adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/57c8398d-2238-41df-bbc7-45b7950d210f.json

271 lines
9.6 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
"Event": {
"analysis": "1",
"date": "2016-09-01",
"extends_uuid": "",
"info": "Malware Posing as Human Rights Organizations and Commercial Software Targeting Iranians, Foreign Policy Institutions and Middle Eastern Countries (ExtremeDownloader and Strealer)",
"publish_timestamp": "1472740551",
"published": true,
"threat_level_id": "1",
"timestamp": "1472740516",
"uuid": "57c8398d-2238-41df-bbc7-45b7950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#3b7500",
"name": "circl:incident-classification=\"malware\""
},
{
"colour": "#ffffff",
"name": "tlp:white"
}
],
"Attribute": [
{
"category": "Artifacts dropped",
"comment": "Payloads",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740174",
"to_ids": true,
"type": "filename|sha256",
"uuid": "57c83a33-f6d4-4791-a524-47fe950d210f",
"value": "newlity.exe|a62dde31eecf650c2dd39eeda9daf8fd35b1dff5330e72035d1846579ea838dc"
},
{
"category": "Artifacts dropped",
"comment": "Payloads",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740174",
"to_ids": true,
"type": "filename|sha256",
"uuid": "57c83a33-53e8-4a85-88cb-4c30950d210f",
"value": "private_chat.exe|1a24714fd99030bd63804ab96fc2612f148a5f08d1c2845152c3a0e168600db9"
},
{
"category": "Artifacts dropped",
"comment": "Payloads",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740174",
"to_ids": true,
"type": "filename|sha256",
"uuid": "57c83a34-7500-4033-a076-47f4950d210f",
"value": "multiplay-register.exe|e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716"
},
{
"category": "Artifacts dropped",
"comment": "Payloads",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740174",
"to_ids": true,
"type": "filename|sha256",
"uuid": "57c83a34-eb4c-4010-9c4f-432f950d210f",
"value": "TeamSpeak.EXE|13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9"
},
{
"category": "Artifacts dropped",
"comment": "Extreme downloader",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740192",
"to_ids": true,
"type": "filename|sha256",
"uuid": "57c83a34-3e24-4416-8f90-4a25950d210f",
"value": "dwm.exe|e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716"
},
{
"category": "Artifacts dropped",
"comment": "Dropper / Moreoriz",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740201",
"to_ids": true,
"type": "filename|sha256",
"uuid": "57c83a35-0c04-4523-8f40-42bb950d210f",
"value": "contask.exe|b0afef1ee97c8a9a7a7d4a83b5d8aab3a710062d9df98f909a3306c031e2cc21"
},
{
"category": "Artifacts dropped",
"comment": "Strealer",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740213",
"to_ids": true,
"type": "filename|sha256",
"uuid": "57c83a35-4ab4-49b0-80a3-43c3950d210f",
"value": "mozilla.exe|3a8995413b8e63dca766999c5a3220114e4ab4c446130c5bd7c852a618dd2fa7"
},
{
"category": "Artifacts dropped",
"comment": "TightVNC",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740216",
"to_ids": true,
"type": "filename|sha256",
"uuid": "57c83a36-7eb8-418f-8181-4bb4950d210f",
"value": "vn.exe|1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae"
},
{
"category": "Network activity",
"comment": "C2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740003",
"to_ids": true,
"type": "domain",
"uuid": "57c83aa3-897c-4a04-ba98-435d950d210f",
"value": "apache-utility.com"
},
{
"category": "Network activity",
"comment": "C2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740004",
"to_ids": true,
"type": "domain",
"uuid": "57c83aa4-42e4-40b0-a045-470c950d210f",
"value": "microsoft-hotfix.com"
},
{
"category": "Network activity",
"comment": "C2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740004",
"to_ids": true,
"type": "ip-dst",
"uuid": "57c83aa4-d7ac-4cb8-a9cb-4d31950d210f",
"value": "5.152.202.53"
},
{
"category": "Network activity",
"comment": "C2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740004",
"to_ids": true,
"type": "domain",
"uuid": "57c83aa4-99b4-4d1a-9bbb-4542950d210f",
"value": "update-finder.com"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740347",
"to_ids": false,
"type": "link",
"uuid": "57c83bfb-4838-4a75-9522-41bc950d210f",
"value": "https://iranthreats.github.io/resources/human-rights-impersonation-malware/"
},
{
"category": "Artifacts dropped",
"comment": "TightVNC - Xchecked via VT: 1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740516",
"to_ids": true,
"type": "sha1",
"uuid": "57c83ca4-d5bc-49b7-9778-48a102de0b81",
"value": "b89d8b5bd6f9bf1c1d61f0d3851dec9cf4216b9b"
},
{
"category": "Artifacts dropped",
"comment": "TightVNC - Xchecked via VT: 1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740517",
"to_ids": true,
"type": "md5",
"uuid": "57c83ca5-2308-4ce2-b870-4cc202de0b81",
"value": "a2ff24322c12558eb1f29aea3ca6f24a"
},
{
"category": "External analysis",
"comment": "TightVNC - Xchecked via VT: 1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740517",
"to_ids": false,
"type": "link",
"uuid": "57c83ca5-89ac-4e60-b7d0-4eda02de0b81",
"value": "https://www.virustotal.com/file/1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae/analysis/1452468082/"
},
{
"category": "Artifacts dropped",
"comment": "Extreme downloader - Xchecked via VT: e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740517",
"to_ids": true,
"type": "sha1",
"uuid": "57c83ca5-ec84-4e30-90f7-4f8d02de0b81",
"value": "d5144c73f7e7c961bc2823cf002892eee70c4dbf"
},
{
"category": "Artifacts dropped",
"comment": "Extreme downloader - Xchecked via VT: e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740517",
"to_ids": true,
"type": "md5",
"uuid": "57c83ca5-f860-4991-b6ee-486302de0b81",
"value": "ccaf21e122ca9d2e2397a9e28eb4cc87"
},
{
"category": "External analysis",
"comment": "Extreme downloader - Xchecked via VT: e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740517",
"to_ids": false,
"type": "link",
"uuid": "57c83ca5-971c-45a8-89ae-428d02de0b81",
"value": "https://www.virustotal.com/file/e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716/analysis/1470948989/"
},
{
"category": "Artifacts dropped",
"comment": "Payloads - Xchecked via VT: 13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740518",
"to_ids": true,
"type": "sha1",
"uuid": "57c83ca6-be84-471d-bc23-428402de0b81",
"value": "f2179dbba6a4f132864d8edd38c26991ac21559d"
},
{
"category": "Artifacts dropped",
"comment": "Payloads - Xchecked via VT: 13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740518",
"to_ids": true,
"type": "md5",
"uuid": "57c83ca6-d4e0-46d3-9a59-4e8702de0b81",
"value": "77857588c41f778b7660d4e52634a4e3"
},
{
"category": "External analysis",
"comment": "Payloads - Xchecked via VT: 13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9",
"deleted": false,
"disable_correlation": false,
"timestamp": "1472740518",
"to_ids": false,
"type": "link",
"uuid": "57c83ca6-ca38-4a27-805b-4e8702de0b81",
"value": "https://www.virustotal.com/file/13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9/analysis/1470330553/"
}
]
}
}
Reference in a new issue Copy permalink