-8c9e-4fe2950d210f" ,
"value" : "http://bg.pensionhotel.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-4440-41f6-a67b-432d950d210f" ,
"value" : "http://blog.fontanka.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-1600-4266-b5d4-4c48950d210f" ,
"value" : "http://caforssztxqzf2nm.onion"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-c92c-49ef-b325-40d5950d210f" ,
"value" : "http://calendar.fontanka.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-facc-4b47-af46-4472950d210f" ,
"value" : "http://grupovo.bg"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-8c60-4747-94a1-4c6e950d210f" ,
"value" : "http://i24.com.ua"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-cea8-4272-81e4-4a85950d210f" ,
"value" : "http://most-dnepr.info"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-c418-4b72-9235-4e3e950d210f" ,
"value" : "http://novayagazeta.spb.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-e228-43b5-8a7a-4492950d210f" ,
"value" : "http://osvitaportal.com.ua"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-66d8-46f9-8775-48f4950d210f" ,
"value" : "http://spbvoditel.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-7a40-4389-a3bc-4767950d210f" ,
"value" : "http://www.aica.co.jp"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-b188-43f1-8a3f-42b3950d210f" ,
"value" : "http://www.fontanka.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-0b30-4f0d-919a-41ad950d210f" ,
"value" : "http://www.grupovo.bg"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-ce74-4b3c-83bf-4dc5950d210f" ,
"value" : "http://www.imer.ro"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-3978-4bc4-9fe3-42eb950d210f" ,
"value" : "http://www.mediaport.ua"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-cea4-4fd4-b3df-4759950d210f" ,
"value" : "http://www.online812.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b0-a4cc-4f30-9fe0-4b3b950d210f" ,
"value" : "http://www.otbrana.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b1-8760-49d0-b8be-41ad950d210f" ,
"value" : "http://www.pensionhotel.cz"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925665" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b1-749c-4cd8-a045-426b950d210f" ,
"value" : "http://www.sinematurk.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59f056b1-1ea8-475c-8c5c-479c950d210f" ,
"value" : "http://www.t.ks.ua"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-e470-463c-ac02-4e06950d210f" ,
"value" : "bg.pensionhotel.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-07b0-479c-9468-4d27950d210f" ,
"value" : "blog.fontanka.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-df04-4182-bb91-45be950d210f" ,
"value" : "calendar.fontanka.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-4f9c-4f1e-8673-4e58950d210f" ,
"value" : "novayagazeta.spb.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-70c0-4fd3-abd4-4154950d210f" ,
"value" : "www.aica.co.jp"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-5370-4e58-9476-415f950d210f" ,
"value" : "www.fontanka.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-a280-4719-97c4-4d98950d210f" ,
"value" : "www.grupovo.bg"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-8304-4c87-8bf6-4823950d210f" ,
"value" : "www.imer.ro"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-1030-43b1-9ce4-42a5950d210f" ,
"value" : "www.mediaport.ua"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-97e4-461a-a4da-4e97950d210f" ,
"value" : "www.online812.ru"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-3640-4eea-add8-4308950d210f" ,
"value" : "www.otbrana.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-3c20-4cfd-8def-4845950d210f" ,
"value" : "www.pensionhotel.cz"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-865c-440e-a567-4377950d210f" ,
"value" : "www.sinematurk.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59f056b1-c288-4de0-9948-44f2950d210f" ,
"value" : "www.t.ks.ua"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "59f056b1-a968-4587-9891-44fc950d210f" ,
"value" : "16605a4a29a101208457c47ebfde788487be788d"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "59f056b1-9920-4d2d-aaa2-4481950d210f" ,
"value" : "413eba3973a15c1a6429d9f170f3e8287f98c21c"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "59f056b1-1a4c-429b-ac8b-4787950d210f" ,
"value" : "4f61e154230a64902ae035434690bf2b96b4e018"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "59f056b1-3f08-4989-9daa-43cb950d210f" ,
"value" : "79116fe99f2b421c52ef64097f0f39b815b20907"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "59f056b1-ef38-427f-aa41-4f05950d210f" ,
"value" : "afeee8b4acff87bc469a6f0364a81ae5d60a2add"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "59f056b1-2c08-428c-94c5-4c41950d210f" ,
"value" : "de5c8d858e6e41da715dca1c019df0bfb92d32c0"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: de5c8d858e6e41da715dca1c019df0bfb92d32c0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "59f060e2-cfec-4adb-8022-45e602de0b81" ,
"value" : "630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: de5c8d858e6e41da715dca1c019df0bfb92d32c0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "59f060e2-0ac0-4413-8fff-4c1202de0b81" ,
"value" : "fbbdc39af1139aebba4da004475e8839"
} ,
{
"category" : "External analysis" ,
"comment" : "- Xchecked via VT: de5c8d858e6e41da715dca1c019df0bfb92d32c0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "59f060e2-0138-472b-a46a-49a102de0b81" ,
"value" : "https://www.virustotal.com/file/630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da/analysis/1508925094/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: afeee8b4acff87bc469a6f0364a81ae5d60a2add" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "59f060e2-83b8-4fda-b325-415502de0b81" ,
"value" : "b14d8faf7f0cbcfad051cefe5f39645f"
} ,
{
"category" : "External analysis" ,
"comment" : "- Xchecked via VT: afeee8b4acff87bc469a6f0364a81ae5d60a2add" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "59f060e2-4e28-44be-8e85-4da202de0b81" ,
"value" : "https://www.virustotal.com/file/8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93/analysis/1508925088/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: 79116fe99f2b421c52ef64097f0f39b815b20907" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "59f060e2-1368-44be-932f-465602de0b81" ,
"value" : "579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: 79116fe99f2b421c52ef64097f0f39b815b20907" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "59f060e2-dc68-4bf7-951d-422d02de0b81" ,
"value" : "1d724f95c61f1055f0d02c2154bbccd3"
} ,
{
"category" : "External analysis" ,
"comment" : "- Xchecked via VT: 79116fe99f2b421c52ef64097f0f39b815b20907" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "59f060e2-52b0-4714-824f-453202de0b81" ,
"value" : "https://www.virustotal.com/file/579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648/analysis/1508923756/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "59f060e2-50b0-4fff-b4e7-4dbd02de0b81" ,
"value" : "301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "59f060e2-5918-4e11-84aa-436a02de0b81" ,
"value" : "347ac3b6b791054de3e5720a7144a977"
} ,
{
"category" : "External analysis" ,
"comment" : "- Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "59f060e2-2324-47b7-8233-4c2b02de0b81" ,
"value" : "https://www.virustotal.com/file/301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c/analysis/1508918790/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "59f060e2-fadc-4b4a-9639-48e602de0b81" ,
"value" : "2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "59f060e2-5f18-4ceb-b975-499702de0b81" ,
"value" : "37945c44a897aa42a66adcab68f560e0"
} ,
{
"category" : "External analysis" ,
"comment" : "- Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1508925666" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "59f060e2-f748-4b93-a714-4b7002de0b81" ,
"value" : "https://www.virustotal.com/file/2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035/analysis/1508925098/"
}
] ,
"Object" : [
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "3" ,
"timestamp" : "1508922700" ,
"uuid" : "59f0554c-76c4-42bb-9dbc-4fe9950d210f" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "filename" ,
"timestamp" : "1508922700" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "59f0554c-c8c0-46ad-a129-4243950d210f" ,
"value" : "dispci.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1508922700" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "59f0554c-e344-4c46-96d0-435c950d210f" ,
"value" : "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
}
]
}
2023-04-21 13:25:09 +00:00
]
2023-12-14 14:30:15 +00:00
}
2023-04-21 13:25:09 +00:00
}
