2023-04-21 13:25:09 +00:00
|
|
|
{
|
|
|
|
|
"Event": {
|
|
|
|
|
"analysis": "2",
|
|
|
|
|
"date": "2018-04-17",
|
|
|
|
|
"extends_uuid": "",
|
|
|
|
|
"info": "OSINT - Talos/Cisco Threat Roundup for April 6 - 13",
|
|
|
|
|
"publish_timestamp": "1524215579",
|
|
|
|
|
"published": true,
|
|
|
|
|
"threat_level_id": "3",
|
|
|
|
|
"timestamp": "1524215517",
|
|
|
|
|
"uuid": "5ad5bc00-d988-48bb-9293-2135950d210f",
|
|
|
|
|
"Orgc": {
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
|
|
|
},
|
|
|
|
|
"Tag": [
|
|
|
|
|
{
|
|
|
|
|
"colour": "#ffffff",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "tlp:white",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215228",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad5bc17-d2b4-4902-8453-2133950d210f",
|
|
|
|
|
"value": "45.77.68.17"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215228",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad5bc17-bb60-4d19-a86c-2133950d210f",
|
|
|
|
|
"value": "45.32.78.78"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215229",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad5bc18-7ee8-4354-ba91-2133950d210f",
|
|
|
|
|
"value": "45.63.57.87"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215229",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad5bc18-1580-4efa-b81c-2133950d210f",
|
|
|
|
|
"value": "173.192.16.184"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215229",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad5bc18-346c-4a97-a0f9-2133950d210f",
|
|
|
|
|
"value": "174.37.56.249"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215230",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5ad5bc27-d3f0-4174-86a2-2105950d210f",
|
|
|
|
|
"value": "gpt9.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215230",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5ad5bc28-8c90-49e9-8dd9-2105950d210f",
|
|
|
|
|
"value": "optcdn.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215231",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bc28-15b0-4355-836e-2105950d210f",
|
|
|
|
|
"value": "www.userbest.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215231",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5ad5bc28-6cd4-4054-8e52-2105950d210f",
|
|
|
|
|
"value": "optitm.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215232",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5bc34-d378-4050-9152-2134950d210f",
|
|
|
|
|
"value": "https://blog.talosintelligence.com/2018/04/threat-round-up-0406-0413.html"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc56-ba44-4b4d-a342-4a3d950d210f",
|
|
|
|
|
"value": "599d9e37c39ec47a50b512e01449a37ff3c3354ed0b9b4de2ca7e8f2d3a33bfa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc56-ae30-40dd-b2ac-49b9950d210f",
|
|
|
|
|
"value": "4d0f0b7c9a3b8694895275fcc45aa1df3e6f2ad0c58563a40ac80776c705f821"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc57-a220-41bf-94f1-457a950d210f",
|
|
|
|
|
"value": "0aeb76bb929ea68275b904412054c3b15a73fd6479ee3daecd5ffd4c407eb721"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc57-1784-41fc-b9b5-4dae950d210f",
|
|
|
|
|
"value": "c76394aaf293cbf4bf3b9d7a94c251feac11435204664d700bb4bd87da3c1898"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc57-c3f8-4904-8e25-4e98950d210f",
|
|
|
|
|
"value": "66c2586add3eac9184972cfc7a6172532c16dc0d1e1f874e4cd3fa2276657c2a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc58-2758-4247-bcc6-4aac950d210f",
|
|
|
|
|
"value": "02cb3c5568577ed9658fcf68b9f776d720e2f7355090b10875f0f9bb2b8ed161"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc58-adf0-4b60-806e-4abb950d210f",
|
|
|
|
|
"value": "5f7f8a6fd32cf4d91efe01c2f1b7c4fd5f509b504af134a08c6c688ba9597ea6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc59-4570-49e8-88fb-431d950d210f",
|
|
|
|
|
"value": "3c9c3423951655b97251bf5d3d12fe59fcf96d4274c4887b88744438371fe61b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc59-8f48-4308-8bfb-49d8950d210f",
|
|
|
|
|
"value": "4e496591b9c2c9722c07746edfc7892b178b8965bb4c452322caab68b2d5f262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc59-aa78-41b1-9d73-46bb950d210f",
|
|
|
|
|
"value": "2eed2f22d055d605a8387d35610e4e82815eb29b7212de12088202efa54d3c31"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5a-de94-4d91-901d-4658950d210f",
|
|
|
|
|
"value": "0073f6d57c2e4ca1871dc1a5e270160e734b2d79bd9b7b55b82a8ddc53aaac0f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5a-4b04-477d-890c-4d36950d210f",
|
|
|
|
|
"value": "c21fdd9a5d244aed75890c59094789c2f46815983084f4bc5966ae28630908a8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5b-7e08-4f15-af49-478d950d210f",
|
|
|
|
|
"value": "98f7b5afa98edbfcb4a6f502d9d29e6bb0912a6bcb7a14abe3a9a60e0487b201"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5b-f808-4a39-b552-4db5950d210f",
|
|
|
|
|
"value": "c7e92cc3f88c7180e2774f2641c593ebebedee3424314fdd8fa8365f6cd0000a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5c-da98-4b7a-b9f6-4201950d210f",
|
|
|
|
|
"value": "1937b1e07be1737d79a3a4b1ea9c5ab0a56f1c3ce44d2e34d705a7b69b9346cd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5c-c52c-4d38-8067-450f950d210f",
|
|
|
|
|
"value": "310848da5dd6e75c8df5bc00223582a7b7e6fbef90ca45222948eaba546be3bd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5c-5da8-42af-951d-4d53950d210f",
|
|
|
|
|
"value": "40a0f808c1fd873c364850d95e2f0adb0ca24740945702de5c0552a5afc60612"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5d-e9b0-40b1-acc7-44b3950d210f",
|
|
|
|
|
"value": "b609c46124d069b2299de3896a5cc2f7540e4effcba462e7f5300573666efd4a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5d-fd5c-4e4e-980c-49e6950d210f",
|
|
|
|
|
"value": "d7e95936470c9747f9c803d3839159e86112afbe49d68b578775f1c29141d502"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5e-ec34-4911-b09f-4b75950d210f",
|
|
|
|
|
"value": "036d8c2a089ea0870fa37060c96928789a8b373ca0795d1c06db443b53dc5882"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5e-d19c-4bc2-bcd7-4bef950d210f",
|
|
|
|
|
"value": "2b7662b93abcd312eb2c4d66c246af9dc7c43a511fae5dddd11617bf2ced16c3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5f-fe68-49c6-a3c9-4a6e950d210f",
|
|
|
|
|
"value": "5795c26debe0c06d1f1968730a84efeed69f0493b23f8411b3ea60781e7a24a7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc5f-1d74-4651-a100-450a950d210f",
|
|
|
|
|
"value": "6856286bb8ac5961f58831e7e4fa6debe7a4a399e5ffa56d37e7ca78f1588871"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc60-df30-4572-bdf6-47f5950d210f",
|
|
|
|
|
"value": "6db67b808d476e3412034571798447aafbbe320a0884a417a7d7fae604440c6e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523956843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bc60-0670-4423-ad02-4b87950d210f",
|
|
|
|
|
"value": "acaa87b92f1e2ee316033624e4760ca4f9c781e82b72949c46861c7652cf74c2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215232",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad5bca9-d554-437a-bcaa-46f8950d210f",
|
|
|
|
|
"value": "66.171.248.178"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215233",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bcbe-06c4-474e-ab97-4145950d210f",
|
|
|
|
|
"value": "dns1.soprodns.ru"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215234",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bcbe-780c-4a6d-bfbf-4fd4950d210f",
|
|
|
|
|
"value": "ipv4bot.whatismyipaddress.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215234",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad5bd2a-1fdc-4e2b-bf6d-2135950d210f",
|
|
|
|
|
"value": "198.54.117.217"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215235",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad5bd2b-4298-4151-a76a-2135950d210f",
|
|
|
|
|
"value": "68.65.121.51"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215235",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad5bd2b-dac8-4912-aec3-2135950d210f",
|
|
|
|
|
"value": "104.200.23.95"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215235",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad5bd2b-7418-468b-ae9d-2135950d210f",
|
|
|
|
|
"value": "104.250.149.195"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215236",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bd4d-1490-4fae-95c6-4454950d210f",
|
|
|
|
|
"value": "www.atopgixn.info"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215236",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bd4d-4a24-4c7e-b423-4ea0950d210f",
|
|
|
|
|
"value": "www.gstringguitarco.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215237",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bd4e-5980-4712-9599-4250950d210f",
|
|
|
|
|
"value": "www.mymugcity.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215237",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bd4e-af4c-41b7-a076-4962950d210f",
|
|
|
|
|
"value": "www.snhvwa.men"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215238",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bd4f-2c18-405a-adab-43d6950d210f",
|
|
|
|
|
"value": "www.mankafei.net"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215238",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bd4f-71ac-439d-a73d-45fd950d210f",
|
|
|
|
|
"value": "www.9999zh.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215238",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bd4f-52ec-437a-997b-414b950d210f",
|
|
|
|
|
"value": "www.dltecgeradores.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215239",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bd50-e740-490f-86fa-4ee2950d210f",
|
|
|
|
|
"value": "www.zswlu.info"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215239",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bd50-f0d0-47a7-a915-4991950d210f",
|
|
|
|
|
"value": "www.bitstubs.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215240",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad5bd50-a1cc-4857-aa5d-44f2950d210f",
|
|
|
|
|
"value": "www.allsystemstoupgrades.win"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215240",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd6d-0178-4d74-8d40-4ba1950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0\\K27logrv.ini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215240",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5bd6e-7378-4136-8027-41a4950d210f",
|
|
|
|
|
"value": "%TEMP%\\Gsdf0d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215241",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd6e-c170-4c8b-856b-4635950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsnD1EF.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215241",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5bd6e-86dc-418e-9aa9-4362950d210f",
|
|
|
|
|
"value": "%TEMP%\\zvu"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215242",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd6f-2d30-421e-9ba1-430d950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0\\K27logim.jpeg"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215242",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd6f-e854-47a9-9995-4661950d210f",
|
|
|
|
|
"value": "%ProgramFiles(x86)%\\Microsoft\\Windows\\WebCache\\WebCacheV01.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215242",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd70-aa20-4e06-9194-4635950d210f",
|
|
|
|
|
"value": "%TEMP%\\nstD210.tmp\\System.dll"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215243",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd70-1c58-4be6-aef8-4f0e950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0\\K27logri.ini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215243",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd70-c500-4493-9481-4d18950d210f",
|
|
|
|
|
"value": "%TEMP%\\Gsdf0d\\mshlg4q6x.exe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215244",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5bd71-4894-4eb5-a879-493a950d210f",
|
|
|
|
|
"value": "%ProgramFiles(x86)%\\Gsdf0d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215244",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd71-a870-415f-8710-4ae5950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsc8B5E.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215244",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd72-a33c-4f97-8452-4c2d950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0\\K27log.ini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215245",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd72-8f20-4bf5-9743-43ec950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsi8B7F.tmp\\System.dll"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215245",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd72-706c-4609-92d7-4930950d210f",
|
|
|
|
|
"value": "%ProgramFiles(x86)%\\Gsdf0d\\mshlg4q6x.exe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215246",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd73-a3b0-4af3-ba12-47f1950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0\\K27logrc.ini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215246",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd73-6a70-4b8b-af9b-4afc950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsi8B7F.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215246",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5bd74-37f4-46c9-a6bc-459a950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Files and or directories created",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215247",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bd74-85b4-4cf0-919e-4868950d210f",
|
|
|
|
|
"value": "%TEMP%\\nstD210.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957141",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd95-354c-49a7-95bf-2135950d210f",
|
|
|
|
|
"value": "44f6b3cea3a371a7cd6161739dcc6f9f96a40c8c732b1acd8042a2991a9bbf73"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957142",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd96-3784-4d69-a211-2135950d210f",
|
|
|
|
|
"value": "d62ee1186d8a8c7d84b2a03e0bee1c13c47d133a55238ba7c367f9539e6c9b17"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957142",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd96-1d30-4389-9fb6-2135950d210f",
|
|
|
|
|
"value": "df9f1a4e2cb4247132c7442aedfe873c5e801ab048e0236407066c3acd5ec79b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957143",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd97-e4b4-4de5-95ab-2135950d210f",
|
|
|
|
|
"value": "d8f1f59b81a985f538fc0a51c85c688794f94b28a06883ba9dadfb4b0c8bccd6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957143",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd97-6bbc-4b0b-9aa6-2135950d210f",
|
|
|
|
|
"value": "2ca04f3c65e3fd16b9c879c7db4cc8025279463dbb965e3954e35106fe952e86"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957144",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd98-ed34-4052-ae05-2135950d210f",
|
|
|
|
|
"value": "3538c0a7785ab6d418112d10cd6844ded5745064840d18d74d9b978dea1fe1a9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957144",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd98-cf6c-4d74-a084-2135950d210f",
|
|
|
|
|
"value": "09cc6c9e39425a71ccdc26ffd8a67179043b20f646286685eea24e6bb00b12d9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957144",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd98-e250-4bd5-a891-2135950d210f",
|
|
|
|
|
"value": "725752c4bda82acf554aad37fe97d08f4367c9a1e5d40b6fe17cdc94adf040fc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957145",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd99-d9a0-47ea-a8be-2135950d210f",
|
|
|
|
|
"value": "3d756dcf4397cb6b0d406b9f70eb18029965fce0110c0290af6ad73468aa2c1f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957145",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd99-4084-48e3-b142-2135950d210f",
|
|
|
|
|
"value": "ef4d20220eaecedc0b3069192843bd5eddc196b25a9e083fd16d19ae100374df"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957146",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9a-a804-41f0-a284-2135950d210f",
|
|
|
|
|
"value": "70d50a77db7cb028163638a7e58c354e1fbab4757323ad9eccfb51e9b257f83c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957146",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9a-95c0-4312-a2af-2135950d210f",
|
|
|
|
|
"value": "35c996576eba666a33e26bc25122196de365465da8ebee70930b9c4ec6be7313"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957146",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9a-6830-4f10-9018-2135950d210f",
|
|
|
|
|
"value": "330a8b46f74f5d4af759b18db64dfd9af2ef3e429d597cd4522148fb78633000"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957147",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9b-2c78-44ff-85f3-2135950d210f",
|
|
|
|
|
"value": "ac6fbd8f18bb93cfac31af73eb9cf6a1aa925b95d44b42b3659ecfd49209ec76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957147",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9b-8d54-4ba2-b249-2135950d210f",
|
|
|
|
|
"value": "711155de0073adc2f68fc4088253f92f43a696bbf5d8f892f902724be37668f3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957148",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9c-cad0-43fd-892d-2135950d210f",
|
|
|
|
|
"value": "c1e6324086192a47c60daee91f9f906c2ceb03cac0c67a8ed3f0a31c37e3a991"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957148",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9c-f994-4ea5-8975-2135950d210f",
|
|
|
|
|
"value": "5301f9401c7d7ac485d0169085222c64ec2de6f14783cad6150b7c6f0f368c7c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957148",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9c-031c-40d6-98bf-2135950d210f",
|
|
|
|
|
"value": "96847279dd3564a5d689bf310483fe351fac55e54a440d15e55f0bb7d35baab6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957149",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9d-e554-4fc7-ba1d-2135950d210f",
|
|
|
|
|
"value": "aebb84da20c2c92da398b1e5fcc8adc6bfe893d5a8b56c5cd1beb42b3fa5f069"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957149",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9d-1e1c-434f-bbb3-2135950d210f",
|
|
|
|
|
"value": "2a0904b6301b42ed0838633b161c947a781600fc884b0fc499f906a49ea38292"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957150",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9e-5030-431e-8562-2135950d210f",
|
|
|
|
|
"value": "0e1c8a62bd632cd364d16dcf0839531c8dcb443269f4478f301e4adf758977a6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957150",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9e-30e8-4ffa-968b-2135950d210f",
|
|
|
|
|
"value": "f34354749657c44beee0b1d7f5cdc4a31c858eab565fc2592f96c69eb9d501e1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957151",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9f-7848-4529-bb8e-2135950d210f",
|
|
|
|
|
"value": "8ecfcfc939e40cc943df83f548286c2f7f519a53e195b3ae595e0bef39baee29"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957151",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9f-a110-4657-ae42-2135950d210f",
|
|
|
|
|
"value": "21178d6e06ded3b1a43e98eb781220c37e729ef081bd160f168fc465313ea4ff"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957151",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bd9f-daa4-41b1-8eaa-2135950d210f",
|
|
|
|
|
"value": "ef4b97346e1ee359feff43d136f3dd6031993fb47bdfd25520b4fc3279d3649b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215247",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-9404-45af-be5e-2443950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0\\K27logrv.ini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215248",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-be08-40da-84a4-2443950d210f",
|
|
|
|
|
"value": "%TEMP%\\Gsdf0d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215248",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-9c44-4bf6-afee-2443950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsnD1EF.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215249",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-76fc-4b80-bced-2443950d210f",
|
|
|
|
|
"value": "%TEMP%\\zvu"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215249",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-eb9c-472a-8557-2443950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0\\K27logim.jpeg"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215250",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-ac8c-40ef-b307-2443950d210f",
|
|
|
|
|
"value": "%ProgramFiles(x86)%\\Microsoft\\Windows\\WebCache\\WebCacheV01.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215250",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-6ea8-407f-95c6-2443950d210f",
|
|
|
|
|
"value": "%TEMP%\\nstD210.tmp\\System.dll"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215250",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-1f94-4184-b3e3-2443950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0\\K27logri.ini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215251",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-e660-4caf-90e5-2443950d210f",
|
|
|
|
|
"value": "%TEMP%\\Gsdf0d\\mshlg4q6x.exe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215251",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-ad90-4ea3-9e89-2443950d210f",
|
|
|
|
|
"value": "%ProgramFiles(x86)%\\Gsdf0d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215252",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-56ac-4c9f-9041-2443950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsc8B5E.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215252",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-ed08-4849-bd91-2443950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0\\K27log.ini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215252",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-8940-486f-9da7-2443950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsi8B7F.tmp\\System.dll"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215253",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-0ffc-473b-8bec-2443950d210f",
|
|
|
|
|
"value": "%ProgramFiles(x86)%\\Gsdf0d\\mshlg4q6x.exe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215253",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-9528-41d6-aac3-2443950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0\\K27logrc.ini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215254",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-26d4-4a61-a6f6-2443950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsi8B7F.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215254",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-2bfc-420c-833f-2443950d210f",
|
|
|
|
|
"value": "%AppData%\\K27P0CT0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Files and or directories created - Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215255",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5bea5-4c18-42bd-9eec-2443950d210f",
|
|
|
|
|
"value": "%TEMP%\\nstD210.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957478",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bee6-e57c-4fb9-ba55-2134950d210f",
|
|
|
|
|
"value": "082f1ce18a378ec6eb67565fb7bd89cd29db886b44fe4312a863382af9e13df7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957479",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bee7-50fc-4a49-b96d-2134950d210f",
|
|
|
|
|
"value": "0e1d3984bd6c33ba0fc108329e3906bd074d70ed44a4c7fa6d8f857531bbc437"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957479",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bee7-50d8-4a9d-abb0-2134950d210f",
|
|
|
|
|
"value": "380545cfde4acaf2c29969d175db1cecd28c5691693e097e52da5c0e886a8301"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957479",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bee7-bff0-428b-9e2c-2134950d210f",
|
|
|
|
|
"value": "13da7abee3f2ea4275c1434900db5ba9f620fde8743eb0ff2388b32897685e0b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957480",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bee8-3f50-41ef-9cf6-2134950d210f",
|
|
|
|
|
"value": "9dc0c514ea1aaa91c1255857cb261bd6c94f8565ffef4420b75c5d5320717b09"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957480",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bee8-bf58-4dd4-875a-2134950d210f",
|
|
|
|
|
"value": "30103085dd67ac6e9bdf14255fc5c8b697d68b810e732b4ae29798b62e5ad677"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957481",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bee9-bec0-44e4-a6d2-2134950d210f",
|
|
|
|
|
"value": "663ecdfa115605418b2826e4de7e289b0cd12849b719c7a171ee7524bf22fe99"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957481",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bee9-016c-4288-a267-2134950d210f",
|
|
|
|
|
"value": "cc203d955e3e33479423f7b2aea1f13c2ba5895da16159a779407e03e747d116"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957481",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bee9-610c-41ee-9b39-2134950d210f",
|
|
|
|
|
"value": "3784e5b40ff8687265efe5dacfd5b6c9d744fe294f425703ddafbf687192eb8e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957482",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beea-4204-4cc4-9acf-2134950d210f",
|
|
|
|
|
"value": "0a52739b2a45b1002b78230df60dd42d2ffa0897197953639dd627bcc0454134"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957482",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beea-41f8-4227-ad39-2134950d210f",
|
|
|
|
|
"value": "1824bb4ea96c6107c6660b104d60073be3a9f5c3bdbbc2c801771fc34a03e01c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957483",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beeb-8114-421c-81fc-2134950d210f",
|
|
|
|
|
"value": "a1175ff8f5544f4ec078e4d55db4b6aff7a7844e9df2057d3fe906cfa77d25f0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957483",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beeb-4c24-49b5-8ea1-2134950d210f",
|
|
|
|
|
"value": "61dede4113d1eda504f7360ae535cd88ede9425722db4a43577185d0312acd5a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957484",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beec-7568-4a94-85b2-2134950d210f",
|
|
|
|
|
"value": "ac755dfabf99ea6fc8c334dcef526d1dce3680200deeaac5e80077a27042af9c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957484",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beec-a088-46a9-93ae-2134950d210f",
|
|
|
|
|
"value": "786c1b55e5e73fd3c2231d7e6fa0565aacb4fb239807f42c2f0cb83f57186271"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957484",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beec-e600-4b55-9e92-2134950d210f",
|
|
|
|
|
"value": "4e27ccfd0c90aab501d16d45b1e9d13bde3e2d6c2ba6d230b7973dcc8567e556"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957485",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beed-0220-4adf-9ea2-2134950d210f",
|
|
|
|
|
"value": "c7dcf76652af54cf4cbbfdfc4fa5cc8d4a8e1807d478eceee32270260dbfecf7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957485",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beed-73f0-40ba-a922-2134950d210f",
|
|
|
|
|
"value": "228ffe97f34e097a0cb3b3288ee56a063da65d890b1f888d59d59f0ad2b3bb71"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957486",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beee-b710-4fe7-8159-2134950d210f",
|
|
|
|
|
"value": "39c05a8b0d635eb221023154423dd3e26c93d16bb5a16a2512c68bde62996023"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957486",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beee-39c8-495b-a7b5-2134950d210f",
|
|
|
|
|
"value": "6bd38baca4b923c26628e9dcf9ee64d8bcc5c4ba9cb9f2298e32f8db7816de08"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957486",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beee-1e90-4d38-a935-2134950d210f",
|
|
|
|
|
"value": "cb2155b65879f66eb449b60a90c632c701fbea7ac8d4011e3b24b238c3302de0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957487",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beef-b80c-4f61-bfb4-2134950d210f",
|
|
|
|
|
"value": "8fdabcedb02b4ae9364e53f38738710a1f6e9851077c29dbda34cf934229b47d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957487",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5beef-7498-49aa-abd0-2134950d210f",
|
|
|
|
|
"value": "fdb559a29e0374fa7ce71d8661400fcc2d2db7d3486822a5cf1e0eba5c5634c8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957488",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bef0-b040-4436-b953-2134950d210f",
|
|
|
|
|
"value": "4a6043017f598162263d52315c79bfcb5fbef86f19d51beb718fe8093dc1af16"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523957488",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bef0-511c-42ee-8fe7-2134950d210f",
|
|
|
|
|
"value": "2f9ca1b196aa915e3c87dabe20f353a4a69ee5998f8559ef8073194918dc7ea9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215255",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mutex",
|
|
|
|
|
"uuid": "5ad5c543-92b8-4648-af41-45a0950d210f",
|
|
|
|
|
"value": "\\BaseNamedObjects\\00291FDE1ED259137753E922"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215255",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad5d370-bae8-429c-862d-4a8c950d210f",
|
|
|
|
|
"value": "101.99.75.151"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215256",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5ad5d371-c774-497c-8e27-4706950d210f",
|
|
|
|
|
"value": "makewebomb.xyz"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962787",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a3-e298-4956-989d-243b950d210f",
|
|
|
|
|
"value": "b4abd9556f093b7d80bdc755d502917310a807d5ee9d9f9bac19bb0c8d596dbc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962788",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a4-07a4-49e5-9c58-243b950d210f",
|
|
|
|
|
"value": "1ca88b2c00b625bf596b93abafae873a6aec5bf1afeee1e116dc402cae69f83a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962788",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a4-3bc0-42e1-b7cc-243b950d210f",
|
|
|
|
|
"value": "3f2925b26b0f0b0f141346d8a654a74704d9326492537de17518bd6fb11671e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962789",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a5-f828-4ef1-b2ea-243b950d210f",
|
|
|
|
|
"value": "ba0a2f6e001bc9c02ee8c5fbcd6cceaa74ced5ec058dfda71623146f06ff2490"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962789",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a5-f920-4475-afea-243b950d210f",
|
|
|
|
|
"value": "f68b0c32da95c0fb06c4cefb992e1a0039afed32f6cfcef083db39a0702a06c7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962789",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a5-dc18-4c46-be57-243b950d210f",
|
|
|
|
|
"value": "61ff6f5d48f02c0a5b7a28936f8aa9ebad2344f3552608fae2ce3f14a9bf14d4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962790",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a6-de3c-4eb1-ac25-243b950d210f",
|
|
|
|
|
"value": "a7d667e9d67d4b7db00c52572ca1e945b1aba8139dce9c647b8b9bce89ba45e0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962790",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a6-1fb8-4ff9-b1c9-243b950d210f",
|
|
|
|
|
"value": "6a1a4a21545538c2dd34ba9beec07cbfe17c8ff65a10f1bcdf8598a8f1b58e42"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962791",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a7-cbd0-42f5-aa2e-243b950d210f",
|
|
|
|
|
"value": "85d0021f75a2d312a27bc1c17702d09520006aff590d439a90d8045d2325a04e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962791",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a7-c294-49cf-ac38-243b950d210f",
|
|
|
|
|
"value": "09574981553c2729c9779beee8e6007734f932a155de278eb46d9fc557c39400"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962791",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a7-dba4-4f49-a12c-243b950d210f",
|
|
|
|
|
"value": "e981fd64b4c1f1d50cdf3f21d3cd07dfb04dec58c518bee8697a187069997498"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962792",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a8-4e2c-4dbe-9db6-243b950d210f",
|
|
|
|
|
"value": "7c83266775aceac7e54b9d7db2620245520a52e854a5e61f5c5f2452a60432de"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962792",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a8-c514-46bc-a3e1-243b950d210f",
|
|
|
|
|
"value": "3ed671f4ea7e92ef0e0bf61e7bacc0b7a2a82ccea73a53e7cde66e3497a86520"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962793",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a9-e248-4f8c-b955-243b950d210f",
|
|
|
|
|
"value": "97702356739358d428d1e7c7ddcc8aa08379562b290edb12348cae2bc0ddbb32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962793",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a9-7924-4802-ba83-243b950d210f",
|
|
|
|
|
"value": "9c6def0cb6963372a10888e6f702d80381559a29db1da32ab149273b3d10ca34"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962793",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3a9-c654-4aa7-9bd9-243b950d210f",
|
|
|
|
|
"value": "df58773cc519e82a8beebeca8035018168cb3cb26aa491aae89c8d68cec835a7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962794",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3aa-fbc8-422b-93f5-243b950d210f",
|
|
|
|
|
"value": "5eb40ac46872c6d26cd7ebdb0938a9375d7cdf28017a5c625d890a7d2ba7852d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962794",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3aa-0b2c-491a-9b07-243b950d210f",
|
|
|
|
|
"value": "afcdd2fda5b3c9e78a977df31be307ea7323b746e07e35e4d3c39a3a3f4b4b79"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962795",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3ab-9598-4729-821c-243b950d210f",
|
|
|
|
|
"value": "a854a9702c14be3508d35873e80577ee9b1296c993ee2a4269c283884775564e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962795",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3ab-1980-401f-af4c-243b950d210f",
|
|
|
|
|
"value": "431e6a8252837a5e1c7c98aa9b72c1df4b21e34ae8c7e73882294097f140466e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962795",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3ab-ceb4-4edf-b75e-243b950d210f",
|
|
|
|
|
"value": "1d7a1a4181706379a7f80ed926c47cb0ebc7beb953739c9b41cec20093c63914"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962796",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3ac-f5a0-48d0-948a-243b950d210f",
|
|
|
|
|
"value": "7b24f0523af239668ee8946c433c53d0c233b0290bbaca405885d39dff86fa1f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962796",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3ac-1ac4-4e14-af1f-243b950d210f",
|
|
|
|
|
"value": "444147472ba54f1f58776a84e98152ae28dfbca23602cb440a830fddd4a283cf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962797",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3ad-b024-4bd7-9640-243b950d210f",
|
|
|
|
|
"value": "b33436701b6a54b78141a2812264f4b3ee93ac0a5ae0149e636e7db8c4f38a28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523962797",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5d3ad-599c-4727-8962-243b950d210f",
|
|
|
|
|
"value": "e5d34b53cb6e4e111e167cf13b608b87f7ab7d43d7f08f995ae9f2c1139e8f51"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215256",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5ad5d964-4598-41ca-9c0f-a0a3950d210f",
|
|
|
|
|
"value": "gandcrab.bit"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215257",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5ad5d964-11b8-4b37-a4f1-a0a3950d210f",
|
|
|
|
|
"value": "nomoreransom.bit"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215257",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5ad5d964-d98c-404f-8a50-a0a3950d210f",
|
|
|
|
|
"value": "nomoreransom.coin"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215257",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5d9ac-c5ac-4c4e-8211-a1d4950d210f",
|
|
|
|
|
"value": "%LocalAppData%\\Microsoft\\Windows\\WebCache\\WebCacheV01.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215258",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5d9ad-7214-4623-bdc6-a1d4950d210f",
|
|
|
|
|
"value": "%LocalAppData%\\Microsoft\\Windows\\Temporary Files\\Content.IE5\\SSZWDDXW\\W7RSB4SE.htm"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215258",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5d9ad-0f34-4b2d-9f8e-a1d4950d210f",
|
|
|
|
|
"value": "%AppData%\\Microsoft\\zkwnlf.exe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970293",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0f5-1140-4653-a5ee-4b3b950d210f",
|
|
|
|
|
"value": "4605f6041d93c6390c1ed856336c01a6cf3982bea1987c6de846752ca7006882"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970294",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0f6-4e00-4a26-a357-4ffb950d210f",
|
|
|
|
|
"value": "a10aefc70a3d3512cf54f74e39b3ee5cc5403c003179c57aeea7fb3895ed8ace"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970294",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0f6-8b6c-4695-bd9d-4c5b950d210f",
|
|
|
|
|
"value": "a0365a881396fa66719255cd617e5ef7e175343f28b7ee7ec347bf87811274c0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970295",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0f7-88ec-437c-984f-4014950d210f",
|
|
|
|
|
"value": "05be7b2de818dcb358a4f24d6050ae2b91d728c80a8af279894b5e701b060926"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970296",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0f8-c34c-457c-aeb3-4438950d210f",
|
|
|
|
|
"value": "a32a315ae45f62d26cdd22281a69932c83f147fc4e820a9cc7bf05bcc4680777"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970296",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0f8-5860-4a44-93bd-4ba2950d210f",
|
|
|
|
|
"value": "6bd49db136718b3cef01348bc839e206d566a1e1c32e0537be61dfa2ee87de6b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970296",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0f8-1bb8-4caf-b2e7-431d950d210f",
|
|
|
|
|
"value": "a677a593cebda3734ab26828b65fd93b54bbc02199a080a26da61afcff29ae48"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970297",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0f9-6a40-46c1-bd92-45c3950d210f",
|
|
|
|
|
"value": "84c269a1661a987058f51dea4644ec2703b28170324fbeab6920e40ad1a05a54"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970297",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0f9-63f8-4f8c-97a5-4e18950d210f",
|
|
|
|
|
"value": "ad7c7472d980025e3edbab89988fec2d5776b4f72b0757c2b1dac54d1c991c37"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970298",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0fa-6de8-4b15-8027-4191950d210f",
|
|
|
|
|
"value": "877d9c4195c38a9dc55c472f7c72ec3d6ad0d95a544458a2050edf22df3aac5c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970298",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0fa-1df8-4e66-90d0-4557950d210f",
|
|
|
|
|
"value": "0a6cabedfabfbab3fba2057d30b1faab2f1b2d2d47a6227aa3b677af45f92da2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970299",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0fb-7134-4d0e-b0f5-4eb3950d210f",
|
|
|
|
|
"value": "683339b58c7cbc066f84c625efa0248eb89bfcd24de916f5fe600c33867084e7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970299",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0fb-74dc-43d0-8b39-43ce950d210f",
|
|
|
|
|
"value": "7bc897c2c55ff708cbccff1461d2406aaef7953686817bd2d6a39ad58af393f9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970300",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0fc-f2e4-4b91-8b27-4d61950d210f",
|
|
|
|
|
"value": "e1e31a797b01f5f4ec694fb03d894e5ab331f41f3bc8c34bb407d390554bfe3a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970302",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0fe-67fc-464c-b0d2-4bb6950d210f",
|
|
|
|
|
"value": "fa8c301685d5ceb6a97b75f3bb665871e3ddf5b47410179dd7a55f4f3cebf4ab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970303",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0ff-657c-457e-a74e-4b17950d210f",
|
|
|
|
|
"value": "9b4536855237fe80447950bf86d1177489dbc1b231122e4a5d2157ba93c1b504"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970303",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f0ff-e98c-4f46-a8fd-4980950d210f",
|
|
|
|
|
"value": "19a5f6fc34e531409c787b00444671b44a5c11dec0dafab0e0ef699de29eea6d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970304",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f100-1c08-4320-b4d4-428b950d210f",
|
|
|
|
|
"value": "b4e2b99c18bf61acedaff5b1908a212470eb902ddfe8e164e01ffcfbab19834b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970304",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f100-2800-496f-993a-4b96950d210f",
|
|
|
|
|
"value": "db5b0bb4d05292e6649fa84f076195d7a0cfb15516ce386f214dc2dd96a5e467"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970305",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f101-9ff0-4170-a6a9-4b43950d210f",
|
|
|
|
|
"value": "11117fe96292e5d5702f2c82e4b21c3cbc4234f13417b22ad963a9f746978482"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523970305",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5f101-3e6c-4095-9810-4b7d950d210f",
|
|
|
|
|
"value": "33ab8e652c16836caf3b22518485757f417fab73a92e916f0c6aaf27b57f3be4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215259",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f210-eda0-4291-ac47-4b67950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsy4211.tmp\\GetVersion.dll"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215259",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f211-bf5c-4b0b-97b3-4038950d210f",
|
|
|
|
|
"value": "%System32%\\pwkmbru\\dsieovx.sys"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215260",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f211-bd54-47d6-bb3a-4a99950d210f",
|
|
|
|
|
"value": "%System32%\\pwkmbru\\dsieovxdrv.sys"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215260",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f212-36ac-45c0-bd4a-4769950d210f",
|
|
|
|
|
"value": "%TEMP%\\3E3A.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215261",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f212-a40c-4b2a-8361-4d16950d210f",
|
|
|
|
|
"value": "%WinDir%\\TEMP\\UDD4441.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215261",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f213-2dc8-410e-a58d-4eb8950d210f",
|
|
|
|
|
"value": "%LocalAppData%\\igfxmtc\\dowmload.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215261",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f213-a4e4-44fe-96af-401f950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsy4211.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215262",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f213-cf88-43e9-bfb1-4702950d210f",
|
|
|
|
|
"value": "%TEMP%\\3DCC.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215262",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f214-52e8-4a64-847b-4df9950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsy4211.tmp\\InstallOptions.dll"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215263",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3cb-f368-4ad1-bc5f-4cf2950d210f",
|
|
|
|
|
"value": "%System32%\\drivers\\spbiovxl.sys"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215263",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3cc-dd28-4c1d-9af4-4cdc950d210f",
|
|
|
|
|
"value": "%LocalAppData%\\exhpugb\\dowmload.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215263",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3cd-a07c-455b-8173-4e32950d210f",
|
|
|
|
|
"value": "%WinDir%\\TEMP\\UDD7B8B.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215264",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3cd-6278-4b4f-8810-442a950d210f",
|
|
|
|
|
"value": "%TEMP%\\3ED5.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215264",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3ce-6690-4d18-a2c1-4133950d210f",
|
|
|
|
|
"value": "%TEMP%\\400F.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215265",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3ce-1a1c-4d2a-b2b9-4327950d210f",
|
|
|
|
|
"value": "%WinDir%\\TEMP\\msidntfs\\SSL\\cert.db"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215265",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3ce-2198-4ffc-bffa-411f950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsy4211.tmp\\ioSpecial.ini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215266",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3cf-7c58-4a5b-9781-4a06950d210f",
|
|
|
|
|
"value": "%System32%\\pwkmbru\\dsieovx.exe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215266",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3cf-eed4-48e1-bde5-4068950d210f",
|
|
|
|
|
"value": "%WinDir%\\TEMP\\UDD73AE.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215266",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3d0-d0c8-42e6-b303-4076950d210f",
|
|
|
|
|
"value": "%LocalAppData%\\igfxmtc\\igfxmtc.exe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215267",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3d0-aff8-4da4-8fa1-4153950d210f",
|
|
|
|
|
"value": "%WinDir%\\TEMP\\msidntfs\\SSL\\SecureTrust Network Root CA 2.cer"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215267",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3d1-9bf0-40a6-9a60-41a0950d210f",
|
|
|
|
|
"value": "%TEMP%\\4119.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215268",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3d1-bb88-46bb-83eb-42b0950d210f",
|
|
|
|
|
"value": "%TEMP%\\nsy4211.tmp\\modern-wizard.bmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215268",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3d1-c0f0-4fe5-9d6e-4de7950d210f",
|
|
|
|
|
"value": "%WinDir%\\TEMP\\UDD6BD1.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215268",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3d2-0064-413f-b95f-4074950d210f",
|
|
|
|
|
"value": "%TEMP%\\3DCC.tmp.exe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215269",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3d2-362c-4c19-81a0-4b69950d210f",
|
|
|
|
|
"value": "%WinDir%\\TEMP\\UDD63F3.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215269",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3d3-6f60-4351-8b4f-4d33950d210f",
|
|
|
|
|
"value": "%WinDir%\\TEMP\\UDD8369.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215270",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3d3-6620-41d9-86f7-41fd950d210f",
|
|
|
|
|
"value": "%TEMP%\\3FFE.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215270",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad5f3d4-e690-42cd-a28e-4e80950d210f",
|
|
|
|
|
"value": "%TEMP%\\nss41A2.tmp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523972177",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5f851-4c38-4407-a13b-436d950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\9B4DFF593EC4945503B76D97E83BADF6893F2597"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215271",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5f852-fca4-4c49-862f-4202950d210f",
|
|
|
|
|
"value": "\\Software\\Microsoft\\WBEM\\CIMOM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523972178",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5f852-c810-4df5-a5f8-45a8950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV\\Instances"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215271",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5f853-8f58-492a-8488-4ad7950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV\\INSTANCES\\magsv"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1523972179",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5f853-6b7c-45d1-bc66-49eb950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\magsv"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215271",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad6f368-0d14-45d4-914d-4411950d210f",
|
|
|
|
|
"value": "216.58.217.174"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215272",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad6f368-9a7c-4654-a670-47ff950d210f",
|
|
|
|
|
"value": "62.75.222.235"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215272",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad6f369-00c4-46b6-8aea-4a91950d210f",
|
|
|
|
|
"value": "216.58.206.78"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215273",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad6f369-bd00-4721-a3f3-4d28950d210f",
|
|
|
|
|
"value": "84.16.241.77"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215273",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad6f369-2740-4db8-98d0-4b31950d210f",
|
|
|
|
|
"value": "66.199.229.251"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215273",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5ad6f36a-5780-4671-b8a3-42c4950d210f",
|
|
|
|
|
"value": "google.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215274",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad6f36a-a7b4-4397-9ce8-45e2950d210f",
|
|
|
|
|
"value": "u.drawfixmydesign.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215274",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad6f36b-6cd4-4054-a272-4445950d210f",
|
|
|
|
|
"value": "r.drawfixmydesign.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215275",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mutex",
|
|
|
|
|
"uuid": "5ad6f49a-fb1c-48bc-94f9-4419950d210f",
|
|
|
|
|
"value": "\\BaseNamedObjects\\DRBCXMtx"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036873",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f509-2e3c-4b5e-a4b4-48a3950d210f",
|
|
|
|
|
"value": "2593e0c6d66d36c7d8b3061f3c242875113310a2939f89aea73eda1397e44e31"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036874",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50a-1a78-49de-8491-4aa3950d210f",
|
|
|
|
|
"value": "e9a7b16189e27dff9ff67e31d09fa05e7f32658dfa56bb51feff8ca0cfb4eb85"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036874",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50a-42c8-48b9-bf8a-46c7950d210f",
|
|
|
|
|
"value": "1a1144444adb05aee9ef8adfb3c892a97d32b870d1ee300975a5f3597f2ed638"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036874",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50a-b92c-4855-88ac-492e950d210f",
|
|
|
|
|
"value": "ff5d541f260063a88b04a892cacfb3bcb13b8dd83c5f29ed5000737dbd6662c4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036875",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50b-d154-4795-b7f3-47e7950d210f",
|
|
|
|
|
"value": "b1d0bfdd95f168cea0df0e138ee627cb7feb0a26ac7a736baa031547bb6fb08d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036875",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50b-d714-4dce-9ed7-4f30950d210f",
|
|
|
|
|
"value": "9af34cdb7f0b01c044fdeb64f0b733d78e8b9be854c4beeee679f8ee083530b1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036875",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50b-b668-4b71-bfcb-4a28950d210f",
|
|
|
|
|
"value": "24281907f8904bf6b9af4116f52ae2ba8b4b97ce586cd3b2b2777a8f3c76c8cc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036876",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50c-07dc-4e7e-844e-49dd950d210f",
|
|
|
|
|
"value": "61cb5cbccb6d1c329cb1a641c3a74fd4a4521dee0d2d03e810f3f12303e0f1f1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036876",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50c-31ec-4ca7-9ecc-4e7a950d210f",
|
|
|
|
|
"value": "3431065d2208123137714d2d432427d33cff576d202e1fc7ea2990b21847cce1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036877",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50d-e290-458b-befc-4bbe950d210f",
|
|
|
|
|
"value": "ba975d346f8f543f348e1e42f03bf50167045740b321ae6dc8a8497e608e8766"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036877",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50d-1a8c-4844-ad53-40f5950d210f",
|
|
|
|
|
"value": "2df889657dd28f91ea10c08d5a72cf890bf142a6fb4928520ecdefcf708cc2b5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036878",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50e-2550-41da-a161-445b950d210f",
|
|
|
|
|
"value": "174286f1a0bd66552237da989be39ef821b11fc6acccef5eabc00448991d1876"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036878",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50e-f01c-4cec-88c9-4232950d210f",
|
|
|
|
|
"value": "4632c1023c0baaa1e227defd4923098c4f3c49317964ff1cb088b40b9df7a605"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036878",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50e-efa0-4487-9291-4e90950d210f",
|
|
|
|
|
"value": "530607f9b54be981e420a7bca1d33d0fa180e6c42877beddeb23836cc440f062"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036879",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50f-c064-4e25-a17f-4fcb950d210f",
|
|
|
|
|
"value": "e9bcf85599744033e320f5031ecc8157e0498a42d699cb175d7242c95b9f4358"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036879",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f50f-3194-4722-9575-48af950d210f",
|
|
|
|
|
"value": "86746d7dfa923b5b1e0e5a0d27f19eb40979dcf342f2fba01ccbb09175b9363c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524036880",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad6f510-5a7c-4901-930f-4c91950d210f",
|
|
|
|
|
"value": "973c024f2af38334bfe80a5c1fc2f96b2215397124ff08110e3c96aa986e7440"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215275",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad71113-447c-41a1-9bd4-4e24950d210f",
|
|
|
|
|
"value": "%ProgramFiles%\\Mozilla\\thfirxd.exe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215275",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad71113-7aa4-4bfd-b9ac-49c5950d210f",
|
|
|
|
|
"value": "%System32%\\Tasks\\aybbmte"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215276",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad73c88-56bc-4414-803a-7ba2950d210f",
|
|
|
|
|
"value": "52.85.88.217"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215276",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad73c88-9f88-4029-b6c6-7ba2950d210f",
|
|
|
|
|
"value": "bush.basinafterthought.bid"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055177",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c89-3e98-4607-87f0-7ba2950d210f",
|
|
|
|
|
"value": "9ad10ae09760aa994fdf2d6132a60276badb77b0ab773ee5d07d5b5e7a259207"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055177",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c89-055c-4812-80a0-7ba2950d210f",
|
|
|
|
|
"value": "2c31ec1ded95ec22f07a3bc29c03badd9158d8ddc19e1cdb98ccdab3482f2421"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055178",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8a-57d8-4f69-a836-7ba2950d210f",
|
|
|
|
|
"value": "433403d0f920938654f1592148f99110a5dd35fed88260c44a022983e12bdaa1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055178",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8a-27ec-4308-81b8-7ba2950d210f",
|
|
|
|
|
"value": "a02c5f7013b02bbc66380276f4250ea42173971c60e8836bb676243b648dd3a0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055179",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8b-584c-4667-a86f-7ba2950d210f",
|
|
|
|
|
"value": "f0bfcb581935377def575a18a89290427d335c95da6781b11d1ad91711cb4a81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055179",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8b-42c8-4947-a2c8-7ba2950d210f",
|
|
|
|
|
"value": "41bf7b4e4d7a87395cc8867e026ed9d586830420a70325a672d07ea9c1a351e0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055180",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8c-d530-4489-820d-7ba2950d210f",
|
|
|
|
|
"value": "e616d1e7e2b6e1d4f1ac2fea3e2041b842d27f5de05ff941b5661997cfe8a856"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055180",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8c-99d0-48b7-be88-7ba2950d210f",
|
|
|
|
|
"value": "4300dc69146725fe7476b6ee4a81ecbed78604e4575e299f52f6b6f3c65eaaa1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055180",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8c-20f8-44cc-8a1b-7ba2950d210f",
|
|
|
|
|
"value": "bc782f40d16fd6574c1e84edd0728470f426a31d2ff94e4bbb87a19cf3992048"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055181",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8d-1654-4e71-a6d4-7ba2950d210f",
|
|
|
|
|
"value": "04ead5ee82c762a26e1dc0e6a8b21c54669c771cca0291b5d41282d2e73a7fc0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055181",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8d-2888-4ed3-a247-7ba2950d210f",
|
|
|
|
|
"value": "739f27ac00dc449895f589ff28e86d78ea17ca298ffc0b40021136d7c77ed679"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055182",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8e-57e0-4131-aa43-7ba2950d210f",
|
|
|
|
|
"value": "cc4c722e0d6e2bbff6119e1895f6dfbbb2ed75b3d786e4de507b48792a2660a2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055182",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8e-83b4-4b62-9db9-7ba2950d210f",
|
|
|
|
|
"value": "28589697e00deb562a29f3cb335167b2880f3ef3065e418f57f1b626d9ea8c94"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055183",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8f-df38-4dfa-a837-7ba2950d210f",
|
|
|
|
|
"value": "b622971e681f9e2fa5f84bfcb9e7144b6198d3fb554de8d4488117ca1e3f51c8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055183",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c8f-ae2c-445e-8e26-7ba2950d210f",
|
|
|
|
|
"value": "0fee9d67ef1967d2bee1f67b1dc5ae24dff5d6dba17b9247e33b87f5bf6e6856"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055184",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c90-5394-4e42-87b1-7ba2950d210f",
|
|
|
|
|
"value": "6c8ca3ba14ee685739ea32a3ddc613d4544c69194a97c55365c570c053609938"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055184",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c90-3768-45e1-b5e5-7ba2950d210f",
|
|
|
|
|
"value": "f1dbfaf0378434cd1758feaabe050171df1c234ddc6215df494c6592a9e92547"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055185",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c91-f2bc-45d2-8433-7ba2950d210f",
|
|
|
|
|
"value": "e586da2bd9fd73223281176033b97e6e4e137249f9aff8430004099b31508e12"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055185",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c91-d9f0-4c95-aff6-7ba2950d210f",
|
|
|
|
|
"value": "1d70d1eb3210984b8d2c3c62ca6ade7b018f44688d009cbde3c2c214224a3ffb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055186",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c92-da9c-43f3-95ae-7ba2950d210f",
|
|
|
|
|
"value": "404746279f7d963489d1d7d2d9be4bd1b1dd82e81e21f6ebf09091ee7b059988"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055186",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c92-e460-4485-bc27-7ba2950d210f",
|
|
|
|
|
"value": "4696ddd4a7ed96a86a09413f14657c7e01053213f6f1f6008a3a3bbe4fe45229"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055187",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c93-67c8-4844-b5eb-7ba2950d210f",
|
|
|
|
|
"value": "66af9dc27feb2b69729b82e4076dd699cc504c3c8dce943d2023c7bdeca00f2a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055187",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c93-7f38-4ee0-8843-7ba2950d210f",
|
|
|
|
|
"value": "4694e19504a1bbc0335c213bad487727ab75faab3bf29d92cb7e3d14a2d3a8d0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055187",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c93-efb8-439d-b748-7ba2950d210f",
|
|
|
|
|
"value": "0863bf4a5476b5de02a15c3bdec1604c7d8ab7c8ca1c0546edf2f16a756e0d8f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055188",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73c94-2d30-45ff-9fff-7ba2950d210f",
|
|
|
|
|
"value": "39974f2161bc0151692ae2f380d38b626f2b47904f92ce5706e29b2fe05122d3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215277",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad73d16-6bbc-47dd-8e71-21a4950d210f",
|
|
|
|
|
"value": "72.230.82.80"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215277",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad73d16-3c70-4009-8cfd-21a4950d210f",
|
|
|
|
|
"value": "216.146.43.71"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215277",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad73d17-86a0-40c3-a66d-21a4950d210f",
|
|
|
|
|
"value": "173.248.31.6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad73d17-da38-40bf-9fb6-21a4950d210f",
|
|
|
|
|
"value": "93.185.4.90"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad73d17-67b4-42a8-ba91-21a4950d210f",
|
|
|
|
|
"value": "173.243.255.79"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad73d18-fa24-4b78-94c1-21a4950d210f",
|
|
|
|
|
"value": "checkip.dyndns.org"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215279",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad73d19-80bc-426e-add3-21a4950d210f",
|
|
|
|
|
"value": "Files\\Content.IE5\\SSZWDDXW\\W7RSB4SE.htm"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215280",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5ad73d19-f07c-4db8-8e0b-21a4950d210f",
|
|
|
|
|
"value": "%TEMP%\\serizay.exe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055321",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d19-0744-48a0-b32e-21a4950d210f",
|
|
|
|
|
"value": "91122476660eff79e0de0f30752e1cf9b37985013cb2fd6ad51c6ea6f20dbdf5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1a-7044-4255-9e6f-21a4950d210f",
|
|
|
|
|
"value": "fccaca287d58a30c33cc6a52e49fc16c9c5f08143624b82c8ea1df216ec42db0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1a-1034-4e73-a261-21a4950d210f",
|
|
|
|
|
"value": "6b93b7b97c1d5f3ad00378c8ff279c2f2ef8ba4ca16fdde45fe0557c37e8630a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1b-b110-4c26-a2b6-21a4950d210f",
|
|
|
|
|
"value": "e9574e34b580958e83aa060868edf408751f89f2844da98f2a8c4df24a175efd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1b-75b0-491c-8bac-21a4950d210f",
|
|
|
|
|
"value": "2b0dbfbc6f7018646a9ec428424986969a8bcf3ca1c4e1b23d7aab3e7e7dda5f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1b-de28-44b4-a3b5-21a4950d210f",
|
|
|
|
|
"value": "d4be54137269f8b720abd45b5f900e513c8e9c6144169900c673a07b3181006a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1c-5f18-49a5-abd6-21a4950d210f",
|
|
|
|
|
"value": "45919cf6c7ca6e97bcbf5f3bcf670db27c29d81aaa50b3563c50ec4e80ec6f4c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1c-6158-42bc-8cc9-21a4950d210f",
|
|
|
|
|
"value": "388a22678ed13c5fc9a26d8d89a37805143b38d782677b49d9abbfa1dcd47105"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055325",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1d-71e8-4b2f-a09c-21a4950d210f",
|
|
|
|
|
"value": "d9b137bba139689b08b01f59dfc61b161f522c8618cd74321a7ae4531e093ebb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055325",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1d-fbb4-4047-afb3-21a4950d210f",
|
|
|
|
|
"value": "702c79933e6afba258861251597fc1eb6fada3273a1a3038f4332f09eac44237"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055325",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1d-3654-4e9d-8677-21a4950d210f",
|
|
|
|
|
"value": "ccbf0df625484ab8244a47737514ff698fa00fe2ed8da99e779134c4f96c2a3f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055326",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1e-2150-46e9-9409-21a4950d210f",
|
|
|
|
|
"value": "5c80cd096858030abfb8ec87a0aceb8b9d791dfdc67259e668ec2cabab3abef4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055326",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1e-5ee4-43e8-b824-21a4950d210f",
|
|
|
|
|
"value": "6b6eb4cc4aa8e3d71a97a8657ffcd27d2bd12466faf3b1f7fcbcd274a4b9561c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055327",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1f-014c-4906-8d8c-21a4950d210f",
|
|
|
|
|
"value": "06c65a259d7c96000fcec97a7d8c5b6c4d0c8b8e52ed1d45c934a50d0369b3eb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055327",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1f-5508-42c7-bac1-21a4950d210f",
|
|
|
|
|
"value": "f43312efa07fe063b6fd50de8f1bc3e7ccfe27b4d80d9082e8faaced210f6be0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055327",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d1f-7944-4903-b661-21a4950d210f",
|
|
|
|
|
"value": "84f1fd4c31d0c21517ffe56eea666d6c7954aec47e958c33238b91f6bc9ef0e0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055328",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d20-7894-432b-ae81-21a4950d210f",
|
|
|
|
|
"value": "07cb19e9013ac45d8e99618944ebd9d1a81499239d20800f8aaf5789b6fbb47e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055328",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d20-f584-458b-9057-21a4950d210f",
|
|
|
|
|
"value": "e122d91eb62a33c8b4ef56b2299caf2f58fd4e48694c97e06c92f858497cf860"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055329",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d21-0dc8-4cc0-902c-21a4950d210f",
|
|
|
|
|
"value": "ea284de1551e367f736ce661b7342fc3a98297cfa8358972120375702dd14ccf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055329",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d21-5ac0-4c8b-8c2f-21a4950d210f",
|
|
|
|
|
"value": "e4b38a225a2703c06bcf4d26acc22753a86b74fa461720bda700c1fa2c1b3db6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055329",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d21-230c-412b-9b25-21a4950d210f",
|
|
|
|
|
"value": "daeded4fb715741d4045fa7ff6e7d81920c3e7ce892c1c29676a51ee70d63712"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055330",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d22-75c0-410d-abaf-21a4950d210f",
|
|
|
|
|
"value": "bc417721acee0afa960d71a7c59acfb6d233384625620bd0856734521b028005"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055330",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d22-91cc-4678-99df-21a4950d210f",
|
|
|
|
|
"value": "79a50327843a8ccf58147971d1c86945f9a40cd0d4ee35084b8af26c9f5ab210"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055331",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d23-6508-4f7f-800c-21a4950d210f",
|
|
|
|
|
"value": "53e260744b0f3d02c6d629cd466483b79c147d882e6749639631c4c7eeb46808"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055331",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73d23-3ff4-40f7-b773-21a4950d210f",
|
|
|
|
|
"value": "2e5bff8f11e5ed171ac94f1a5656014fbffd46b66493c90aaf47b640568faa1e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215280",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "hostname",
|
|
|
|
|
"uuid": "5ad73f73-19b8-4bfc-8b13-7ba5950d210f",
|
|
|
|
|
"value": "116.151.167.12.in-addr.arpa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215280",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad73fa0-6ed0-456b-8abc-7b9e950d210f",
|
|
|
|
|
"value": "85.25.185.229"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad73fa0-d070-4d34-866b-7b9e950d210f",
|
|
|
|
|
"value": "43.231.4.7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524215281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5ad73fa1-70a4-4800-81f9-7b9e950d210f",
|
|
|
|
|
"value": "12.167.151.116"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055969",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa1-fde8-43a9-b2f1-7b9e950d210f",
|
|
|
|
|
"value": "c6eeffc5eb2ee7203e7abef9e60c5edffd5471aa02760e1b2ef0cce5c5a73aa3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055970",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa2-33ac-4795-9641-7b9e950d210f",
|
|
|
|
|
"value": "cd159019d822551dd72c81fc954042275f65deaee88469c05682e7575a27e8e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055970",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa2-13e0-409e-a743-7b9e950d210f",
|
|
|
|
|
"value": "f0bd29ac4f11195c79f8b1812cbf93fcb2b8e67bd219c287e9e93c8136c44a32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055971",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa3-fb38-4d1d-8955-7b9e950d210f",
|
|
|
|
|
"value": "40b0cde3e58f802d799ce9b3baa86d3b03582b8d52af828fcf33a7b71fa704de"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055971",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa3-c334-4f35-97ee-7b9e950d210f",
|
|
|
|
|
"value": "842fd3e6342f2eab3bb49c69a6d963e3c7022221bdb074b4437310f8170b2c6f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055971",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa3-a3b4-46e6-85e7-7b9e950d210f",
|
|
|
|
|
"value": "e5633dfe5df0eadc14ee162af1c1f47c6350f514f6867cdeea8efeaf2cdd4f90"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055972",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa4-0dc8-4f29-94b6-7b9e950d210f",
|
|
|
|
|
"value": "ea088b52681001876b19f1b4c22823d347b734e167cb634208a204d95f6c01f5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055972",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa4-3f20-40a2-ae9e-7b9e950d210f",
|
|
|
|
|
"value": "268b1d9cc88537d6ba2301845262a82bc6df00b07a74fa7ead0242e5cf0dc9ae"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055973",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa5-3d2c-40a2-9c8b-7b9e950d210f",
|
|
|
|
|
"value": "9b389a4e17438eeba6cba94c6359317175b36e38329ae8ccfef2e7bc5d3b5a61"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055973",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa5-a420-4e9f-a25d-7b9e950d210f",
|
|
|
|
|
"value": "e411592afee8c0a1d6baab011017672dea44c307ed4ea223999eb0152cd95db6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055973",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa5-3bdc-4d75-a2d2-7b9e950d210f",
|
|
|
|
|
"value": "8ab34d8df0858423dd1f4f70f407ca929cf9300839c783ef40f64024e477b4f0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055974",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa6-8fd4-47f8-83e6-7b9e950d210f",
|
|
|
|
|
"value": "c8aeb4cf24afcabea69ac048a658fe031b033534a9cc77e249c03b1d0464a75c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055974",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa6-765c-4471-a3b3-7b9e950d210f",
|
|
|
|
|
"value": "10de8c9c16f71496e3c55f0d50640741449ea8f0e7b84dfabc80e13232dcee74"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055975",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa7-5400-4faf-bd8b-7b9e950d210f",
|
|
|
|
|
"value": "d2f102299b545cf1efc42b2e7d2de46dc6edf49b4da4ec4ee475539b21c7bad7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055975",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa7-711c-4f2d-ae86-7b9e950d210f",
|
|
|
|
|
"value": "5a9b3c474315a6cc941b44e2e1563266497d7c3a8fc88653b12d3b6fa9283439"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055975",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa7-47dc-4f2e-8c5a-7b9e950d210f",
|
|
|
|
|
"value": "f5c742ff51664195be30bba05c56c909b07cf7a475c570a704435e99ec925c92"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055976",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa8-f2b4-4348-9cf4-7b9e950d210f",
|
|
|
|
|
"value": "8d6c39242bb75f30437e3a3712cd54e5f4a1ccba7deef3ced7607c3894391297"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055976",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa8-8e1c-4c31-a3ba-7b9e950d210f",
|
|
|
|
|
"value": "5e7847c2c9edb9a8cd764e28cdb8f575fa157846ed1b0e4ccf0612f915a794a1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055977",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa9-d408-42db-a368-7b9e950d210f",
|
|
|
|
|
"value": "17595c6caf5362a043f81d32dc30dae30f27354fa9783de374301cbf42be2ff3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055977",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa9-f584-442c-9f41-7b9e950d210f",
|
|
|
|
|
"value": "35dcd9cd70c1047b835736be487536a3f3d6f2c2d40752f40ab278149972c481"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055977",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fa9-e6f4-4f0d-9fd4-7b9e950d210f",
|
|
|
|
|
"value": "6812a316ac2f2fa0affd0977f61a97f7463f3dd77e18b217e8b97e2414d4ea18"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055978",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73faa-75ac-41d4-ad16-7b9e950d210f",
|
|
|
|
|
"value": "81233480a520d005f90f203e99bc325fca56eff338e6761a11295315ac9010d1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055978",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73faa-cbb4-4d33-b945-7b9e950d210f",
|
|
|
|
|
"value": "8014614d9085f4ada71d6c403e8042ffdd715974ad826a19ec2fb8a4f713ca9f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055979",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fab-79a4-43fd-84c1-7b9e950d210f",
|
|
|
|
|
"value": "1f26c8b1dada5dc707651958630211824886556eb23f77f04d7a4818f8c8e756"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1524055979",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad73fab-d5f8-42d8-b922-7b9e950d210f",
|
|
|
|
|
"value": "018ba4d9446e31d228b829f0f90f2f4519b87359d5d5750177152e0b986d8aad"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Object": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957750",
|
|
|
|
|
"uuid": "d8250151-a555-4e5e-9239-e4d6a705c550",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "d8250151-a555-4e5e-9239-e4d6a705c550",
|
|
|
|
|
"referenced_uuid": "f18a6769-9119-4ce8-8261-38c8c36c6d48",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957904",
|
|
|
|
|
"uuid": "5ad5c090-a380-414e-899d-476502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957747",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5bff3-5ec0-4b30-9434-462a02de0b81",
|
|
|
|
|
"value": "afc9302ffde49d146ad7f58a95040ec5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957748",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5bff4-8e70-4b28-95b4-4e2b02de0b81",
|
|
|
|
|
"value": "4d3b0b76b83413777d10b922138c00bb297a249f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957748",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bff4-2308-4b63-b3a7-462402de0b81",
|
|
|
|
|
"value": "1824bb4ea96c6107c6660b104d60073be3a9f5c3bdbbc2c801771fc34a03e01c"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957748",
|
|
|
|
|
"uuid": "f18a6769-9119-4ce8-8261-38c8c36c6d48",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957749",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5bff5-881c-4c74-9573-45d302de0b81",
|
|
|
|
|
"value": "2013-11-04T18:18:54"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957749",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5bff5-aac0-4292-87a8-43e502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/1824bb4ea96c6107c6660b104d60073be3a9f5c3bdbbc2c801771fc34a03e01c/analysis/1383589134/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957749",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5bff5-8fb4-4324-8915-462602de0b81",
|
|
|
|
|
"value": "32/47"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957752",
|
|
|
|
|
"uuid": "5667d69e-d4e0-49ff-b66d-ee9c0d1606a0",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5667d69e-d4e0-49ff-b66d-ee9c0d1606a0",
|
|
|
|
|
"referenced_uuid": "2777d3d2-815c-4e73-92b3-e7c5f6a6bb4f",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957904",
|
|
|
|
|
"uuid": "5ad5c090-da68-4041-aa64-4d0702de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957749",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5bff5-cad4-4cf9-8622-4ce302de0b81",
|
|
|
|
|
"value": "e5c8c53b9d383fcbb0b5659da87dc3b7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957750",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5bff6-a184-40ac-af3a-4fa902de0b81",
|
|
|
|
|
"value": "560ca9b75304d19ea94d9265617f787ec6b82a72"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957750",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bff6-50f0-4246-8b33-467002de0b81",
|
|
|
|
|
"value": "ac755dfabf99ea6fc8c334dcef526d1dce3680200deeaac5e80077a27042af9c"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957751",
|
|
|
|
|
"uuid": "2777d3d2-815c-4e73-92b3-e7c5f6a6bb4f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957751",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5bff7-98e0-4c38-b697-4d4c02de0b81",
|
|
|
|
|
"value": "2013-10-20T22:53:04"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957751",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5bff7-9530-4b74-b13b-452a02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/ac755dfabf99ea6fc8c334dcef526d1dce3680200deeaac5e80077a27042af9c/analysis/1382309584/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957752",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5bff8-6e88-4e73-bc8b-4ed202de0b81",
|
|
|
|
|
"value": "32/48"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957755",
|
|
|
|
|
"uuid": "5a0f795c-3740-4127-ae11-5719c06e4613",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5a0f795c-3740-4127-ae11-5719c06e4613",
|
|
|
|
|
"referenced_uuid": "ff6c2680-4cca-4e84-aeef-dbf889d731cb",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957904",
|
|
|
|
|
"uuid": "5ad5c090-8c30-4c3f-9beb-475802de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957752",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5bff8-fd8c-4b9f-bd7e-499f02de0b81",
|
|
|
|
|
"value": "a346d50295afa82919cf03e817910796"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957752",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5bff8-26c8-4643-b96d-41da02de0b81",
|
|
|
|
|
"value": "6e830e1dcb0556efa884b311e595019dac96dd58"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957753",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bff9-90b0-43b8-9956-435202de0b81",
|
|
|
|
|
"value": "6db67b808d476e3412034571798447aafbbe320a0884a417a7d7fae604440c6e"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957753",
|
|
|
|
|
"uuid": "ff6c2680-4cca-4e84-aeef-dbf889d731cb",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957753",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5bff9-397c-4aae-a7d2-4dda02de0b81",
|
|
|
|
|
"value": "2018-02-13T19:00:25"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957753",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5bff9-0498-4b64-a270-4f2002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6db67b808d476e3412034571798447aafbbe320a0884a417a7d7fae604440c6e/analysis/1518548425/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957754",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5bffa-ffc4-4351-8469-4d2a02de0b81",
|
|
|
|
|
"value": "45/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957757",
|
|
|
|
|
"uuid": "7f770580-9cd5-4055-8779-f7214ff95236",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "7f770580-9cd5-4055-8779-f7214ff95236",
|
|
|
|
|
"referenced_uuid": "ee0ed29e-9ebc-4abb-b406-61d5e5e7d74f",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957904",
|
|
|
|
|
"uuid": "5ad5c090-2410-4a85-898d-40ef02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957754",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5bffa-8dfc-4f0d-a8c7-4c6002de0b81",
|
|
|
|
|
"value": "2485c3718c9bd94718729a6cc7ac9fbb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957755",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5bffb-f66c-45cb-8f1c-4df002de0b81",
|
|
|
|
|
"value": "407610f3f91a43640c9b5eaa00a84cad5bb647ed"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957755",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bffb-9400-4990-9ec8-484a02de0b81",
|
|
|
|
|
"value": "725752c4bda82acf554aad37fe97d08f4367c9a1e5d40b6fe17cdc94adf040fc"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957755",
|
|
|
|
|
"uuid": "ee0ed29e-9ebc-4abb-b406-61d5e5e7d74f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957755",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5bffb-c704-4832-9a55-46aa02de0b81",
|
|
|
|
|
"value": "2018-04-07T08:19:50"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957756",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5bffc-353c-4ea9-a736-4cb802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/725752c4bda82acf554aad37fe97d08f4367c9a1e5d40b6fe17cdc94adf040fc/analysis/1523089190/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957756",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5bffc-40a8-4937-a0a4-427402de0b81",
|
|
|
|
|
"value": "31/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957759",
|
|
|
|
|
"uuid": "16dd834b-161d-4a5d-a463-e0fe0c82ddb8",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "16dd834b-161d-4a5d-a463-e0fe0c82ddb8",
|
|
|
|
|
"referenced_uuid": "c2c034d9-7fc9-4b07-b85e-b77886481632",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957904",
|
|
|
|
|
"uuid": "5ad5c090-1694-4bb2-9d3e-450f02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957756",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5bffc-39e8-46fe-a585-4b4602de0b81",
|
|
|
|
|
"value": "09fd1e70c66b1a7a2f47c871052672cf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957757",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5bffd-2ed0-4023-bb56-4f1802de0b81",
|
|
|
|
|
"value": "4f9eb8c56b8cc753806967772b92b357ce0b2327"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957757",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bffd-29c8-4417-b679-459d02de0b81",
|
|
|
|
|
"value": "09cc6c9e39425a71ccdc26ffd8a67179043b20f646286685eea24e6bb00b12d9"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957758",
|
|
|
|
|
"uuid": "c2c034d9-7fc9-4b07-b85e-b77886481632",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957758",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5bffe-a06c-4b1a-88d8-42a602de0b81",
|
|
|
|
|
"value": "2018-04-15T07:22:04"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957758",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5bffe-1ebc-46db-b6cc-416802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/09cc6c9e39425a71ccdc26ffd8a67179043b20f646286685eea24e6bb00b12d9/analysis/1523776924/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957758",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5bffe-80b0-4f48-a145-4e4e02de0b81",
|
|
|
|
|
"value": "44/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957761",
|
|
|
|
|
"uuid": "1c3353ab-72a9-4b8d-bf7b-26b82f95bcab",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "1c3353ab-72a9-4b8d-bf7b-26b82f95bcab",
|
|
|
|
|
"referenced_uuid": "ca39f2b2-ab66-4b27-b7c6-c0e6031aa3c6",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957904",
|
|
|
|
|
"uuid": "5ad5c090-7664-40db-b41b-494d02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957759",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5bfff-1fcc-4db5-933e-41f402de0b81",
|
|
|
|
|
"value": "93cfb3115f1c3ee27b8e40be8936ff0c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957759",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5bfff-91a0-4dfa-b8be-428002de0b81",
|
|
|
|
|
"value": "2579550687a537a79baa0004d051fbeb2dc31d6a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957759",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5bfff-b104-4846-a499-47dc02de0b81",
|
|
|
|
|
"value": "0e1d3984bd6c33ba0fc108329e3906bd074d70ed44a4c7fa6d8f857531bbc437"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957760",
|
|
|
|
|
"uuid": "ca39f2b2-ab66-4b27-b7c6-c0e6031aa3c6",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957760",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c000-0ea8-402a-b3cc-47fa02de0b81",
|
|
|
|
|
"value": "2015-03-30T19:55:02"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957760",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c000-4e3c-4806-87f8-4a3902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0e1d3984bd6c33ba0fc108329e3906bd074d70ed44a4c7fa6d8f857531bbc437/analysis/1427745302/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957761",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c001-722c-41ff-b0ed-4db102de0b81",
|
|
|
|
|
"value": "37/57"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957764",
|
|
|
|
|
"uuid": "4bbac67b-db88-4ff1-b57e-99611cfee662",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "4bbac67b-db88-4ff1-b57e-99611cfee662",
|
|
|
|
|
"referenced_uuid": "7d0a5db8-4b69-4b06-b514-861ac2bcc9c8",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957904",
|
|
|
|
|
"uuid": "5ad5c090-2158-48f6-b705-407a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957761",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c001-29d4-4f68-ba24-4ccb02de0b81",
|
|
|
|
|
"value": "d598b662efc21cb52c8ccc1ab4fa3aee"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957761",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c001-2368-47c2-8bf3-4b6802de0b81",
|
|
|
|
|
"value": "fc36673a5adf95ccbc5e4fe8cba82929ac904f79"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957762",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c002-626c-426c-9b0d-429e02de0b81",
|
|
|
|
|
"value": "330a8b46f74f5d4af759b18db64dfd9af2ef3e429d597cd4522148fb78633000"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957762",
|
|
|
|
|
"uuid": "7d0a5db8-4b69-4b06-b514-861ac2bcc9c8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957762",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c002-170c-43f8-9cc3-46a002de0b81",
|
|
|
|
|
"value": "2018-04-11T17:37:46"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957762",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c002-0cb0-4c6e-be1e-48b102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/330a8b46f74f5d4af759b18db64dfd9af2ef3e429d597cd4522148fb78633000/analysis/1523468266/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957763",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c003-bd48-4b8d-aeac-491e02de0b81",
|
|
|
|
|
"value": "24/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957766",
|
|
|
|
|
"uuid": "38195b20-39ab-4f46-a15f-4cac8fa71f0b",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "38195b20-39ab-4f46-a15f-4cac8fa71f0b",
|
|
|
|
|
"referenced_uuid": "b9326c01-9fbc-4562-9806-9eb7f18f1658",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957904",
|
|
|
|
|
"uuid": "5ad5c090-ae9c-422d-b0e5-454a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957763",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c003-4b4c-4353-8667-4e9002de0b81",
|
|
|
|
|
"value": "c54f8d34f2640cd64dd4b6f8d852d676"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957763",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c003-1ab8-4c81-9a57-447002de0b81",
|
|
|
|
|
"value": "f562f593819976e50aa911b5fae590e583a2ae33"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957764",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c004-4d8c-400d-bff6-437d02de0b81",
|
|
|
|
|
"value": "d8f1f59b81a985f538fc0a51c85c688794f94b28a06883ba9dadfb4b0c8bccd6"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957764",
|
|
|
|
|
"uuid": "b9326c01-9fbc-4562-9806-9eb7f18f1658",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957764",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c004-c4d8-456b-8fa8-447a02de0b81",
|
|
|
|
|
"value": "2018-04-17T01:03:38"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957765",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c005-2c28-4a60-b90a-4e1102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/d8f1f59b81a985f538fc0a51c85c688794f94b28a06883ba9dadfb4b0c8bccd6/analysis/1523927018/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957765",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c005-0044-498c-b7c6-464c02de0b81",
|
|
|
|
|
"value": "35/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957768",
|
|
|
|
|
"uuid": "23168de0-12c0-4447-aecb-32d09f2215d6",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "23168de0-12c0-4447-aecb-32d09f2215d6",
|
|
|
|
|
"referenced_uuid": "6ffec30e-27e2-4994-b80e-41bbfc7b35ca",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-3a98-4bb9-9159-4fc902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957765",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c005-c4f8-4c2a-852e-4ca502de0b81",
|
|
|
|
|
"value": "f26a613b679c97f5355a1c4a4c71948a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957765",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c005-c1cc-4aa6-850a-435c02de0b81",
|
|
|
|
|
"value": "d7403d4e903fdf67db31b5a11267e665e2c03339"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957766",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c006-25b8-4fd7-b31b-4f6a02de0b81",
|
|
|
|
|
"value": "13da7abee3f2ea4275c1434900db5ba9f620fde8743eb0ff2388b32897685e0b"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957766",
|
|
|
|
|
"uuid": "6ffec30e-27e2-4994-b80e-41bbfc7b35ca",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957766",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c006-315c-4d76-9343-42a502de0b81",
|
|
|
|
|
"value": "2014-01-17T18:07:27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957767",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c007-d844-412f-9f0f-452202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/13da7abee3f2ea4275c1434900db5ba9f620fde8743eb0ff2388b32897685e0b/analysis/1389982047/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957767",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c007-7ef4-461b-92ca-490d02de0b81",
|
|
|
|
|
"value": "29/47"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957770",
|
|
|
|
|
"uuid": "3797aea4-eab0-4f22-9e6d-a1a543cb0009",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "3797aea4-eab0-4f22-9e6d-a1a543cb0009",
|
|
|
|
|
"referenced_uuid": "bc2915ec-2b50-47b9-abaa-3481306c33d2",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-3714-4747-9c07-4c5a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957767",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c007-3940-4cc9-9be5-419402de0b81",
|
|
|
|
|
"value": "c642c2a00199c1dfd86bd00a48429afb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957768",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c008-4548-4976-91f5-4e2102de0b81",
|
|
|
|
|
"value": "dc7211fb70415814b9af44aaa153c2cc06e0f7df"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957768",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c008-bd1c-4669-b528-413402de0b81",
|
|
|
|
|
"value": "2b7662b93abcd312eb2c4d66c246af9dc7c43a511fae5dddd11617bf2ced16c3"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957768",
|
|
|
|
|
"uuid": "bc2915ec-2b50-47b9-abaa-3481306c33d2",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957768",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c009-a5fc-4866-b94a-4e5602de0b81",
|
|
|
|
|
"value": "2018-02-13T18:09:20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957769",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c009-ce30-4eb8-8647-477e02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2b7662b93abcd312eb2c4d66c246af9dc7c43a511fae5dddd11617bf2ced16c3/analysis/1518545360/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957769",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c009-a58c-4d1b-86f3-408002de0b81",
|
|
|
|
|
"value": "47/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957772",
|
|
|
|
|
"uuid": "d9bd8f68-4507-4e45-b3b2-51b238bf210c",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "d9bd8f68-4507-4e45-b3b2-51b238bf210c",
|
|
|
|
|
"referenced_uuid": "e050e2a6-56c7-45ff-82a3-771b9fed5773",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-11b0-4fdd-b554-432502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957769",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c009-8a60-4e59-902d-4b8902de0b81",
|
|
|
|
|
"value": "a16b48a1b06af3203312b46fb3012bf0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957770",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c00a-9cd0-494f-aacb-443502de0b81",
|
|
|
|
|
"value": "f71b209616bfb7e8c6ff07a85076b0537766c8a6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957770",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c00a-3a74-4172-9b5c-4a7b02de0b81",
|
|
|
|
|
"value": "21178d6e06ded3b1a43e98eb781220c37e729ef081bd160f168fc465313ea4ff"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957771",
|
|
|
|
|
"uuid": "e050e2a6-56c7-45ff-82a3-771b9fed5773",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957771",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c00b-741c-452b-89dd-4d7402de0b81",
|
|
|
|
|
"value": "2018-04-15T07:22:15"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957771",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c00b-157c-48d0-97dd-452602de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/21178d6e06ded3b1a43e98eb781220c37e729ef081bd160f168fc465313ea4ff/analysis/1523776935/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957771",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c00b-3124-453b-a3cc-4c5402de0b81",
|
|
|
|
|
"value": "35/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957774",
|
|
|
|
|
"uuid": "bdfb2aaf-fbc1-4f37-a1c2-3d2e7ab849e4",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "bdfb2aaf-fbc1-4f37-a1c2-3d2e7ab849e4",
|
|
|
|
|
"referenced_uuid": "0b1fa52a-e14a-41b1-870c-6f2f34beb767",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-c9ec-4187-9a4b-4f3d02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957772",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c00c-fcf0-4f32-bf27-47cc02de0b81",
|
|
|
|
|
"value": "dfcf5ba6e5fe982c1bcbeecbe8661abb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957772",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c00c-34f4-4172-8e89-48ee02de0b81",
|
|
|
|
|
"value": "097e6324f7c65236b791312503b75a736d8b5879"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957772",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c00c-b5f8-4525-9d8f-40c802de0b81",
|
|
|
|
|
"value": "711155de0073adc2f68fc4088253f92f43a696bbf5d8f892f902724be37668f3"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957773",
|
|
|
|
|
"uuid": "0b1fa52a-e14a-41b1-870c-6f2f34beb767",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957773",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c00d-12bc-4b1b-8e67-49bf02de0b81",
|
|
|
|
|
"value": "2018-04-04T09:38:45"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957773",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c00d-36e8-4138-aaaa-48ed02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/711155de0073adc2f68fc4088253f92f43a696bbf5d8f892f902724be37668f3/analysis/1522834725/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957774",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c00e-45a8-4dbc-aca0-46ac02de0b81",
|
|
|
|
|
"value": "41/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957777",
|
|
|
|
|
"uuid": "5bf3dff0-e75c-4c33-b4a1-eb598f12b360",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5bf3dff0-e75c-4c33-b4a1-eb598f12b360",
|
|
|
|
|
"referenced_uuid": "52911c0c-a5de-4e05-b24b-f95bc38926b4",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-e308-469d-b6fc-479102de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957774",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c00e-aa48-4fa7-ac49-424b02de0b81",
|
|
|
|
|
"value": "02fe66090aa1e35ab228488e8c1715b0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957774",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c00e-4e74-420b-893e-461302de0b81",
|
|
|
|
|
"value": "a328f25c415918b7717f4ae43f8b177f20db5f48"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957775",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c00f-6f44-4a8a-8f0a-475802de0b81",
|
|
|
|
|
"value": "02cb3c5568577ed9658fcf68b9f776d720e2f7355090b10875f0f9bb2b8ed161"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957775",
|
|
|
|
|
"uuid": "52911c0c-a5de-4e05-b24b-f95bc38926b4",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957775",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c00f-fa74-41e5-b5e1-459e02de0b81",
|
|
|
|
|
"value": "2018-02-14T02:11:17"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957775",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c00f-ce08-4ee3-a2ee-4e9502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/02cb3c5568577ed9658fcf68b9f776d720e2f7355090b10875f0f9bb2b8ed161/analysis/1518574277/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957776",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c010-b3c4-4ffd-bd8b-404502de0b81",
|
|
|
|
|
"value": "50/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957779",
|
|
|
|
|
"uuid": "614923b5-0de4-4fc9-a207-736b5e32740d",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "614923b5-0de4-4fc9-a207-736b5e32740d",
|
|
|
|
|
"referenced_uuid": "8ea75fc7-ff1e-45ce-806b-6542e4d5da9c",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-90b8-451f-9e64-4b8102de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957776",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c010-9eec-443b-a522-4df302de0b81",
|
|
|
|
|
"value": "b3df868e667345393f53f96485413afc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957776",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c010-9b64-4ec4-97ed-487402de0b81",
|
|
|
|
|
"value": "83b45579bc95e9b298bdd78103c92d518226084b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957777",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c011-24c8-42d9-8a5e-471d02de0b81",
|
|
|
|
|
"value": "cc203d955e3e33479423f7b2aea1f13c2ba5895da16159a779407e03e747d116"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957777",
|
|
|
|
|
"uuid": "8ea75fc7-ff1e-45ce-806b-6542e4d5da9c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957777",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c011-2c60-481e-a648-416402de0b81",
|
|
|
|
|
"value": "2013-11-09T09:52:55"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957778",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c012-0eb4-4ac4-b541-4af002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/cc203d955e3e33479423f7b2aea1f13c2ba5895da16159a779407e03e747d116/analysis/1383990775/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957778",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c012-c674-48f3-bd95-436902de0b81",
|
|
|
|
|
"value": "35/46"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957781",
|
|
|
|
|
"uuid": "995bfffe-f2bd-4180-9982-f4700327897d",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "995bfffe-f2bd-4180-9982-f4700327897d",
|
|
|
|
|
"referenced_uuid": "bdda72e7-74f6-4a7e-9ce2-860f07a867cc",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-5a88-45c1-ac63-4c9a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957778",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c012-59b4-4c3e-814f-4e8c02de0b81",
|
|
|
|
|
"value": "7d8e7947905be31b08f6b122bdc0e807"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957779",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c013-f17c-4678-bd91-4ddd02de0b81",
|
|
|
|
|
"value": "382798e0b1a9e3598ba729816f4bdf78af59507c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957779",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c013-a6dc-4d12-8e67-430b02de0b81",
|
|
|
|
|
"value": "df9f1a4e2cb4247132c7442aedfe873c5e801ab048e0236407066c3acd5ec79b"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957779",
|
|
|
|
|
"uuid": "bdda72e7-74f6-4a7e-9ce2-860f07a867cc",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957779",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c013-e2ac-4e4e-8613-473f02de0b81",
|
|
|
|
|
"value": "2018-04-15T07:23:42"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957780",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c014-a148-4349-a7d3-4b3902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/df9f1a4e2cb4247132c7442aedfe873c5e801ab048e0236407066c3acd5ec79b/analysis/1523777022/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957780",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c014-71ec-4406-859c-42cf02de0b81",
|
|
|
|
|
"value": "41/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957783",
|
|
|
|
|
"uuid": "3d6d671b-63e1-4e34-add1-f1ac1def5d61",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "3d6d671b-63e1-4e34-add1-f1ac1def5d61",
|
|
|
|
|
"referenced_uuid": "73b55eba-1b5c-4404-a1fe-f8776317e5db",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-0e78-4c74-a70f-458402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957780",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c014-d8ac-4d96-9a52-45a302de0b81",
|
|
|
|
|
"value": "d42bbd4720a5505c3beb32bfb6cda8cb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957781",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c015-8c3c-4899-923d-411802de0b81",
|
|
|
|
|
"value": "53107a52af70868fabe1372c6a6bcd249acee4d7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957781",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c015-1048-45d8-9512-49ff02de0b81",
|
|
|
|
|
"value": "786c1b55e5e73fd3c2231d7e6fa0565aacb4fb239807f42c2f0cb83f57186271"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957781",
|
|
|
|
|
"uuid": "73b55eba-1b5c-4404-a1fe-f8776317e5db",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957782",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c016-f190-42e2-81a0-454202de0b81",
|
|
|
|
|
"value": "2013-10-18T19:13:24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957782",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c016-4f98-4dd9-95bc-42c902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/786c1b55e5e73fd3c2231d7e6fa0565aacb4fb239807f42c2f0cb83f57186271/analysis/1382123604/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957782",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c016-c640-4cdb-bb28-42de02de0b81",
|
|
|
|
|
"value": "35/48"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957785",
|
|
|
|
|
"uuid": "4faa8c04-91b8-4cae-a6e4-b7e025fba6fb",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "4faa8c04-91b8-4cae-a6e4-b7e025fba6fb",
|
|
|
|
|
"referenced_uuid": "2c7fb252-23a4-4d0f-a7d2-38ef26d62292",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-57bc-4dc0-9cbe-409302de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957783",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c017-79ac-4d88-a299-41cb02de0b81",
|
|
|
|
|
"value": "474037c0cc41ea9a2de42d6b94c759c5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957783",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c017-db9c-4a73-b77d-48d702de0b81",
|
|
|
|
|
"value": "61bd61916fac9af19f735f59c8f20ba9b5b145f8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957783",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c017-ec4c-4428-acae-431502de0b81",
|
|
|
|
|
"value": "2a0904b6301b42ed0838633b161c947a781600fc884b0fc499f906a49ea38292"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957784",
|
|
|
|
|
"uuid": "2c7fb252-23a4-4d0f-a7d2-38ef26d62292",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957784",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c018-f634-48a1-8a91-4ca002de0b81",
|
|
|
|
|
"value": "2018-04-11T00:34:44"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957784",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c018-de88-4827-9b63-4f3602de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2a0904b6301b42ed0838633b161c947a781600fc884b0fc499f906a49ea38292/analysis/1523406884/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957785",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c019-4ee8-4cb9-8d1f-42b102de0b81",
|
|
|
|
|
"value": "22/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957788",
|
|
|
|
|
"uuid": "973396c7-45b7-4106-addf-ac2d80c845bf",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "973396c7-45b7-4106-addf-ac2d80c845bf",
|
|
|
|
|
"referenced_uuid": "caf0696e-f479-451b-87c4-55c4e29e725c",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-0f38-4a61-9550-43cb02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957785",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c019-bb48-468c-8f89-4cc002de0b81",
|
|
|
|
|
"value": "9044a2e1ea1eb511db8ab5e918c5fc8e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957785",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c019-8790-48b8-91bc-4a8b02de0b81",
|
|
|
|
|
"value": "4e7a00b64fd7861378edd9e29a66401d44fa5c8e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957786",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c01a-dba4-45ce-a828-4ea902de0b81",
|
|
|
|
|
"value": "ef4d20220eaecedc0b3069192843bd5eddc196b25a9e083fd16d19ae100374df"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957786",
|
|
|
|
|
"uuid": "caf0696e-f479-451b-87c4-55c4e29e725c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957786",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c01a-ae9c-454b-b507-428c02de0b81",
|
|
|
|
|
"value": "2018-04-13T06:32:29"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957786",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c01a-c70c-4dab-bda5-445e02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/ef4d20220eaecedc0b3069192843bd5eddc196b25a9e083fd16d19ae100374df/analysis/1523601149/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957787",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c01b-6100-4f8b-9d5c-43a202de0b81",
|
|
|
|
|
"value": "41/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957790",
|
|
|
|
|
"uuid": "54f5c200-a42b-4430-bbf0-b9669a922753",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "54f5c200-a42b-4430-bbf0-b9669a922753",
|
|
|
|
|
"referenced_uuid": "3c6123b5-074a-48ac-8e18-eacd3427f3e0",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-1bf0-4c4b-ba02-478c02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957787",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c01b-49e0-4066-944c-4f8602de0b81",
|
|
|
|
|
"value": "31968f20d5803d91aa2caf76a912634b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957787",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c01b-08ac-4eba-ae02-4c6e02de0b81",
|
|
|
|
|
"value": "adc3eea50a98ad71035f3f6f7068093b05db0f3c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957788",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c01c-f3a4-44a7-8ae3-4fce02de0b81",
|
|
|
|
|
"value": "4a6043017f598162263d52315c79bfcb5fbef86f19d51beb718fe8093dc1af16"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957788",
|
|
|
|
|
"uuid": "3c6123b5-074a-48ac-8e18-eacd3427f3e0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957788",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c01c-d378-4efb-9433-4f0b02de0b81",
|
|
|
|
|
"value": "2014-11-05T19:15:43"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957789",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c01d-dd04-4f86-869b-41f502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4a6043017f598162263d52315c79bfcb5fbef86f19d51beb718fe8093dc1af16/analysis/1415214943/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957789",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c01d-ba24-4191-a04c-480802de0b81",
|
|
|
|
|
"value": "42/53"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957792",
|
|
|
|
|
"uuid": "31544fd1-56dd-45f2-b82e-92735845680d",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "31544fd1-56dd-45f2-b82e-92735845680d",
|
|
|
|
|
"referenced_uuid": "3c388591-92db-40b6-ae4b-b929b333b015",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-fc8c-42ab-b4b4-412202de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957789",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c01d-e4cc-42e7-9bc5-45f302de0b81",
|
|
|
|
|
"value": "b406938547c8d101f789712862bf292a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957789",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c01d-72ec-4063-ad28-413f02de0b81",
|
|
|
|
|
"value": "1883c127413ef4405118dd1ced7623188994aa2c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957790",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c01e-0d04-48d3-9773-479302de0b81",
|
|
|
|
|
"value": "5301f9401c7d7ac485d0169085222c64ec2de6f14783cad6150b7c6f0f368c7c"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957790",
|
|
|
|
|
"uuid": "3c388591-92db-40b6-ae4b-b929b333b015",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957790",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c01e-2a58-400a-8eee-407802de0b81",
|
|
|
|
|
"value": "2018-04-15T07:22:37"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957791",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c01f-ce8c-4917-a7e9-414f02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5301f9401c7d7ac485d0169085222c64ec2de6f14783cad6150b7c6f0f368c7c/analysis/1523776957/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957791",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c01f-c22c-4cd7-94f9-42b002de0b81",
|
|
|
|
|
"value": "42/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957794",
|
|
|
|
|
"uuid": "112a8e0b-9c16-4653-b33c-dd0c9395e5f1",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "112a8e0b-9c16-4653-b33c-dd0c9395e5f1",
|
|
|
|
|
"referenced_uuid": "3c1121a3-79bf-4e3d-9f13-9a8b93a071cb",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-5514-4479-896a-44a902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957791",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c01f-c8dc-499b-8d8e-489d02de0b81",
|
|
|
|
|
"value": "07a34546e519b95d3c4c8cf996ed03f9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957792",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c020-13d4-4ec2-88b4-4a1b02de0b81",
|
|
|
|
|
"value": "1848d35c3ba39444aed847cd67f3bac673f43c53"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957792",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c020-fd54-4178-b461-4ec802de0b81",
|
|
|
|
|
"value": "0e1c8a62bd632cd364d16dcf0839531c8dcb443269f4478f301e4adf758977a6"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957792",
|
|
|
|
|
"uuid": "3c1121a3-79bf-4e3d-9f13-9a8b93a071cb",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957793",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c021-9578-4271-8266-485d02de0b81",
|
|
|
|
|
"value": "2018-04-11T00:24:20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957793",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c021-b8a0-4407-bf12-4a8902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0e1c8a62bd632cd364d16dcf0839531c8dcb443269f4478f301e4adf758977a6/analysis/1523406260/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957793",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c021-8168-488b-8340-4b3c02de0b81",
|
|
|
|
|
"value": "24/65"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957796",
|
|
|
|
|
"uuid": "94710067-d371-4822-8b18-19de4086162d",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "94710067-d371-4822-8b18-19de4086162d",
|
|
|
|
|
"referenced_uuid": "682b1d3f-030c-4473-ba89-9cd2fe00057c",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-e5d4-4573-8eb5-4f8d02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957793",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c021-6ffc-41a7-abce-489e02de0b81",
|
|
|
|
|
"value": "05473bd36fd70cc0f24cc88fe36751d4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957794",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c022-0598-4555-8bb0-4e3202de0b81",
|
|
|
|
|
"value": "86a84feeb9bd371d558d1b445592458432912128"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957794",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c022-7748-4c14-bcf4-40ab02de0b81",
|
|
|
|
|
"value": "4e496591b9c2c9722c07746edfc7892b178b8965bb4c452322caab68b2d5f262"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957795",
|
|
|
|
|
"uuid": "682b1d3f-030c-4473-ba89-9cd2fe00057c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957795",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c023-f5dc-416f-b990-477c02de0b81",
|
|
|
|
|
"value": "2018-02-15T23:36:02"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957795",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c023-b014-4478-975d-408d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4e496591b9c2c9722c07746edfc7892b178b8965bb4c452322caab68b2d5f262/analysis/1518737762/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957795",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c023-b9e0-4c8f-a43b-49d102de0b81",
|
|
|
|
|
"value": "51/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957798",
|
|
|
|
|
"uuid": "4801e439-9b95-4e31-b323-19141dc9f661",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "4801e439-9b95-4e31-b323-19141dc9f661",
|
|
|
|
|
"referenced_uuid": "49706bc5-c3ca-4603-9c8c-27e7b7da5aea",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-c1e4-4a3b-9f8f-414302de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957796",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c024-bbb4-4c6b-b579-4abe02de0b81",
|
|
|
|
|
"value": "674e2b0107ca6fb28cd708baae42c93b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957796",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c024-b008-4c8d-8327-41b102de0b81",
|
|
|
|
|
"value": "15952246291b8b94607f122ea32997c8fb08f9fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957796",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c024-2a60-41e7-a034-4f5202de0b81",
|
|
|
|
|
"value": "40a0f808c1fd873c364850d95e2f0adb0ca24740945702de5c0552a5afc60612"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957797",
|
|
|
|
|
"uuid": "49706bc5-c3ca-4603-9c8c-27e7b7da5aea",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957797",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c025-f2fc-42c9-a7c1-48cc02de0b81",
|
|
|
|
|
"value": "2018-02-18T13:12:24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957797",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c025-7b28-42f1-bacc-419e02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/40a0f808c1fd873c364850d95e2f0adb0ca24740945702de5c0552a5afc60612/analysis/1518959544/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957798",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c026-88e0-4a1c-ac0c-432202de0b81",
|
|
|
|
|
"value": "54/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957801",
|
|
|
|
|
"uuid": "a323b8bb-713c-49d2-9182-c5c82a7ad35d",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "a323b8bb-713c-49d2-9182-c5c82a7ad35d",
|
|
|
|
|
"referenced_uuid": "3b0a52e2-f7d8-4624-9306-b85a5d163797",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-d464-468c-a11a-45ab02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957798",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c026-0474-45ed-b215-4ff802de0b81",
|
|
|
|
|
"value": "7f77120177fb33bf160aa78901971bde"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957798",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c026-c718-4b2a-99ba-440802de0b81",
|
|
|
|
|
"value": "5a11223ac68b9f231a18ecf8183cd81d67dd74aa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957799",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c027-b100-4946-b525-450f02de0b81",
|
|
|
|
|
"value": "f34354749657c44beee0b1d7f5cdc4a31c858eab565fc2592f96c69eb9d501e1"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957799",
|
|
|
|
|
"uuid": "3b0a52e2-f7d8-4624-9306-b85a5d163797",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957799",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c027-186c-4187-9067-421502de0b81",
|
|
|
|
|
"value": "2018-04-09T05:25:49"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957799",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c027-3874-4acb-862d-4ce502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f34354749657c44beee0b1d7f5cdc4a31c858eab565fc2592f96c69eb9d501e1/analysis/1523251549/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957800",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c028-71fc-4cb6-94ac-438202de0b81",
|
|
|
|
|
"value": "38/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957803",
|
|
|
|
|
"uuid": "471e1471-53fb-4110-b102-8cce0d58cf5b",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "471e1471-53fb-4110-b102-8cce0d58cf5b",
|
|
|
|
|
"referenced_uuid": "afea6952-1d7c-42e2-8600-2db8d77a821e",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-323c-42aa-b35b-4ae102de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957800",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c028-e0f4-4e46-83c1-4bce02de0b81",
|
|
|
|
|
"value": "411a12a8f765a78ce4763354c416707d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957800",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c028-2b18-4b04-959d-4da402de0b81",
|
|
|
|
|
"value": "73e0fcf79d3c5b3499e897b69b0cdfa4d8433b1c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957801",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c029-7cfc-4ed6-a8a9-4e9602de0b81",
|
|
|
|
|
"value": "663ecdfa115605418b2826e4de7e289b0cd12849b719c7a171ee7524bf22fe99"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957801",
|
|
|
|
|
"uuid": "afea6952-1d7c-42e2-8600-2db8d77a821e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957801",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c029-e514-4447-ba2d-408402de0b81",
|
|
|
|
|
"value": "2013-11-09T23:34:55"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957802",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c02a-1ee8-430c-9b60-416e02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/663ecdfa115605418b2826e4de7e289b0cd12849b719c7a171ee7524bf22fe99/analysis/1384040095/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957802",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c02a-335c-4f39-9973-41ef02de0b81",
|
|
|
|
|
"value": "29/46"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957805",
|
|
|
|
|
"uuid": "7db6a294-00d5-4a9d-b4ff-29e484eb8d4a",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "7db6a294-00d5-4a9d-b4ff-29e484eb8d4a",
|
|
|
|
|
"referenced_uuid": "4f42f6bc-bc09-4beb-b412-645e35f3d61c",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-bc1c-48bb-b9df-419a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957802",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c02a-1714-4a2a-85e9-46c002de0b81",
|
|
|
|
|
"value": "0dd66e761ae86fcea07c2db6b2c1a1d0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957803",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c02b-da84-477b-a8db-41ed02de0b81",
|
|
|
|
|
"value": "4f09185af27ad7ad6c96d5db6c5bb2b38f2ad118"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957803",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c02b-cc84-4a3c-abd8-453e02de0b81",
|
|
|
|
|
"value": "c7e92cc3f88c7180e2774f2641c593ebebedee3424314fdd8fa8365f6cd0000a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957803",
|
|
|
|
|
"uuid": "4f42f6bc-bc09-4beb-b412-645e35f3d61c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957803",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c02b-77a4-4353-b748-469902de0b81",
|
|
|
|
|
"value": "2018-02-18T22:42:54"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957804",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c02c-4ea0-4c17-9652-44bb02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c7e92cc3f88c7180e2774f2641c593ebebedee3424314fdd8fa8365f6cd0000a/analysis/1518993774/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957804",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c02c-6d8c-4750-b7e0-4a2e02de0b81",
|
|
|
|
|
"value": "47/58"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957807",
|
|
|
|
|
"uuid": "30ffb028-4ee1-479d-ad8e-b16c1c787b24",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "30ffb028-4ee1-479d-ad8e-b16c1c787b24",
|
|
|
|
|
"referenced_uuid": "cdd6e30a-cb0d-4276-8b1c-208f8db7873c",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-f2c8-4685-9551-401602de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957804",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c02c-b2e0-4e2b-9761-477602de0b81",
|
|
|
|
|
"value": "fbecbd26e13fae93d2b2a36c5a6a645c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957805",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c02d-6168-43a8-8a78-495f02de0b81",
|
|
|
|
|
"value": "a5781cb00f1c3b05bb61156b45b2175578c9b973"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957805",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c02d-b714-49bf-a675-4a3602de0b81",
|
|
|
|
|
"value": "0a52739b2a45b1002b78230df60dd42d2ffa0897197953639dd627bcc0454134"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957805",
|
|
|
|
|
"uuid": "cdd6e30a-cb0d-4276-8b1c-208f8db7873c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957806",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c02e-d548-4c2a-b0a9-479e02de0b81",
|
|
|
|
|
"value": "2016-06-08T11:33:10"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957806",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c02e-2570-418f-94ee-467902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0a52739b2a45b1002b78230df60dd42d2ffa0897197953639dd627bcc0454134/analysis/1465385590/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957806",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c02e-74a8-44dd-834a-453102de0b81",
|
|
|
|
|
"value": "37/57"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957809",
|
|
|
|
|
"uuid": "58e315b7-b23a-4232-a7df-24c01f2c6147",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "58e315b7-b23a-4232-a7df-24c01f2c6147",
|
|
|
|
|
"referenced_uuid": "a8ef1585-9219-4fd3-82c4-fd44b510ec44",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "5ad5c091-c510-47c8-9fb5-45a402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957806",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c02e-7d20-43a5-bc76-421602de0b81",
|
|
|
|
|
"value": "9d34c94b7684098684acb3a5624eed77"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957807",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c02f-0230-44af-94c2-475302de0b81",
|
|
|
|
|
"value": "6fad9f2313aa377dcfbf24f8f72148f8cbe04220"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957807",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c02f-8a8c-4742-863e-4fdc02de0b81",
|
|
|
|
|
"value": "c1e6324086192a47c60daee91f9f906c2ceb03cac0c67a8ed3f0a31c37e3a991"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957808",
|
|
|
|
|
"uuid": "a8ef1585-9219-4fd3-82c4-fd44b510ec44",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957808",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c030-8f80-475f-9258-446402de0b81",
|
|
|
|
|
"value": "2018-04-15T07:23:28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957808",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c030-b858-432c-89fc-4aae02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c1e6324086192a47c60daee91f9f906c2ceb03cac0c67a8ed3f0a31c37e3a991/analysis/1523777008/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957809",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c031-d0cc-4630-abc2-404902de0b81",
|
|
|
|
|
"value": "24/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957812",
|
|
|
|
|
"uuid": "eead743e-4f7b-417e-ab5b-754be3ab4639",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "eead743e-4f7b-417e-ab5b-754be3ab4639",
|
|
|
|
|
"referenced_uuid": "44db359a-2322-4199-b7b2-ad7047055145",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-b804-4efd-8926-419b02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957809",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c031-8654-4fcb-b81d-46ac02de0b81",
|
|
|
|
|
"value": "f04a33fba9e02ac620dae57d3fbef98d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957809",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c031-1808-4fb3-ba50-413502de0b81",
|
|
|
|
|
"value": "88c485a72af65f3e77cc060677c30e37874d1084"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957809",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c031-78ac-4657-b08d-426702de0b81",
|
|
|
|
|
"value": "aebb84da20c2c92da398b1e5fcc8adc6bfe893d5a8b56c5cd1beb42b3fa5f069"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957810",
|
|
|
|
|
"uuid": "44db359a-2322-4199-b7b2-ad7047055145",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957810",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c032-f778-46ca-a3f3-427e02de0b81",
|
|
|
|
|
"value": "2018-04-10T19:18:03"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957810",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c032-bf40-4afa-b471-4f9702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/aebb84da20c2c92da398b1e5fcc8adc6bfe893d5a8b56c5cd1beb42b3fa5f069/analysis/1523387883/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957811",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c033-5c78-4ab4-883b-401f02de0b81",
|
|
|
|
|
"value": "31/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957814",
|
|
|
|
|
"uuid": "c462c18c-5dd2-474d-9bdb-683249100648",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "c462c18c-5dd2-474d-9bdb-683249100648",
|
|
|
|
|
"referenced_uuid": "51803a65-599e-4c65-a62e-47cedcfdf679",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-3270-4e92-b694-40df02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957811",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c033-c4c8-4306-9d97-419e02de0b81",
|
|
|
|
|
"value": "6edaf925da32588b1a7ff520bf83110f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957811",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c033-73c8-4c9c-8fab-457502de0b81",
|
|
|
|
|
"value": "2392005587724e422ed77412a56c946b220ad5b5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957812",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c034-b5a4-46ba-9d83-46ae02de0b81",
|
|
|
|
|
"value": "30103085dd67ac6e9bdf14255fc5c8b697d68b810e732b4ae29798b62e5ad677"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957812",
|
|
|
|
|
"uuid": "51803a65-599e-4c65-a62e-47cedcfdf679",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957812",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c034-10ac-4225-82af-4e9a02de0b81",
|
|
|
|
|
"value": "2013-11-10T00:44:33"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957812",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c034-7bfc-4fdd-a823-4b8902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/30103085dd67ac6e9bdf14255fc5c8b697d68b810e732b4ae29798b62e5ad677/analysis/1384044273/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957813",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c035-7f54-4a87-990c-41cc02de0b81",
|
|
|
|
|
"value": "30/45"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957816",
|
|
|
|
|
"uuid": "24579f89-a5e2-40a1-b402-1a3f503a9fee",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "24579f89-a5e2-40a1-b402-1a3f503a9fee",
|
|
|
|
|
"referenced_uuid": "4df065d3-0e9e-474e-99f0-ddcfd2163f78",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-ab20-455e-89f4-410102de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957813",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c035-3960-4b32-a26b-45d002de0b81",
|
|
|
|
|
"value": "27d69990681a0c6219c580cffaaac5a7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957813",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c035-49cc-41c2-8f1b-4b0a02de0b81",
|
|
|
|
|
"value": "0e9b41fa1a5b36788c1705ccff0cc9e6c702b053"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957814",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c036-7250-4d9b-9d58-4f0202de0b81",
|
|
|
|
|
"value": "310848da5dd6e75c8df5bc00223582a7b7e6fbef90ca45222948eaba546be3bd"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957814",
|
|
|
|
|
"uuid": "4df065d3-0e9e-474e-99f0-ddcfd2163f78",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957814",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c036-33b0-46d0-8894-484c02de0b81",
|
|
|
|
|
"value": "2018-02-13T15:20:06"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957815",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c037-b0dc-43e6-9d77-46cd02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/310848da5dd6e75c8df5bc00223582a7b7e6fbef90ca45222948eaba546be3bd/analysis/1518535206/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957815",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c037-33e0-4c2c-a853-40d202de0b81",
|
|
|
|
|
"value": "47/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957818",
|
|
|
|
|
"uuid": "8e397422-74ed-45d1-9b6a-68a3333869ce",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "8e397422-74ed-45d1-9b6a-68a3333869ce",
|
|
|
|
|
"referenced_uuid": "3136bde9-7b09-4380-9688-b316ff8030a3",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-2ba0-4183-987c-420a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957815",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c037-4e78-475a-8a41-478a02de0b81",
|
|
|
|
|
"value": "923d42d648ba3f65d30e82d8a8405f74"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957816",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c038-e578-4f7f-bf72-450402de0b81",
|
|
|
|
|
"value": "955254b67dfcb399cbc2d9124b4a0d15bea94f74"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957817",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c039-bf40-4d6f-a4d4-4e5e02de0b81",
|
|
|
|
|
"value": "228ffe97f34e097a0cb3b3288ee56a063da65d890b1f888d59d59f0ad2b3bb71"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957817",
|
|
|
|
|
"uuid": "3136bde9-7b09-4380-9688-b316ff8030a3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957817",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c039-9f24-4691-b76c-477c02de0b81",
|
|
|
|
|
"value": "2013-10-12T08:23:46"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957818",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c03a-a9d4-4ff2-8955-4ab002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/228ffe97f34e097a0cb3b3288ee56a063da65d890b1f888d59d59f0ad2b3bb71/analysis/1381566226/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957818",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c03a-f83c-408b-9649-4cd402de0b81",
|
|
|
|
|
"value": "18/45"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957821",
|
|
|
|
|
"uuid": "a9fa6c94-efe8-4dbf-b103-c24ab19cbbf7",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "a9fa6c94-efe8-4dbf-b103-c24ab19cbbf7",
|
|
|
|
|
"referenced_uuid": "62a360ce-dbdb-4fbb-8e80-7ce96f87946c",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-c178-4b50-8603-488a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957818",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c03a-9f78-4129-abe6-444102de0b81",
|
|
|
|
|
"value": "06e083d515104be00cd6558791c44b52"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957819",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c03b-927c-4135-9d6e-443a02de0b81",
|
|
|
|
|
"value": "a7ab277b95e0058962ca6c95e80b7d8585f6b62c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957819",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c03b-380c-423e-b8c9-415c02de0b81",
|
|
|
|
|
"value": "c21fdd9a5d244aed75890c59094789c2f46815983084f4bc5966ae28630908a8"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957819",
|
|
|
|
|
"uuid": "62a360ce-dbdb-4fbb-8e80-7ce96f87946c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957819",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c03b-efec-49e2-9658-49f102de0b81",
|
|
|
|
|
"value": "2018-02-13T18:46:36"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957820",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c03c-1684-44bd-bbb9-4d7402de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c21fdd9a5d244aed75890c59094789c2f46815983084f4bc5966ae28630908a8/analysis/1518547596/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957820",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c03c-f0a4-4ab3-b414-440402de0b81",
|
|
|
|
|
"value": "46/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957823",
|
|
|
|
|
"uuid": "f165aa6e-5d89-4258-8673-39c9f6b9948c",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "f165aa6e-5d89-4258-8673-39c9f6b9948c",
|
|
|
|
|
"referenced_uuid": "85cfd077-9915-43ee-80d6-d145645df836",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-3960-42d0-94c5-47a502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957820",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c03c-68d8-4104-93a4-4cac02de0b81",
|
|
|
|
|
"value": "cc09780b9efd18bf7191089cc72c0785"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957821",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c03d-3800-45d4-b9ed-4b8902de0b81",
|
|
|
|
|
"value": "fcf3b257c6eed1ec42892a8ca951eb3dfde681ce"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957821",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c03d-5acc-499a-9308-425702de0b81",
|
|
|
|
|
"value": "ef4b97346e1ee359feff43d136f3dd6031993fb47bdfd25520b4fc3279d3649b"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957822",
|
|
|
|
|
"uuid": "85cfd077-9915-43ee-80d6-d145645df836",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957822",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c03e-bb64-4c95-9a6c-4f4f02de0b81",
|
|
|
|
|
"value": "2018-03-28T23:28:36"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957822",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c03e-0a1c-4baa-ae31-4cba02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/ef4b97346e1ee359feff43d136f3dd6031993fb47bdfd25520b4fc3279d3649b/analysis/1522279716/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957822",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c03e-9894-4877-924f-4ca002de0b81",
|
|
|
|
|
"value": "41/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957825",
|
|
|
|
|
"uuid": "475a6596-dcd2-4cd5-bde7-91710d2635ae",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "475a6596-dcd2-4cd5-bde7-91710d2635ae",
|
|
|
|
|
"referenced_uuid": "20aa948a-2c13-4806-97db-a0b7b736ef88",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-89d4-47cb-b89b-48b402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957823",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c03f-0050-4900-bef9-472502de0b81",
|
|
|
|
|
"value": "da4e7c3359edf27e38fbcd1ecfc901c8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957823",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c03f-c3c8-428f-9f39-490502de0b81",
|
|
|
|
|
"value": "67549dcd823b0592a958aa8443ce1c219103ed42"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957823",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c03f-01d0-4603-9508-44d602de0b81",
|
|
|
|
|
"value": "a1175ff8f5544f4ec078e4d55db4b6aff7a7844e9df2057d3fe906cfa77d25f0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957824",
|
|
|
|
|
"uuid": "20aa948a-2c13-4806-97db-a0b7b736ef88",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957824",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c040-5de4-4352-9aab-42d102de0b81",
|
|
|
|
|
"value": "2013-11-02T14:10:58"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957824",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c040-10d4-4800-ae14-416202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a1175ff8f5544f4ec078e4d55db4b6aff7a7844e9df2057d3fe906cfa77d25f0/analysis/1383401458/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957825",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c041-09f4-45ab-8721-433f02de0b81",
|
|
|
|
|
"value": "25/47"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957828",
|
|
|
|
|
"uuid": "f66345c9-da87-4634-807e-95b40b3f7829",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "f66345c9-da87-4634-807e-95b40b3f7829",
|
|
|
|
|
"referenced_uuid": "4f729230-95ef-4dd1-8e92-e3ca84fde7b0",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-b8f4-4920-92cf-488f02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957825",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c041-b7e4-439c-b1c8-403902de0b81",
|
|
|
|
|
"value": "7ab76d9f40f3d9c0e004a81734b2aeb8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957825",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c041-372c-43fd-a3e2-45e402de0b81",
|
|
|
|
|
"value": "9f5ce8fb8f070b03cc4d42a849e2e6563954f553"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957825",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c041-cb9c-46ee-87bd-4a1602de0b81",
|
|
|
|
|
"value": "2f9ca1b196aa915e3c87dabe20f353a4a69ee5998f8559ef8073194918dc7ea9"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957826",
|
|
|
|
|
"uuid": "4f729230-95ef-4dd1-8e92-e3ca84fde7b0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957826",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c042-d7b8-4166-920a-4f7902de0b81",
|
|
|
|
|
"value": "2013-10-07T09:01:54"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957826",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c042-e454-4172-a077-4af702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2f9ca1b196aa915e3c87dabe20f353a4a69ee5998f8559ef8073194918dc7ea9/analysis/1381136514/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957827",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c043-6468-426b-93d3-4afc02de0b81",
|
|
|
|
|
"value": "19/48"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957830",
|
|
|
|
|
"uuid": "3ec767cb-63b7-4634-936d-ec2c72b7f414",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "3ec767cb-63b7-4634-936d-ec2c72b7f414",
|
|
|
|
|
"referenced_uuid": "e68803ee-8f52-4a45-b1ad-fadc751112e0",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-509c-4bdc-a240-453402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957827",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c043-51d8-4b4e-ace9-416702de0b81",
|
|
|
|
|
"value": "c35973540aaffc8843e2b492433b4b78"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957827",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c043-72d8-487b-b9fe-416a02de0b81",
|
|
|
|
|
"value": "1dac4d6b1e9e7f8b304d434917c88f6557274c09"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957828",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c044-3404-42a5-bd34-480c02de0b81",
|
|
|
|
|
"value": "082f1ce18a378ec6eb67565fb7bd89cd29db886b44fe4312a863382af9e13df7"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957828",
|
|
|
|
|
"uuid": "e68803ee-8f52-4a45-b1ad-fadc751112e0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957828",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c044-fd14-4282-bdbf-400002de0b81",
|
|
|
|
|
"value": "2016-01-15T09:59:07"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957828",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c044-8848-471b-8854-43ce02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/082f1ce18a378ec6eb67565fb7bd89cd29db886b44fe4312a863382af9e13df7/analysis/1452851947/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957829",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c045-d4c0-413f-ae38-47cd02de0b81",
|
|
|
|
|
"value": "42/56"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957832",
|
|
|
|
|
"uuid": "2f1a76d0-7049-4e63-b652-573bad749c33",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "2f1a76d0-7049-4e63-b652-573bad749c33",
|
|
|
|
|
"referenced_uuid": "66400a8a-058c-46d1-be9e-5e0a8e28a098",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-1d28-4d8a-b2fa-437202de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957829",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c045-1098-45bb-b4cc-476e02de0b81",
|
|
|
|
|
"value": "083f4b601f084f80b3e10bf3478b68bf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957829",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c045-b7ac-4980-aaa7-4e6402de0b81",
|
|
|
|
|
"value": "d21edb550df8eea061eccb60b29bd219c8de3e0c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957830",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c046-7e50-4aa6-8789-411502de0b81",
|
|
|
|
|
"value": "98f7b5afa98edbfcb4a6f502d9d29e6bb0912a6bcb7a14abe3a9a60e0487b201"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957830",
|
|
|
|
|
"uuid": "66400a8a-058c-46d1-be9e-5e0a8e28a098",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957830",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c046-12a4-4e5d-806d-4d2302de0b81",
|
|
|
|
|
"value": "2018-02-13T18:17:32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957831",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c047-94a4-428c-8e26-4ba302de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/98f7b5afa98edbfcb4a6f502d9d29e6bb0912a6bcb7a14abe3a9a60e0487b201/analysis/1518545852/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957831",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c047-3624-4dbe-864a-4dd502de0b81",
|
|
|
|
|
"value": "33/60"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957834",
|
|
|
|
|
"uuid": "e7bf71e1-5ed5-46ce-8ba8-a1f4f00e8d19",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "e7bf71e1-5ed5-46ce-8ba8-a1f4f00e8d19",
|
|
|
|
|
"referenced_uuid": "92a63283-9df8-4cf5-831d-a1d429ae0a04",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-48d8-403b-9c8a-492a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957831",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c047-6d3c-4bd5-9d41-4c3002de0b81",
|
|
|
|
|
"value": "764f7d194a9fd699715da038b45d0d35"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957831",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c047-1590-4f77-89c8-4e8002de0b81",
|
|
|
|
|
"value": "79d20d3242c6a039359161313162c1bb05797d15"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957832",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c048-e88c-40c5-b946-44bd02de0b81",
|
|
|
|
|
"value": "2ca04f3c65e3fd16b9c879c7db4cc8025279463dbb965e3954e35106fe952e86"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957832",
|
|
|
|
|
"uuid": "92a63283-9df8-4cf5-831d-a1d429ae0a04",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957832",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c048-1020-475d-ade3-496802de0b81",
|
|
|
|
|
"value": "2018-04-16T06:08:59"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957833",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c049-d830-4572-9c71-41ca02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2ca04f3c65e3fd16b9c879c7db4cc8025279463dbb965e3954e35106fe952e86/analysis/1523858939/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957833",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c049-8704-4627-a507-431502de0b81",
|
|
|
|
|
"value": "28/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957836",
|
|
|
|
|
"uuid": "1c7451e3-1e01-469b-87a2-8fe5a7a8a1b3",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "1c7451e3-1e01-469b-87a2-8fe5a7a8a1b3",
|
|
|
|
|
"referenced_uuid": "4f0576c0-d450-4279-9daa-96479dfa26ee",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-036c-47d9-b844-499e02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957833",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c049-d88c-4565-bc7a-444302de0b81",
|
|
|
|
|
"value": "bf6cd7918821245d8cf822167ef41ba7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957834",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c04a-af9c-4c28-a8e5-4e2202de0b81",
|
|
|
|
|
"value": "305047c262f70690e61b90cdf4278b683da83a31"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957834",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c04a-2e94-4b3f-8b50-49ad02de0b81",
|
|
|
|
|
"value": "4e27ccfd0c90aab501d16d45b1e9d13bde3e2d6c2ba6d230b7973dcc8567e556"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957834",
|
|
|
|
|
"uuid": "4f0576c0-d450-4279-9daa-96479dfa26ee",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957834",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c04a-b8b4-4ec6-b6b5-4bd402de0b81",
|
|
|
|
|
"value": "2013-10-15T08:19:13"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957835",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c04b-9f00-412b-99e8-4cfb02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4e27ccfd0c90aab501d16d45b1e9d13bde3e2d6c2ba6d230b7973dcc8567e556/analysis/1381825153/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957835",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c04b-b56c-40f0-9fdd-46fe02de0b81",
|
|
|
|
|
"value": "23/47"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957838",
|
|
|
|
|
"uuid": "fe05184f-77b8-4157-80b7-07aa043c9936",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "fe05184f-77b8-4157-80b7-07aa043c9936",
|
|
|
|
|
"referenced_uuid": "2f79727e-28c0-423d-9ed6-8cbf85e2b518",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-c058-4f50-8e82-4dad02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957835",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c04b-3190-4a1c-9c67-406302de0b81",
|
|
|
|
|
"value": "3328804e560b53c97cfe787824bec452"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957836",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c04c-162c-4c10-9538-44f702de0b81",
|
|
|
|
|
"value": "de50f8d6f17a207ab88dd50127ca8da89f9ff738"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957836",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c04c-b6e4-442e-9f9e-4ed302de0b81",
|
|
|
|
|
"value": "599d9e37c39ec47a50b512e01449a37ff3c3354ed0b9b4de2ca7e8f2d3a33bfa"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957836",
|
|
|
|
|
"uuid": "2f79727e-28c0-423d-9ed6-8cbf85e2b518",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957837",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c04d-aba0-4ce3-a459-456602de0b81",
|
|
|
|
|
"value": "2018-02-14T02:28:48"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957837",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c04d-8e6c-4958-a908-4eab02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/599d9e37c39ec47a50b512e01449a37ff3c3354ed0b9b4de2ca7e8f2d3a33bfa/analysis/1518575328/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957837",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c04d-8060-48ba-884f-4f5102de0b81",
|
|
|
|
|
"value": "52/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957840",
|
|
|
|
|
"uuid": "3732f786-fed1-4ec0-81a2-cf90bac3e268",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "3732f786-fed1-4ec0-81a2-cf90bac3e268",
|
|
|
|
|
"referenced_uuid": "dc2dd4e7-efc4-4d62-8c13-1af4257ee137",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-5120-4b55-a0c6-478902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957838",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c04e-c394-418c-ac7e-4a8902de0b81",
|
|
|
|
|
"value": "ae1d5a422ee778c4ba40e5b224333a9d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957838",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c04e-248c-49d7-aac7-440102de0b81",
|
|
|
|
|
"value": "7abb25bf3182c58fc2a99b8727a28078eb143058"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957838",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c04e-c0d4-413e-b7f3-4d9402de0b81",
|
|
|
|
|
"value": "39c05a8b0d635eb221023154423dd3e26c93d16bb5a16a2512c68bde62996023"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957839",
|
|
|
|
|
"uuid": "dc2dd4e7-efc4-4d62-8c13-1af4257ee137",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957839",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c04f-bd60-4c59-99f8-452702de0b81",
|
|
|
|
|
"value": "2013-10-12T08:22:34"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957839",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c04f-b45c-46f0-a9e8-494f02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/39c05a8b0d635eb221023154423dd3e26c93d16bb5a16a2512c68bde62996023/analysis/1381566154/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957840",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c050-1a78-4846-86df-46c202de0b81",
|
|
|
|
|
"value": "19/47"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957843",
|
|
|
|
|
"uuid": "3bf3ae13-b58d-4f5d-8469-5a34c8122639",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "3bf3ae13-b58d-4f5d-8469-5a34c8122639",
|
|
|
|
|
"referenced_uuid": "409f2f05-3619-4f32-9c87-2ba0be7d1f14",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-f82c-4d36-badd-4bfc02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957840",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c050-4d6c-44d4-99cc-4ce602de0b81",
|
|
|
|
|
"value": "bcf18963a5f87002ebaa44255af5179d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957840",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c050-8244-4a62-a194-419702de0b81",
|
|
|
|
|
"value": "cdae45301536fdab9c3cf15dd6b0ccd1d1b579be"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957841",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c051-2148-4cae-a281-4a6302de0b81",
|
|
|
|
|
"value": "d7e95936470c9747f9c803d3839159e86112afbe49d68b578775f1c29141d502"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957841",
|
|
|
|
|
"uuid": "409f2f05-3619-4f32-9c87-2ba0be7d1f14",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957841",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c051-fb3c-4c91-a16e-410e02de0b81",
|
|
|
|
|
"value": "2018-02-16T07:47:11"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957841",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c051-0784-4c8e-8142-423502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/d7e95936470c9747f9c803d3839159e86112afbe49d68b578775f1c29141d502/analysis/1518767231/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957842",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c052-8560-4bfd-8e25-4bbd02de0b81",
|
|
|
|
|
"value": "53/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957845",
|
|
|
|
|
"uuid": "ca3966ec-726d-4dcb-81f4-39c21bce3b57",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "ca3966ec-726d-4dcb-81f4-39c21bce3b57",
|
|
|
|
|
"referenced_uuid": "54df5a27-b7e9-4370-b86a-434bc5c4bfb0",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-ab54-43f0-8707-43e702de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957842",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c052-5f88-436e-81b3-478a02de0b81",
|
|
|
|
|
"value": "02324f64dfa4be5bb0f4abafa5a27c51"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957842",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c052-81b0-4a62-8bec-4f2502de0b81",
|
|
|
|
|
"value": "349c4a436f1544aa76096d9f4100765d133ab49b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957843",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c053-f110-47b2-aeea-435f02de0b81",
|
|
|
|
|
"value": "3c9c3423951655b97251bf5d3d12fe59fcf96d4274c4887b88744438371fe61b"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957843",
|
|
|
|
|
"uuid": "54df5a27-b7e9-4370-b86a-434bc5c4bfb0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957843",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c053-32a0-46af-bcae-499c02de0b81",
|
|
|
|
|
"value": "2018-02-15T21:33:00"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957844",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c054-4f98-4e45-8060-452502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3c9c3423951655b97251bf5d3d12fe59fcf96d4274c4887b88744438371fe61b/analysis/1518730380/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957844",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c054-b870-4ed1-8121-461e02de0b81",
|
|
|
|
|
"value": "51/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957847",
|
|
|
|
|
"uuid": "54175632-8cf7-4b49-934a-da9ed750f839",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "54175632-8cf7-4b49-934a-da9ed750f839",
|
|
|
|
|
"referenced_uuid": "1602037e-3d0a-4d7c-aad4-690589211f3d",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-6a34-41e3-bd40-47d102de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957844",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c054-aff4-4e7e-a670-49d002de0b81",
|
|
|
|
|
"value": "c080899fd8c4c1a77df313c70d1ce2ff"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957845",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c055-dd70-4735-9c04-4d7202de0b81",
|
|
|
|
|
"value": "f38e818652e93bea7cea5bde4da7b511fa221fa4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957845",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c055-9fb8-4326-8152-46db02de0b81",
|
|
|
|
|
"value": "44f6b3cea3a371a7cd6161739dcc6f9f96a40c8c732b1acd8042a2991a9bbf73"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957845",
|
|
|
|
|
"uuid": "1602037e-3d0a-4d7c-aad4-690589211f3d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957845",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c055-08a4-4c7c-897e-467402de0b81",
|
|
|
|
|
"value": "2018-04-15T10:33:07"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957846",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c056-3c48-4e4f-9f54-46d902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/44f6b3cea3a371a7cd6161739dcc6f9f96a40c8c732b1acd8042a2991a9bbf73/analysis/1523788387/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957846",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c056-83ac-431f-80f8-494c02de0b81",
|
|
|
|
|
"value": "43/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957849",
|
|
|
|
|
"uuid": "22060082-286e-4e92-a9de-5932cc66684c",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "22060082-286e-4e92-a9de-5932cc66684c",
|
|
|
|
|
"referenced_uuid": "da7a7be3-a8bf-4a4b-942e-6366ca70d287",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957906",
|
|
|
|
|
"uuid": "5ad5c092-fe80-46fe-a7bc-468602de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957846",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c056-1360-44f7-8cba-460d02de0b81",
|
|
|
|
|
"value": "1772c2d5cbb68dbb3d6436f0e03587d2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957847",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c057-4f80-443b-992b-44a702de0b81",
|
|
|
|
|
"value": "d5ffc39edb0660e6e4c678d6bc8453172ed8e96f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957847",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c057-21cc-4bce-9bf8-4a9202de0b81",
|
|
|
|
|
"value": "380545cfde4acaf2c29969d175db1cecd28c5691693e097e52da5c0e886a8301"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957847",
|
|
|
|
|
"uuid": "da7a7be3-a8bf-4a4b-942e-6366ca70d287",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957848",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c058-fc54-4bee-bfaf-41f502de0b81",
|
|
|
|
|
"value": "2014-11-06T23:59:48"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957848",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c058-4f48-47ed-898c-435b02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/380545cfde4acaf2c29969d175db1cecd28c5691693e097e52da5c0e886a8301/analysis/1415318388/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957848",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c058-9ab0-43c1-8ec2-4e5a02de0b81",
|
|
|
|
|
"value": "33/54"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957851",
|
|
|
|
|
"uuid": "bc3cbc70-c086-48a4-8c6e-faf4f66dc4fd",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "bc3cbc70-c086-48a4-8c6e-faf4f66dc4fd",
|
|
|
|
|
"referenced_uuid": "fe8692b8-47ed-49ae-ac84-c200cf0fb40b",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-b744-4f34-87cc-453a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957849",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c059-a728-438b-9fdc-4dd202de0b81",
|
|
|
|
|
"value": "c3cac81d6f2b9eef489e93ab8f3f73db"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957849",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c059-c2ec-40c6-bcdc-4cee02de0b81",
|
|
|
|
|
"value": "f8394dd33bd8adf68c9741f16c49cac87452518f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957849",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c059-3cb8-4550-bbae-4d0502de0b81",
|
|
|
|
|
"value": "036d8c2a089ea0870fa37060c96928789a8b373ca0795d1c06db443b53dc5882"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957850",
|
|
|
|
|
"uuid": "fe8692b8-47ed-49ae-ac84-c200cf0fb40b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957850",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c05a-d550-4d9d-a9b0-44f602de0b81",
|
|
|
|
|
"value": "2018-02-16T00:01:10"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957850",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c05a-96d8-4354-93e7-4f8402de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/036d8c2a089ea0870fa37060c96928789a8b373ca0795d1c06db443b53dc5882/analysis/1518739270/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957851",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c05b-1c4c-4560-9695-45d602de0b81",
|
|
|
|
|
"value": "54/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957854",
|
|
|
|
|
"uuid": "f971946a-c11f-4e87-958e-b1216469856d",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "f971946a-c11f-4e87-958e-b1216469856d",
|
|
|
|
|
"referenced_uuid": "7fc03e03-5dfe-4d7b-9ca9-d4f2c47233fb",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-610c-4a90-92e0-4a8102de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957851",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c05b-95e8-418a-bb47-4ffb02de0b81",
|
|
|
|
|
"value": "b1941d4166446c06d6d632e970d92636"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957851",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c05b-2a50-4ebf-824b-481f02de0b81",
|
|
|
|
|
"value": "b9dc3b298aad57e771b67bc5f1e233ffb8ffd5c6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957851",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c05b-2c24-4f4f-aa0c-484402de0b81",
|
|
|
|
|
"value": "acaa87b92f1e2ee316033624e4760ca4f9c781e82b72949c46861c7652cf74c2"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957852",
|
|
|
|
|
"uuid": "7fc03e03-5dfe-4d7b-9ca9-d4f2c47233fb",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957852",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c05c-c4b4-4a8b-8d70-449402de0b81",
|
|
|
|
|
"value": "2018-02-13T18:43:15"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957852",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c05c-9500-4c70-b41d-4fca02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/acaa87b92f1e2ee316033624e4760ca4f9c781e82b72949c46861c7652cf74c2/analysis/1518547395/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957853",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c05d-4c84-4704-8334-403402de0b81",
|
|
|
|
|
"value": "46/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957856",
|
|
|
|
|
"uuid": "820f1598-4c73-4860-8239-acc32c501496",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "820f1598-4c73-4860-8239-acc32c501496",
|
|
|
|
|
"referenced_uuid": "686748b5-288c-48a2-9596-1fc1e96df87b",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-023c-47b1-951c-4c1402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957853",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c05d-1188-4ff4-8a28-46a902de0b81",
|
|
|
|
|
"value": "1d1f1a00e81ea25b47ce8ab5f985e613"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957853",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c05d-1f0c-434c-a69a-4db002de0b81",
|
|
|
|
|
"value": "dbb963bbafa980549c37f910f88e74384116dc5a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957854",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c05e-fa84-4869-826f-44f202de0b81",
|
|
|
|
|
"value": "fdb559a29e0374fa7ce71d8661400fcc2d2db7d3486822a5cf1e0eba5c5634c8"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957854",
|
|
|
|
|
"uuid": "686748b5-288c-48a2-9596-1fc1e96df87b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957854",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c05e-b79c-4038-8b10-456902de0b81",
|
|
|
|
|
"value": "2013-10-10T04:18:12"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957854",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c05e-e100-4ffd-8a55-442202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/fdb559a29e0374fa7ce71d8661400fcc2d2db7d3486822a5cf1e0eba5c5634c8/analysis/1381378692/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957855",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c05f-2354-4d54-8aad-492802de0b81",
|
|
|
|
|
"value": "26/48"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957858",
|
|
|
|
|
"uuid": "9b31f6f2-1afa-4cc1-b1c9-3939d61c351e",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "9b31f6f2-1afa-4cc1-b1c9-3939d61c351e",
|
|
|
|
|
"referenced_uuid": "c3012495-b7ed-4916-9049-53b6c65ac11b",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-b3d4-498d-b442-439902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957855",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c05f-2ecc-470f-9219-483902de0b81",
|
|
|
|
|
"value": "abdf720306ad14a86c6398e54f0be09d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957855",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c05f-c018-429b-a1a3-48de02de0b81",
|
|
|
|
|
"value": "0cb24debe4cbc25c4f0c52911fdb98078e275511"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957856",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c060-b7a8-42ec-851e-4fff02de0b81",
|
|
|
|
|
"value": "9dc0c514ea1aaa91c1255857cb261bd6c94f8565ffef4420b75c5d5320717b09"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957856",
|
|
|
|
|
"uuid": "c3012495-b7ed-4916-9049-53b6c65ac11b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957856",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c060-6404-401e-af9d-459902de0b81",
|
|
|
|
|
"value": "2013-11-22T08:18:41"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957857",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c061-ba4c-4bc3-867f-4bee02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9dc0c514ea1aaa91c1255857cb261bd6c94f8565ffef4420b75c5d5320717b09/analysis/1385108321/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957857",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c061-2068-4c26-b711-491402de0b81",
|
|
|
|
|
"value": "29/40"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957860",
|
|
|
|
|
"uuid": "4febf0f3-b71a-45e4-baed-ebd75779a918",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "4febf0f3-b71a-45e4-baed-ebd75779a918",
|
|
|
|
|
"referenced_uuid": "872d5324-22bb-4366-a495-9cfe1ab1fcb8",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-56f8-44c7-ad4c-405b02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957857",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c061-b080-4220-b4ce-453502de0b81",
|
|
|
|
|
"value": "8efc70786479935b96f803fe10cb6044"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957857",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c061-2c5c-4e22-87df-4d7902de0b81",
|
|
|
|
|
"value": "b6ff511bf3089529d49b66ed3cbb6253b6d94193"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957858",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c062-49e0-4b7b-bc37-4ad402de0b81",
|
|
|
|
|
"value": "8fdabcedb02b4ae9364e53f38738710a1f6e9851077c29dbda34cf934229b47d"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957858",
|
|
|
|
|
"uuid": "872d5324-22bb-4366-a495-9cfe1ab1fcb8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957858",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c062-6b68-4143-8d55-49dd02de0b81",
|
|
|
|
|
"value": "2013-10-10T07:16:17"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957859",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c063-6d60-4e3b-a972-490a02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/8fdabcedb02b4ae9364e53f38738710a1f6e9851077c29dbda34cf934229b47d/analysis/1381389377/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957859",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c063-d884-4fe3-87c7-4a1b02de0b81",
|
|
|
|
|
"value": "17/43"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957862",
|
|
|
|
|
"uuid": "b366383d-8567-41d5-8bd2-098a72d6410b",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "b366383d-8567-41d5-8bd2-098a72d6410b",
|
|
|
|
|
"referenced_uuid": "c18455f9-0c99-40ad-9307-b6c207b78199",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-0e34-4b2f-8303-4b8902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957859",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c063-4ec4-4efe-ae43-483902de0b81",
|
|
|
|
|
"value": "fa3cc35f616ee7a76d412fd7b1844d13"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957860",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c064-9ae8-4a9e-a998-45e602de0b81",
|
|
|
|
|
"value": "e436d27ebd89381f69a5b2f877d7a9b9e96aa330"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957860",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c064-737c-4330-99de-475202de0b81",
|
|
|
|
|
"value": "4d0f0b7c9a3b8694895275fcc45aa1df3e6f2ad0c58563a40ac80776c705f821"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957860",
|
|
|
|
|
"uuid": "c18455f9-0c99-40ad-9307-b6c207b78199",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957860",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c064-2b64-42fc-a8be-407102de0b81",
|
|
|
|
|
"value": "2018-02-14T02:26:09"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957861",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c065-f684-449c-a824-41d202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4d0f0b7c9a3b8694895275fcc45aa1df3e6f2ad0c58563a40ac80776c705f821/analysis/1518575169/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957861",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c065-b56c-4c67-81dc-493002de0b81",
|
|
|
|
|
"value": "49/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957864",
|
|
|
|
|
"uuid": "338c09b1-8889-4266-bc9c-9b6198986d8e",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "338c09b1-8889-4266-bc9c-9b6198986d8e",
|
|
|
|
|
"referenced_uuid": "ed59d7cd-6596-4802-b2c8-8bc71943c90f",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-b0f4-4898-975b-4be502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957861",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c065-89c0-40c6-9cc5-468902de0b81",
|
|
|
|
|
"value": "3bc9ae5f2b9e828fa6da848e1bd80ae4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957862",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c066-f434-4c5a-9905-44d202de0b81",
|
|
|
|
|
"value": "cbde1c5e0a62d24f295debb65e6a4e9a677a7e0f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957862",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c066-9400-47b0-8522-4f8c02de0b81",
|
|
|
|
|
"value": "6bd38baca4b923c26628e9dcf9ee64d8bcc5c4ba9cb9f2298e32f8db7816de08"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957863",
|
|
|
|
|
"uuid": "ed59d7cd-6596-4802-b2c8-8bc71943c90f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957863",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c067-9f84-4c25-87c3-440b02de0b81",
|
|
|
|
|
"value": "2013-10-10T07:18:37"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957863",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c067-a25c-424e-ba70-423c02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6bd38baca4b923c26628e9dcf9ee64d8bcc5c4ba9cb9f2298e32f8db7816de08/analysis/1381389517/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957863",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c067-d180-4bc8-9d4b-44aa02de0b81",
|
|
|
|
|
"value": "19/47"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957866",
|
|
|
|
|
"uuid": "9b0cbf41-9f55-4c12-af30-95638bcb9724",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "9b0cbf41-9f55-4c12-af30-95638bcb9724",
|
|
|
|
|
"referenced_uuid": "ddd0eeec-07f6-4e82-aa68-2237276ef93e",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-5d14-4a8b-8a85-449002de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957863",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c067-c44c-49be-8891-4ed202de0b81",
|
|
|
|
|
"value": "7fb513b75ccf200bf82351a9e41a0973"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957864",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c068-684c-4556-b044-488e02de0b81",
|
|
|
|
|
"value": "0f77fb6b52f2b76a3675d5a7cf872966710f812c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957864",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c068-8a30-44af-ad04-4efd02de0b81",
|
|
|
|
|
"value": "c7dcf76652af54cf4cbbfdfc4fa5cc8d4a8e1807d478eceee32270260dbfecf7"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957865",
|
|
|
|
|
"uuid": "ddd0eeec-07f6-4e82-aa68-2237276ef93e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957865",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c069-447c-468d-887d-4df002de0b81",
|
|
|
|
|
"value": "2013-10-13T11:14:58"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957865",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c069-2d8c-4cd0-a08c-465102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c7dcf76652af54cf4cbbfdfc4fa5cc8d4a8e1807d478eceee32270260dbfecf7/analysis/1381662898/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957866",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c06a-89a0-4cff-8102-440b02de0b81",
|
|
|
|
|
"value": "20/47"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957869",
|
|
|
|
|
"uuid": "23d68864-87dc-40f6-8bdb-0382a2de717f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "23d68864-87dc-40f6-8bdb-0382a2de717f",
|
|
|
|
|
"referenced_uuid": "6a099e7c-a5dd-400b-8bca-df7575a5f1e0",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-2a24-4dcf-b28f-48d302de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957866",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c06a-c620-409d-97c7-46ab02de0b81",
|
|
|
|
|
"value": "0b552b46d59aaade686dbb4cac9bc71f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957866",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c06a-c47c-4c77-b3fd-48f202de0b81",
|
|
|
|
|
"value": "45dabdbc4b4608f9341d29fdf403026b9ab72ea7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957866",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c06a-de64-47fd-a80d-43a602de0b81",
|
|
|
|
|
"value": "8ecfcfc939e40cc943df83f548286c2f7f519a53e195b3ae595e0bef39baee29"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957867",
|
|
|
|
|
"uuid": "6a099e7c-a5dd-400b-8bca-df7575a5f1e0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957867",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c06b-39f4-4699-a5b4-417602de0b81",
|
|
|
|
|
"value": "2018-03-30T01:34:25"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957867",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c06b-d7d0-4c66-b15e-4d0202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/8ecfcfc939e40cc943df83f548286c2f7f519a53e195b3ae595e0bef39baee29/analysis/1522373665/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957868",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c06c-f244-4d49-9511-486002de0b81",
|
|
|
|
|
"value": "9/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957871",
|
|
|
|
|
"uuid": "bf50fe3f-7ce4-4162-bee5-5b58898ff862",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "bf50fe3f-7ce4-4162-bee5-5b58898ff862",
|
|
|
|
|
"referenced_uuid": "e031d087-ef4b-4824-9859-b46854c2939b",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-79b0-4e4c-85a3-466302de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957868",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c06c-f2ec-42ca-8b2c-496302de0b81",
|
|
|
|
|
"value": "a24a18a8496520e1c5683334e0180d13"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957868",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c06c-d6d4-4aaa-bf0e-4b4a02de0b81",
|
|
|
|
|
"value": "0d5a0bbf4f2181ec29dcc403b5b5911aec64a617"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957869",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c06d-1958-469b-b6d0-411a02de0b81",
|
|
|
|
|
"value": "6856286bb8ac5961f58831e7e4fa6debe7a4a399e5ffa56d37e7ca78f1588871"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957869",
|
|
|
|
|
"uuid": "e031d087-ef4b-4824-9859-b46854c2939b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957869",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c06d-f844-4fc9-a9e8-4ebb02de0b81",
|
|
|
|
|
"value": "2018-02-13T19:38:44"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957870",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c06e-c090-4419-af65-4ea302de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6856286bb8ac5961f58831e7e4fa6debe7a4a399e5ffa56d37e7ca78f1588871/analysis/1518550724/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957870",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c06e-3220-4587-a392-47a202de0b81",
|
|
|
|
|
"value": "44/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957873",
|
|
|
|
|
"uuid": "a2d09237-7842-4a7c-9966-66901fed8c9d",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "a2d09237-7842-4a7c-9966-66901fed8c9d",
|
|
|
|
|
"referenced_uuid": "f2130b6f-d3b1-4d06-9938-964ee58f732c",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-e624-491a-9905-4d7402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957870",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c06e-c704-451b-8725-4ebf02de0b81",
|
|
|
|
|
"value": "022fc987b7cd2f7530b694f1ca3fd867"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957870",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c06e-b884-4d57-97d5-434b02de0b81",
|
|
|
|
|
"value": "ab0e9d0b4f009d91f218dd57aece93f29ffc1526"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957871",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c06f-b144-4965-91be-415c02de0b81",
|
|
|
|
|
"value": "66c2586add3eac9184972cfc7a6172532c16dc0d1e1f874e4cd3fa2276657c2a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957871",
|
|
|
|
|
"uuid": "f2130b6f-d3b1-4d06-9938-964ee58f732c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957871",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c06f-923c-4d45-b22a-471a02de0b81",
|
|
|
|
|
"value": "2018-02-14T02:31:17"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957872",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c070-93bc-4aee-99d9-4d3402de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/66c2586add3eac9184972cfc7a6172532c16dc0d1e1f874e4cd3fa2276657c2a/analysis/1518575477/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957872",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c070-a65c-43e0-be04-424f02de0b81",
|
|
|
|
|
"value": "49/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957875",
|
|
|
|
|
"uuid": "93d0b571-4b57-409a-8616-fe681227c5b0",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "93d0b571-4b57-409a-8616-fe681227c5b0",
|
|
|
|
|
"referenced_uuid": "ef46be73-9a3e-44c3-83c2-4ede304d137b",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-bf70-44c1-9e9e-459e02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957872",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c070-9a28-4ed8-8efa-4e3602de0b81",
|
|
|
|
|
"value": "a6480a1ca24847268d44b032a86e8e5f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957873",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c071-d4bc-4844-8e0c-43ca02de0b81",
|
|
|
|
|
"value": "21cbdf4557ba7480d1206bcd6cd6765f25381218"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957873",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c071-ea50-49e1-b9bf-4ca202de0b81",
|
|
|
|
|
"value": "ac6fbd8f18bb93cfac31af73eb9cf6a1aa925b95d44b42b3659ecfd49209ec76"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957873",
|
|
|
|
|
"uuid": "ef46be73-9a3e-44c3-83c2-4ede304d137b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957873",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c071-afa8-4c27-8542-468802de0b81",
|
|
|
|
|
"value": "2018-04-15T07:23:18"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957874",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c072-8e14-4de4-b957-408302de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/ac6fbd8f18bb93cfac31af73eb9cf6a1aa925b95d44b42b3659ecfd49209ec76/analysis/1523776998/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957874",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c072-3314-4e01-aa37-430202de0b81",
|
|
|
|
|
"value": "43/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957877",
|
|
|
|
|
"uuid": "d3888401-a744-46ca-af6a-ebd96da536f0",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "d3888401-a744-46ca-af6a-ebd96da536f0",
|
|
|
|
|
"referenced_uuid": "d0fb5f61-30c3-4b2e-a514-31fc3fff048f",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-73c4-4ac8-956c-4c5902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957874",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c072-95c8-4014-8cb2-4c2902de0b81",
|
|
|
|
|
"value": "62f93f7c41eb93f73152d7318075938c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957875",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c073-9e84-4d5e-b1c4-4fd202de0b81",
|
|
|
|
|
"value": "9257e517c6fcff239b29856bf912c80d6015ba6c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957875",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c073-3be0-4b61-86bf-47a002de0b81",
|
|
|
|
|
"value": "cb2155b65879f66eb449b60a90c632c701fbea7ac8d4011e3b24b238c3302de0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957876",
|
|
|
|
|
"uuid": "d0fb5f61-30c3-4b2e-a514-31fc3fff048f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957876",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c074-e918-4986-8a4b-44d102de0b81",
|
|
|
|
|
"value": "2013-10-10T07:16:18"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957876",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c074-e6bc-4229-bdaa-488602de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/cb2155b65879f66eb449b60a90c632c701fbea7ac8d4011e3b24b238c3302de0/analysis/1381389378/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957876",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c074-8df4-4246-8a6a-419d02de0b81",
|
|
|
|
|
"value": "20/47"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957879",
|
|
|
|
|
"uuid": "48f7985a-f575-46f2-b2a6-d8f9f349e20d",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "48f7985a-f575-46f2-b2a6-d8f9f349e20d",
|
|
|
|
|
"referenced_uuid": "1ef1d86b-f368-4bf7-899f-8e2141bf5ae7",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-17b0-4ff6-b132-479a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957876",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c074-6c20-4b5a-9a24-44b602de0b81",
|
|
|
|
|
"value": "2d0398564ff410100e31e772d75b109e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957877",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c075-5550-4477-af77-47be02de0b81",
|
|
|
|
|
"value": "c4b66d9732769033ae7450faf18a6e88653ebc64"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957877",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c075-19c8-4b4f-b5af-4bd702de0b81",
|
|
|
|
|
"value": "70d50a77db7cb028163638a7e58c354e1fbab4757323ad9eccfb51e9b257f83c"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957878",
|
|
|
|
|
"uuid": "1ef1d86b-f368-4bf7-899f-8e2141bf5ae7",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957878",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c076-6f40-41ea-8620-4abc02de0b81",
|
|
|
|
|
"value": "2018-04-11T11:15:54"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957878",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c076-ace4-445e-88c7-4ec702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/70d50a77db7cb028163638a7e58c354e1fbab4757323ad9eccfb51e9b257f83c/analysis/1523445354/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957879",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c077-11fc-46a9-9802-4f7302de0b81",
|
|
|
|
|
"value": "46/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957882",
|
|
|
|
|
"uuid": "bbb9a50d-b258-4447-b8a5-c15bf7581ae8",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "bbb9a50d-b258-4447-b8a5-c15bf7581ae8",
|
|
|
|
|
"referenced_uuid": "0a443b7d-1866-4230-b65b-dedabfe03e83",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-2744-4c9f-bbf1-4cf702de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957879",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c077-bbd4-4dfb-9b36-41e302de0b81",
|
|
|
|
|
"value": "4dc1b426f104f24bc26ccb2370cb3dc6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957879",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c077-2898-4eda-941f-484202de0b81",
|
|
|
|
|
"value": "b5bbcd25a910d03fa056ccbd5d038e026070a0a1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957879",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c077-2434-431d-bd3b-49cf02de0b81",
|
|
|
|
|
"value": "35c996576eba666a33e26bc25122196de365465da8ebee70930b9c4ec6be7313"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957880",
|
|
|
|
|
"uuid": "0a443b7d-1866-4230-b65b-dedabfe03e83",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957880",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c078-0b0c-47f2-b71b-4cc602de0b81",
|
|
|
|
|
"value": "2018-04-15T07:22:25"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957880",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c078-0fd0-4129-86c7-428102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/35c996576eba666a33e26bc25122196de365465da8ebee70930b9c4ec6be7313/analysis/1523776945/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957881",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c079-a16c-4ab0-9747-4b2302de0b81",
|
|
|
|
|
"value": "36/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957884",
|
|
|
|
|
"uuid": "34f4e2b6-3c81-4759-984f-86d7b4918862",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "34f4e2b6-3c81-4759-984f-86d7b4918862",
|
|
|
|
|
"referenced_uuid": "332bc7c4-5a4e-4d1f-ad95-ba547a1bd03d",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-8500-439d-a588-484d02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957881",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c079-10ec-4456-8222-45c902de0b81",
|
|
|
|
|
"value": "00145e4e28e265313235ac7f6dbbd780"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957881",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c079-ba0c-4095-9eea-40da02de0b81",
|
|
|
|
|
"value": "c0de7c159022c157bfca575defd1aa954889e477"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957881",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c079-6a1c-4cb7-ae99-497202de0b81",
|
|
|
|
|
"value": "c76394aaf293cbf4bf3b9d7a94c251feac11435204664d700bb4bd87da3c1898"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957882",
|
|
|
|
|
"uuid": "332bc7c4-5a4e-4d1f-ad95-ba547a1bd03d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957882",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c07a-3250-4563-8e46-4bc902de0b81",
|
|
|
|
|
"value": "2018-02-13T19:26:44"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957882",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c07a-1ef4-4e49-8026-44e002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c76394aaf293cbf4bf3b9d7a94c251feac11435204664d700bb4bd87da3c1898/analysis/1518550004/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957883",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c07b-1578-4e88-8b74-44f402de0b81",
|
|
|
|
|
"value": "48/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957886",
|
|
|
|
|
"uuid": "d1fc796f-8f35-4217-a3cc-d034728cab47",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "d1fc796f-8f35-4217-a3cc-d034728cab47",
|
|
|
|
|
"referenced_uuid": "91de0b6e-f4f2-43e9-8ea7-3f3e5341eecb",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-6fcc-403d-926d-44c202de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957883",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c07b-1d38-4ab7-af4e-4d7002de0b81",
|
|
|
|
|
"value": "c0f96b7e834dbe37e433b6303922ca42"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957883",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c07b-ba44-4101-990f-4bb602de0b81",
|
|
|
|
|
"value": "400b9782c5d1c95a6d3f1824e767abb45f07d26c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957884",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c07c-31d4-4d15-b39f-424002de0b81",
|
|
|
|
|
"value": "b609c46124d069b2299de3896a5cc2f7540e4effcba462e7f5300573666efd4a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957884",
|
|
|
|
|
"uuid": "91de0b6e-f4f2-43e9-8ea7-3f3e5341eecb",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957884",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c07c-90e8-4e3d-ac7d-45b202de0b81",
|
|
|
|
|
"value": "2018-02-16T05:49:02"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957885",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c07d-7038-431d-bbd2-4f1b02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b609c46124d069b2299de3896a5cc2f7540e4effcba462e7f5300573666efd4a/analysis/1518760142/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957885",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c07d-8048-4f17-8d40-477b02de0b81",
|
|
|
|
|
"value": "53/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957888",
|
|
|
|
|
"uuid": "8d5831df-85b4-49dd-ac0e-a65280af1025",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "8d5831df-85b4-49dd-ac0e-a65280af1025",
|
|
|
|
|
"referenced_uuid": "0475bcfd-dcdf-44d2-87b0-2083883a290c",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-1e44-483b-aae4-420102de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957885",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c07d-8170-42b5-bb1b-4d9d02de0b81",
|
|
|
|
|
"value": "a0f504db6b930307d2ed8d4237288627"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957885",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c07d-3d10-45bd-913f-4a8802de0b81",
|
|
|
|
|
"value": "b69e6e1c4412b1c7242bd68f4ad69f4441b7bbef"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957886",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c07e-8900-4259-b0b7-486802de0b81",
|
|
|
|
|
"value": "61dede4113d1eda504f7360ae535cd88ede9425722db4a43577185d0312acd5a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957886",
|
|
|
|
|
"uuid": "0475bcfd-dcdf-44d2-87b0-2083883a290c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957886",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c07e-26a4-4da5-b319-4fa002de0b81",
|
|
|
|
|
"value": "2013-11-11T14:55:26"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957887",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c07f-20a0-4939-817f-40e002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/61dede4113d1eda504f7360ae535cd88ede9425722db4a43577185d0312acd5a/analysis/1384181726/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957887",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c07f-1060-46e6-8da7-40de02de0b81",
|
|
|
|
|
"value": "36/47"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957890",
|
|
|
|
|
"uuid": "2bd61b04-6327-416d-b613-a56d7c4a6dfe",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "2bd61b04-6327-416d-b613-a56d7c4a6dfe",
|
|
|
|
|
"referenced_uuid": "610984d9-b024-4156-9823-26b761e17e15",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-a1c4-461e-99a9-42a502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957887",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c07f-f1c4-44da-b359-426702de0b81",
|
|
|
|
|
"value": "06961bc6bdd66e7dbf9411f48a97ac54"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957888",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c080-9a24-4736-bd6d-45d002de0b81",
|
|
|
|
|
"value": "d41d6b1778be5558caac06c5793ae26d764316a5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957888",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c080-ff34-45b6-9a2b-4bdc02de0b81",
|
|
|
|
|
"value": "2eed2f22d055d605a8387d35610e4e82815eb29b7212de12088202efa54d3c31"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957888",
|
|
|
|
|
"uuid": "610984d9-b024-4156-9823-26b761e17e15",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957888",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c080-a43c-4826-a378-492602de0b81",
|
|
|
|
|
"value": "2018-02-13T21:48:04"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957889",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c081-ca64-4898-94a0-476002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2eed2f22d055d605a8387d35610e4e82815eb29b7212de12088202efa54d3c31/analysis/1518558484/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957889",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c081-e8fc-4cc3-95df-423702de0b81",
|
|
|
|
|
"value": "46/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957892",
|
|
|
|
|
"uuid": "7bebd57c-bb57-4da1-a8b1-97fb53694f80",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "7bebd57c-bb57-4da1-a8b1-97fb53694f80",
|
|
|
|
|
"referenced_uuid": "4d3f77ed-8659-4a4c-8a0f-65c772c7a7fe",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957907",
|
|
|
|
|
"uuid": "5ad5c093-60a4-411f-9c36-4db402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957889",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c081-44ac-41b3-85da-47c102de0b81",
|
|
|
|
|
"value": "3c439eb4f27e7b5a12a2eb2d45f5ddae"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957890",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c082-0c5c-4347-97ee-4afe02de0b81",
|
|
|
|
|
"value": "18d057a246f5fdaebf913567c6da86c18f257a1a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957890",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c082-a330-4458-9ea7-48d402de0b81",
|
|
|
|
|
"value": "d62ee1186d8a8c7d84b2a03e0bee1c13c47d133a55238ba7c367f9539e6c9b17"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957890",
|
|
|
|
|
"uuid": "4d3f77ed-8659-4a4c-8a0f-65c772c7a7fe",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957891",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c083-90a4-479b-a98e-491b02de0b81",
|
|
|
|
|
"value": "2018-04-15T07:23:38"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957891",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c083-15e0-4fce-b961-456f02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/d62ee1186d8a8c7d84b2a03e0bee1c13c47d133a55238ba7c367f9539e6c9b17/analysis/1523777018/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957891",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c083-c6e0-4ffb-80e2-4ca202de0b81",
|
|
|
|
|
"value": "41/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957894",
|
|
|
|
|
"uuid": "b91d5808-92ad-4fa7-9b4d-7348cc563091",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "b91d5808-92ad-4fa7-9b4d-7348cc563091",
|
|
|
|
|
"referenced_uuid": "7994aa0e-7f14-4988-8820-5ffe04a261d1",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957908",
|
|
|
|
|
"uuid": "5ad5c094-3f4c-4d62-8eeb-4e4002de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957891",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c083-93c8-4a94-83f3-412802de0b81",
|
|
|
|
|
"value": "da6963cf4251a26a96783e36d7f79f6a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957892",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c084-da8c-411b-9386-423102de0b81",
|
|
|
|
|
"value": "8b626ec47c9839a787205ee0fa0f4a96cb500f5f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957892",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c084-e220-45c5-a9a7-476e02de0b81",
|
|
|
|
|
"value": "3538c0a7785ab6d418112d10cd6844ded5745064840d18d74d9b978dea1fe1a9"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957893",
|
|
|
|
|
"uuid": "7994aa0e-7f14-4988-8820-5ffe04a261d1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957893",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c085-63c4-49a7-b955-49a502de0b81",
|
|
|
|
|
"value": "2018-04-08T21:26:04"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957893",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c085-23cc-4f44-b955-4acd02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3538c0a7785ab6d418112d10cd6844ded5745064840d18d74d9b978dea1fe1a9/analysis/1523222764/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957893",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c085-26d0-4136-b322-4c6a02de0b81",
|
|
|
|
|
"value": "19/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957896",
|
|
|
|
|
"uuid": "f46250f9-0e9b-4e25-9bee-b06e384c3a53",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "f46250f9-0e9b-4e25-9bee-b06e384c3a53",
|
|
|
|
|
"referenced_uuid": "c4796178-b6f0-433b-96a2-9b72e558e59a",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957908",
|
|
|
|
|
"uuid": "5ad5c094-c330-4067-bfd7-48a802de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957894",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c086-acfc-419e-88ac-47c402de0b81",
|
|
|
|
|
"value": "a0e97a3709647edd15c5343a3e881200"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957894",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c086-0b98-4249-8714-4b0302de0b81",
|
|
|
|
|
"value": "8f66efb93622c8352e15fae4292527984599c55e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957894",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c086-2b68-4ec7-b84a-4a8102de0b81",
|
|
|
|
|
"value": "5795c26debe0c06d1f1968730a84efeed69f0493b23f8411b3ea60781e7a24a7"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957895",
|
|
|
|
|
"uuid": "c4796178-b6f0-433b-96a2-9b72e558e59a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957895",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c087-9274-4fb1-b3d0-49eb02de0b81",
|
|
|
|
|
"value": "2018-02-13T19:19:28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957895",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c087-3814-490e-8392-457702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5795c26debe0c06d1f1968730a84efeed69f0493b23f8411b3ea60781e7a24a7/analysis/1518549568/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957896",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c088-3c04-4ee2-9708-495802de0b81",
|
|
|
|
|
"value": "44/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957899",
|
|
|
|
|
"uuid": "911c04f4-f1f2-44c4-8242-c69e588493f0",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "911c04f4-f1f2-44c4-8242-c69e588493f0",
|
|
|
|
|
"referenced_uuid": "d436e73b-9629-4c08-988b-73650cd12315",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957908",
|
|
|
|
|
"uuid": "5ad5c094-e9b8-4727-a81b-439f02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957896",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c088-2aec-40f4-86dd-454102de0b81",
|
|
|
|
|
"value": "06d1487a0d9a2f8ca4120aeff4ef93fa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957896",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c088-4dbc-4c31-8f6f-43e602de0b81",
|
|
|
|
|
"value": "2fb0fe6a72310fcd505ade5ee3a3c362f0c758b0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957896",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c088-0be0-4d7d-8d3a-45a602de0b81",
|
|
|
|
|
"value": "0073f6d57c2e4ca1871dc1a5e270160e734b2d79bd9b7b55b82a8ddc53aaac0f"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957897",
|
|
|
|
|
"uuid": "d436e73b-9629-4c08-988b-73650cd12315",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957897",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c089-24a8-42f6-94d0-492002de0b81",
|
|
|
|
|
"value": "2018-02-13T21:17:14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957897",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c089-4654-407b-babc-43c202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0073f6d57c2e4ca1871dc1a5e270160e734b2d79bd9b7b55b82a8ddc53aaac0f/analysis/1518556634/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957898",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c08a-d820-499b-a0da-488e02de0b81",
|
|
|
|
|
"value": "47/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957901",
|
|
|
|
|
"uuid": "c878521d-9b6b-4046-a3d2-fc9798c3c8df",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "c878521d-9b6b-4046-a3d2-fc9798c3c8df",
|
|
|
|
|
"referenced_uuid": "03a28507-7341-429a-afef-14f0e4faeae6",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957908",
|
|
|
|
|
"uuid": "5ad5c094-2ecc-4e48-bedf-4ed902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957898",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c08a-12b8-451e-b8e8-480a02de0b81",
|
|
|
|
|
"value": "88c5c5d977ed5d0f5007d66c9fb4bc80"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957898",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c08a-161c-46f0-9ddb-444a02de0b81",
|
|
|
|
|
"value": "a79c5a2ebde210b39968f035e90aca3ceff5e728"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957899",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c08b-cf4c-419d-b17a-492502de0b81",
|
|
|
|
|
"value": "3784e5b40ff8687265efe5dacfd5b6c9d744fe294f425703ddafbf687192eb8e"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957899",
|
|
|
|
|
"uuid": "03a28507-7341-429a-afef-14f0e4faeae6",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957899",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c08b-afa0-412d-be09-49eb02de0b81",
|
|
|
|
|
"value": "2013-11-08T21:56:31"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957899",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c08b-5980-44bf-bd61-47ab02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3784e5b40ff8687265efe5dacfd5b6c9d744fe294f425703ddafbf687192eb8e/analysis/1383947791/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957900",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c08c-62c4-4015-a50d-434502de0b81",
|
|
|
|
|
"value": "36/47"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957903",
|
|
|
|
|
"uuid": "ac554dac-0487-4973-be4d-4d2efbcfc1b9",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "ac554dac-0487-4973-be4d-4d2efbcfc1b9",
|
|
|
|
|
"referenced_uuid": "49e363d6-17fc-41dc-b434-a102e236ceba",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957908",
|
|
|
|
|
"uuid": "5ad5c094-5614-424d-a89d-457f02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957900",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c08c-dc94-4ae2-9887-4f3602de0b81",
|
|
|
|
|
"value": "781ae76246f0877046045aca91083de1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957900",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c08c-1a64-4707-a860-4eb402de0b81",
|
|
|
|
|
"value": "69349f7d58ef25c33857a7a27162774b93d14aaa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957901",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c08d-4a10-4044-bbc7-496002de0b81",
|
|
|
|
|
"value": "96847279dd3564a5d689bf310483fe351fac55e54a440d15e55f0bb7d35baab6"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957901",
|
|
|
|
|
"uuid": "49e363d6-17fc-41dc-b434-a102e236ceba",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957901",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c08d-af7c-4867-80d7-489902de0b81",
|
|
|
|
|
"value": "2018-04-10T06:49:31"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957901",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c08d-a090-4986-b12c-4e7502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/96847279dd3564a5d689bf310483fe351fac55e54a440d15e55f0bb7d35baab6/analysis/1523342971/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957902",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c08e-6c1c-40fa-9bad-464002de0b81",
|
|
|
|
|
"value": "29/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1523957905",
|
|
|
|
|
"uuid": "7606e8b5-261a-40ea-99e1-383c9a1c85f7",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "7606e8b5-261a-40ea-99e1-383c9a1c85f7",
|
|
|
|
|
"referenced_uuid": "a0ebe82c-5513-4e78-9d9c-2b1ee9be03c0",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1523957908",
|
|
|
|
|
"uuid": "5ad5c094-36d0-4be7-99c9-42e802de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1523957902",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad5c08e-974c-4a8b-8b69-409902de0b81",
|
|
|
|
|
"value": "644cc5ba8fd3ed19e266a7542d7ff99e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1523957902",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad5c08e-c34c-4cd8-b398-41aa02de0b81",
|
|
|
|
|
"value": "f9c780e91fccb4b657eab0240f18e09b94b460e0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1523957903",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad5c08f-7630-418a-934f-480902de0b81",
|
|
|
|
|
"value": "3d756dcf4397cb6b0d406b9f70eb18029965fce0110c0290af6ad73468aa2c1f"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1523957903",
|
|
|
|
|
"uuid": "a0ebe82c-5513-4e78-9d9c-2b1ee9be03c0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1523957903",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad5c08f-66fc-4b5f-ad6f-43d202de0b81",
|
|
|
|
|
"value": "2018-04-15T07:22:28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1523957904",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad5c090-5be8-49d0-bcff-4d0202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3d756dcf4397cb6b0d406b9f70eb18029965fce0110c0290af6ad73468aa2c1f/analysis/1523776948/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1523957904",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5c090-d8ac-4d3d-b12f-45ac02de0b81",
|
|
|
|
|
"value": "44/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": " Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523963662",
|
|
|
|
|
"uuid": "5ad5d64c-0d2c-486c-99c7-a0bb950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523963662",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5d64c-76dc-4ecf-9967-a0bb950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523963662",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d64d-cef4-4715-8505-a0bb950d210f",
|
|
|
|
|
"value": "kdivknmyqwz"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523963662",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d64d-d1c0-47f4-a9ad-a0bb950d210f",
|
|
|
|
|
"value": "HKCU"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523963662",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d64d-46d0-4a4c-857d-a0bb950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": " Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523963520",
|
|
|
|
|
"uuid": "5ad5d680-5248-4175-bd12-d066950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523963520",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5d680-5b58-45b3-a64f-d066950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523963521",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d681-96c8-489d-b2a7-d066950d210f",
|
|
|
|
|
"value": "ProxyServer"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523963521",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d681-67a8-45c8-8593-d066950d210f",
|
|
|
|
|
"value": "HKCU"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523963521",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d681-d04c-42f7-956c-d066950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": " Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523963774",
|
|
|
|
|
"uuid": "5ad5d764-6f6c-4d61-aed1-48bc950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523963774",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5d765-c4b0-4771-b1ed-4f86950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523963774",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d765-002c-4b94-986e-4294950d210f",
|
|
|
|
|
"value": "AutoDetect"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523963774",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d765-01d4-4713-9923-42a2950d210f",
|
|
|
|
|
"value": "HKCU"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523963774",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d765-c9ac-4881-899d-443f950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": " Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523963870",
|
|
|
|
|
"uuid": "5ad5d7de-2ab4-472e-9bba-2440950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523963870",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5d7de-9f5c-4772-b781-2440950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523963871",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d7df-a264-41ee-9732-2440950d210f",
|
|
|
|
|
"value": "ProxyOverride"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523963871",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d7df-c0d0-4876-b89d-2440950d210f",
|
|
|
|
|
"value": "HKCU"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523963871",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d7df-74cc-4b81-ac5b-2440950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": " Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523963948",
|
|
|
|
|
"uuid": "5ad5d82c-72a8-406a-a4cb-a0bd950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523963948",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5d82c-5f5c-4cc3-a47e-a0bd950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523963949",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d82d-9484-42e4-93e3-a0bd950d210f",
|
|
|
|
|
"value": "ProxyEnable"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523963949",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d82d-fca0-42ff-b243-a0bd950d210f",
|
|
|
|
|
"value": "HKCU"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523963949",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d82d-a59c-468f-9978-a0bd950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": " Win.Dropper.Generickdz-6500702-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523963989",
|
|
|
|
|
"uuid": "5ad5d855-b3e0-450a-bfbd-d095950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523963989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5d855-318c-4e89-ac15-d095950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523963990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d856-ecc4-41e0-a4aa-d095950d210f",
|
|
|
|
|
"value": "AutoConfigURL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523963990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d856-2258-4282-b977-d095950d210f",
|
|
|
|
|
"value": "HKCU"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523963990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5d856-e30c-4204-b2e1-d095950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Generic-6502500-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523965844",
|
|
|
|
|
"uuid": "5ad5df94-d030-4f98-bae7-44c8950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523965844",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5df94-4de8-4dce-a50b-4e9d950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523965844",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5df94-92b8-404f-a6b8-4f0f950d210f",
|
|
|
|
|
"value": "NZVHFTBPMBN"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523965845",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5df95-c78c-4ebd-b940-4123950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523965845",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5df95-0804-4151-b1ab-45b9950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523972661",
|
|
|
|
|
"uuid": "5ad5fa35-f650-49aa-81ab-4655950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523972661",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5fa35-5888-4da9-8cc7-452e950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\9B4DFF593EC4945503B76D97E83BADF6893F2597"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523972662",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fa36-2ad8-4a5d-8058-4038950d210f",
|
|
|
|
|
"value": "Blob"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523972662",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fa36-4a70-4a92-b976-40d9950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523972662",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fa36-a308-409a-af89-4fa2950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523972735",
|
|
|
|
|
"uuid": "5ad5fa7f-2914-45a7-98fc-45bd950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523972735",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5fa7f-3834-4989-ad60-4f0c950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV\\INSTANCES"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523972736",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fa80-bc0c-4e0a-8f95-48ff950d210f",
|
|
|
|
|
"value": "DefaultInstance"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523972737",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fa81-6928-4090-9f84-4797950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523972737",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fa81-cec0-41d6-a630-42e0950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523972770",
|
|
|
|
|
"uuid": "5ad5faa2-477c-4823-9ba7-4e7c950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523972771",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5faa3-ead0-4c02-9040-41b1950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV\\INSTANCES\\MAGSV INSTANCE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523972771",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5faa3-91a8-49ff-9857-4dfc950d210f",
|
|
|
|
|
"value": "Altitude"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523972772",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5faa4-80ec-44d3-8c72-4062950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523972772",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5faa4-5100-45ca-9ae4-4d57950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523972820",
|
|
|
|
|
"uuid": "5ad5fad4-36a0-4a9d-b4ae-40b8950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523972820",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5fad4-5ec4-4bd4-bac5-46e0950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV\\INSTANCES\\MAGSV INSTANCE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523972821",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fad5-ad9c-4e05-ad03-426e950d210f",
|
|
|
|
|
"value": "Flags"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523972821",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fad5-10b8-4785-ae36-4751950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523972821",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fad5-7af4-45d2-924a-4425950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523973389",
|
|
|
|
|
"uuid": "5ad5fd0d-c14c-4e4f-8529-41a2950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523973389",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5fd0d-fba0-43f2-b24d-46d2950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV\\INSTANCES\\MAGSV INSTANCE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523973390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fd0e-0aa0-4a8c-bab2-41f7950d210f",
|
|
|
|
|
"value": "Flags"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523973390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fd0e-a344-4239-8f51-4590950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523973390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fd0e-6ba8-4818-84a7-4719950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523973420",
|
|
|
|
|
"uuid": "5ad5fd2c-951c-499f-9a2d-4650950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523973420",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5fd2c-0a98-4888-bb0b-48de950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\CONTROL\\NETWORK"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523973421",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fd2d-1674-49bd-b37b-45fe950d210f",
|
|
|
|
|
"value": "atimode"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523973421",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fd2d-aadc-41b3-9ed7-41b8950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523973421",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fd2d-5964-44a8-9460-46e5950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523973882",
|
|
|
|
|
"uuid": "5ad5fefa-8fac-478c-bef3-4f19950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523973882",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5fefa-b038-41ef-bcb1-4e48950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\CONTROL\\NETWORK"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523973883",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fefb-70b0-4d8a-8815-4c89950d210f",
|
|
|
|
|
"value": "shield_count"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523973883",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fefb-5e8c-4af2-bed2-455e950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523973883",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fefb-3ac0-4104-814b-4acc950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523974031",
|
|
|
|
|
"uuid": "5ad5ff8f-9db8-443b-9835-40b9950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523974031",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5ff8f-0a00-427d-8468-4d9c950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\CONTROL\\NETWORK"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523974031",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5ff8f-7064-4240-8ef3-4452950d210f",
|
|
|
|
|
"value": "set_pt"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523974032",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5ff90-e5b0-4f83-8a7d-4a12950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523974032",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5ff90-0f40-450f-803c-47c4950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523974068",
|
|
|
|
|
"uuid": "5ad5ffb4-6e7c-4470-9b29-4c86950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523974068",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5ffb4-e5bc-4117-b66a-4248950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\CONTROL\\NETWORK"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523974069",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5ffb5-b8d0-4629-8043-4887950d210f",
|
|
|
|
|
"value": "set_pt"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523974069",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5ffb5-37f8-46fc-bf86-4a09950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523974069",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5ffb5-c698-492d-abb6-4ac8950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523974130",
|
|
|
|
|
"uuid": "5ad5fff2-a58c-40ca-9898-41a7950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523974130",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad5fff2-564c-46cc-a87b-4694950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\CONTROL\\NETWORK"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523974131",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fff3-6974-46a2-b8dc-4a13950d210f",
|
|
|
|
|
"value": "set_bl"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523974131",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fff3-a5bc-4162-8830-481f950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523974131",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad5fff3-0a78-4a42-95cf-4216950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523974168",
|
|
|
|
|
"uuid": "5ad60018-0020-4e76-bbc1-4034950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523974169",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad60019-3c50-46c0-9a42-4b1d950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523974169",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad60019-e4b8-4e58-b725-409c950d210f",
|
|
|
|
|
"value": "9B4DFF593EC4945503B76D97E83BADF6893F2597"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523974170",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6001a-9340-48a1-9968-4742950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523974170",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6001a-6c00-4988-92fd-43ab950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523974597",
|
|
|
|
|
"uuid": "5ad601c5-1420-47fd-918b-42c2950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523974598",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad601c6-cccc-459b-929f-4d74950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523974598",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad601c6-28fc-4300-9e62-421d950d210f",
|
|
|
|
|
"value": "9B4DFF593EC4945503B76D97E83BADF6893F2597"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523974598",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad601c6-5518-492a-ab3e-4b55950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523974598",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad601c6-dd8c-4954-bf98-46f4950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523974679",
|
|
|
|
|
"uuid": "5ad60217-e4bc-4470-b1e6-43fd950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523974679",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad60217-f0a0-40a3-a186-4f1c950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP6\\PARAMETERS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523974680",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad60218-7eec-4c62-95c9-4f4f950d210f",
|
|
|
|
|
"value": "DisabledComponents"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523974680",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad60218-700c-4700-9a36-43fa950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523974680",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad60218-1774-4f6a-aace-498f950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523974705",
|
|
|
|
|
"uuid": "5ad60231-3f60-4002-88a6-8ee9950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523974705",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad60231-70e4-4e5a-b2b1-8ee9950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523974705",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad60231-71b8-4792-ac49-8ee9950d210f",
|
|
|
|
|
"value": "ImagePath"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523974706",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad60232-4b64-49b5-9d44-8ee9950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523974706",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad60232-903c-4dd5-8f54-8ee9950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523974878",
|
|
|
|
|
"uuid": "5ad602de-93f8-4977-bd92-4336950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523974878",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad602de-8848-4515-ab6b-497f950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523974879",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad602df-644c-4101-a99d-4bab950d210f",
|
|
|
|
|
"value": "DisplayName"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523974879",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad602df-f0f0-490c-a640-48ac950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523974879",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad602df-0670-4c5b-8fa3-4d8f950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523974925",
|
|
|
|
|
"uuid": "5ad6030d-01fc-4395-b374-4e42950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523974925",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad6030d-37fc-43a7-9ad0-4068950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\NETWORK\\FILESERVICE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523974926",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6030e-ca44-4d19-a460-45f1950d210f",
|
|
|
|
|
"value": "Liveup"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523974926",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6030e-72b0-4071-8f2e-4095950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523974926",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6030e-7ce8-4477-a1f0-48c6950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523974969",
|
|
|
|
|
"uuid": "5ad60339-e7a8-4868-affe-4f0a950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523974969",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad60339-6248-440b-b3f2-41ee950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\NETWORK\\FILESERVICE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523974970",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6033a-19f0-4a83-9f04-45f1950d210f",
|
|
|
|
|
"value": "igfxmtc_time"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523974970",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6033a-2030-459b-a72e-42c9950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523974970",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6033a-9368-4644-9ac9-4060950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523975313",
|
|
|
|
|
"uuid": "5ad60491-c5b0-4344-9c7b-4ebf950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523975313",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad60491-7b90-4e0f-b587-4276950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523975314",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad60492-4a88-480e-8ef7-40ef950d210f",
|
|
|
|
|
"value": "DisableTaskOffload"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523975314",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad60492-c2fc-4311-877e-4c7b950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523975314",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad60492-0180-4f3a-b294-49af950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523975375",
|
|
|
|
|
"uuid": "5ad604cf-5324-47a7-b121-4717950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523975375",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad604cf-9610-4e05-bb3c-41d7950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523975376",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad604d0-2ec4-4c49-a05f-481a950d210f",
|
|
|
|
|
"value": "DisplayName"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523975376",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad604d0-c914-4532-8fcb-4a07950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523975376",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad604d0-f2e0-4df8-94f8-481e950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523975416",
|
|
|
|
|
"uuid": "5ad604f8-dd50-4b52-9771-4024950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523975416",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad604f8-a428-4a0d-a7e6-4326950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523975417",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad604f9-4508-4dc7-bd06-4067950d210f",
|
|
|
|
|
"value": "St"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523975417",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad604f9-77a8-4700-a93c-4cf7950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523975417",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad604f9-e2c0-49d8-91ee-4d82950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523975437",
|
|
|
|
|
"uuid": "5ad6050d-ee58-4332-b5df-4b28950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523975438",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad6050e-9c14-45b7-a776-45b4950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523975438",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6050e-4420-42bc-b7c6-40cc950d210f",
|
|
|
|
|
"value": "St"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523975438",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6050e-ec1c-4af1-833f-4868950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523975438",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6050e-f00c-4b25-8b3c-4ad3950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523975465",
|
|
|
|
|
"uuid": "5ad60529-26b8-4106-a709-41da950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523975465",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad60529-39b0-4038-8975-4d54950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523975465",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad60529-ebb4-4195-a9ef-4b44950d210f",
|
|
|
|
|
"value": "Start"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523975466",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6052a-321c-4998-9c88-4091950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523975466",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6052a-b964-4234-bf84-43c5950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523975529",
|
|
|
|
|
"uuid": "5ad60569-4b3c-4e88-b761-42c4950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523975529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad60569-cdd8-42fb-baf2-44b2950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523975530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6056a-8744-42b7-81e4-4c06950d210f",
|
|
|
|
|
"value": "ErrorControl"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523975530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6056a-a318-4ff6-86b8-46be950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523975530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6056a-79ec-481b-bc8f-486c950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523975564",
|
|
|
|
|
"uuid": "5ad6058c-5b7c-4b6e-9ba7-4cdb950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523975565",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad6058d-83c4-498d-92c7-4780950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523975565",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6058d-d02c-4d5e-9342-4e19950d210f",
|
|
|
|
|
"value": "WOW64"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523975565",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6058d-5ba4-4c0c-ae33-4fed950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523975566",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6058e-9f08-49de-9935-4637950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523975593",
|
|
|
|
|
"uuid": "5ad605a9-8c94-486a-bf56-4b33950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523975594",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad605aa-82e4-4629-bb18-433f950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523975594",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad605aa-54e8-455a-9fbc-402d950d210f",
|
|
|
|
|
"value": "Group"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523975594",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad605aa-a664-47de-a8dd-4422950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523975594",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad605aa-97ac-40d7-a3b9-400a950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1523975620",
|
|
|
|
|
"uuid": "5ad605c4-f4c4-4066-8c84-41a1950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1523975620",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad605c4-17f8-4780-bb94-4084950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\CONTROLSET001\\SERVICES\\MAGSV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1523975621",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad605c5-92d4-431a-9b98-4b28950d210f",
|
|
|
|
|
"value": "Type"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1523975621",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad605c5-3c10-4951-994b-4192950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1523975621",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad605c5-07d8-4d7e-ad36-49ee950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524037700",
|
|
|
|
|
"uuid": "5ad6f828-d124-4a8a-b98c-486c950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524037700",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad6f828-6ad0-433e-841f-404a950d210f",
|
|
|
|
|
"value": "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524037700",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f829-ddf4-4727-bb9b-49f7950d210f",
|
|
|
|
|
"value": "HKU"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524037700",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f829-38a0-4df7-8a8a-426d950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524037818",
|
|
|
|
|
"uuid": "5ad6f8ba-c420-4555-b293-4d40950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524037818",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad6f8ba-eb54-4258-8395-43f3950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\Microsoft\\Tracing\\FWCFG"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524037819",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f8bb-0d64-4ec9-859c-44ee950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524037819",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f8bb-dbc4-4f02-8e50-4ef5950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524037914",
|
|
|
|
|
"uuid": "5ad6f91a-2de4-4254-9d2c-4a3e950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524037914",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad6f91a-c4d8-4fa7-9917-4949950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Tracing\\Microsoft\\qagent\\traceIdentifier"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524037914",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f91a-d5a4-457c-ad67-462c950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524037914",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f91a-5bec-4a9b-a42f-41ca950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524038075",
|
|
|
|
|
"uuid": "5ad6f9bb-17b8-45f7-95c1-4b2d950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524038075",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad6f9bb-c480-41ab-a176-402a950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Tracing\\Microsoft\\NAP\\Netsh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524038075",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f9bb-58a8-4749-ab18-45a2950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524038075",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f9bc-786c-4b2a-b36d-4f84950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524038116",
|
|
|
|
|
"uuid": "5ad6f9e4-6c78-41af-a9b3-4281950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524038116",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad6f9e4-756c-4824-b094-4e2d950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\host2lc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524038117",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f9e5-1304-45d0-9aab-4c57950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524038117",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f9e5-a46c-49eb-96be-4741950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524038140",
|
|
|
|
|
"uuid": "5ad6f9fc-db4c-4b83-bf35-4316950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524038141",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad6f9fd-472c-4def-b00d-435a950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Tracing\\Microsoft\\qagent"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524038141",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f9fd-b934-433e-97df-40c5950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524038141",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6f9fd-e48c-4bc6-9057-4c5e950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524038169",
|
|
|
|
|
"uuid": "5ad6fa19-558c-4a98-acec-4b42950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524038169",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad6fa19-4200-4044-b038-4467950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Tracing\\Microsoft\\NAP\\Netsh\\Napmontr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524038169",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6fa19-d80c-4268-8bc2-4830950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524038169",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad6fa19-4e9c-4bfc-841f-4f35950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524044172",
|
|
|
|
|
"uuid": "5ad7118c-1138-4b45-8e7d-459f950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524044172",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad7118c-9218-45b1-a0fb-4999950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SCHEDULE\\HANDSHAKE\\{E5EC135A-79D5-4595-A051-FFFB0E1F7FB4}"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1524044173",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad7118d-4b40-4d82-9785-41b6950d210f",
|
|
|
|
|
"value": "data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524044173",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad7118d-e9c0-4b8e-adf5-44c8950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524044173",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad7118d-6254-449f-9391-4da5950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524044253",
|
|
|
|
|
"uuid": "5ad711dd-2f60-48cb-8064-47a1950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524044253",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad711dd-8e04-49b9-a437-4176950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SCHEDULE\\COMPATIBILITYADAPTER\\SIGNATURES"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1524044254",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad711de-563c-4bc8-89c6-4fff950d210f",
|
|
|
|
|
"value": "aybbmte.job.fp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524044254",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad711de-b72c-4e1b-bdb2-48ab950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524044254",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad711de-3404-4c60-a6cc-42cd950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524044826",
|
|
|
|
|
"uuid": "5ad7141a-7b48-45e6-b995-4900950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524044826",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad7141a-df08-453a-ae82-41c6950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SCHEDULE\\COMPATIBILITYADAPTER\\SIGNATURES"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1524044827",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad7141b-e8a0-4d9e-928e-43e5950d210f",
|
|
|
|
|
"value": "aybbmte.job"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524044827",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad7141b-c058-41ae-9408-4927950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524044827",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad7141b-2f90-4436-9bdf-40ea950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524045572",
|
|
|
|
|
"uuid": "5ad71704-9bf0-4378-bb92-4080950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524045572",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad71704-2674-40ac-bb39-4c18950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SCHEDULE\\TASKCACHE\\TREE\\AYBBMTE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1524045573",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad71705-c08c-4a9b-acd7-4e03950d210f",
|
|
|
|
|
"value": "Index"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524045573",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad71705-5ae4-4fe9-82dd-4dae950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524045573",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad71705-68d4-4b76-b8c0-4bc9950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524045603",
|
|
|
|
|
"uuid": "5ad71723-79f0-4756-a2b4-476f950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524045603",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad71723-cbdc-42f5-8110-4838950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SCHEDULE\\TASKCACHE\\TREE\\AYBBMTE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1524045603",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad71723-f474-4669-b155-4130950d210f",
|
|
|
|
|
"value": "Id"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524045604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad71724-fe28-45d1-9a85-4160950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524045604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad71724-7d7c-4b85-933e-45e3950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524045664",
|
|
|
|
|
"uuid": "5ad71760-a4ac-4bbf-be00-4450950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524045664",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad71760-30b4-4021-926a-47fc950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SCHEDULE\\TASKCACHE\\TASKS\\{DAC4F53E-3658-4522-B6D9-1FB306F3D9D1}"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1524045665",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad71761-24c8-4410-b238-45f2950d210f",
|
|
|
|
|
"value": "DynamicInfo"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524045665",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad71761-61e4-4499-8eea-4d8c950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524045665",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad71761-30e8-4f53-9464-4294950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524045711",
|
|
|
|
|
"uuid": "5ad7178f-2830-42b7-b039-4712950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524045711",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad7178f-bf04-4040-9ccc-4654950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SCHEDULE\\TASKCACHE\\TASKS\\{DAC4F53E-3658-4522-B6D9-1FB306F3D9D1}"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1524045711",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad7178f-e2f4-41a1-a5f8-4a78950d210f",
|
|
|
|
|
"value": "Path"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524045712",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad71790-4994-4e22-8c58-4d28950d210f",
|
|
|
|
|
"value": "HKCC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524045712",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad71790-2bc8-4270-a95e-4221950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524045735",
|
|
|
|
|
"uuid": "5ad717a7-fb54-41c9-b567-47a0950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524045735",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad717a7-7154-4053-9b2c-4614950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SCHEDULE\\TASKCACHE\\TASKS\\{DAC4F53E-3658-4522-B6D9-1FB306F3D9D1}"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1524045736",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad717a8-17dc-442b-bd1e-4d0e950d210f",
|
|
|
|
|
"value": "Hash"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524045736",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad717a8-62d0-4cd4-83b0-43e0950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524045736",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad717a8-5e04-41e1-9288-40f4950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524053731",
|
|
|
|
|
"uuid": "5ad736e3-c084-4e9a-b288-7b76950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524053731",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad736e3-1ec8-44fd-9e66-7b76950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SCHEDULE\\TASKCACHE\\TASKS\\{DAC4F53E-3658-4522-B6D9-1FB306F3D9D1}"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "data",
|
|
|
|
|
"timestamp": "1524053732",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad736e4-c7b0-46c7-8982-7b76950d210f",
|
|
|
|
|
"value": "Triggers"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524053732",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad736e4-dee4-4b34-8b32-7b76950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524053732",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad736e4-14ec-4d75-a745-7b76950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Dropper.Shipup-6503419-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524053794",
|
|
|
|
|
"uuid": "5ad73722-7364-4e67-9abd-20c4950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524053794",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad73722-7b04-47e9-a9dc-20c4950d210f",
|
|
|
|
|
"value": "\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\SCHEDULE\\HANDSHAKE\\{E5EC135A-79D5-4595-A051-FFFB0E1F7FB4}"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524053795",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad73723-5580-44ac-8888-20c4950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524053795",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad73723-d83c-43bc-a2e1-20c4950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524055759",
|
|
|
|
|
"uuid": "5ad73ecf-f4a4-48dd-bc42-7ba2950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524055759",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad73ecf-1a78-462b-8708-7ba2950d210f",
|
|
|
|
|
"value": "\\SYSTEM\\ControlSet001\\Services\\xkqrdots"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524055759",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad73ecf-3678-4022-ba27-7ba2950d210f",
|
|
|
|
|
"value": "HKLM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524055759",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad73ecf-33dc-44a0-a942-7ba2950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Win.Packed.Tofsee-6504793-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Registry key object describing a Windows registry key with value and last-modified timestamp",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "registry-key",
|
|
|
|
|
"template_uuid": "8b3228ad-6d82-4fe6-b2ae-05426308f1d5",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1524055797",
|
|
|
|
|
"uuid": "5ad73ef5-ea08-492d-9124-219b950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "key",
|
|
|
|
|
"timestamp": "1524055797",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "regkey",
|
|
|
|
|
"uuid": "5ad73ef5-14b8-4b7b-ae39-219b950d210f",
|
|
|
|
|
"value": "\\Control Panel\\Buses"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "root-keys",
|
|
|
|
|
"timestamp": "1524055798",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad73ef6-1f8c-4819-bdf1-219b950d210f",
|
|
|
|
|
"value": "HKU"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Persistence mechanism",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "data-type",
|
|
|
|
|
"timestamp": "1524055798",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad73ef6-a4c4-4e78-9b2e-219b950d210f",
|
|
|
|
|
"value": "REG_NONE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215285",
|
|
|
|
|
"uuid": "3e803fec-57d0-4a64-bffa-8c406bfa4df8",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "3e803fec-57d0-4a64-bffa-8c406bfa4df8",
|
|
|
|
|
"referenced_uuid": "1d03fb64-13be-4f35-87e1-ad4700b35b8c",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215461",
|
|
|
|
|
"uuid": "5ad9aea5-5ff0-4cbb-bb6b-44ac02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9adf2-df14-4dd6-b1ba-444f02de0b81",
|
|
|
|
|
"value": "7de3b44801868f8da4e983f9818f1e0b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9adf2-c85c-4931-a66c-48cc02de0b81",
|
|
|
|
|
"value": "48f0481cbf046c32f240376aaf5d5dd5d4d90e13"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215283",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9adf3-7254-4311-80fa-480b02de0b81",
|
|
|
|
|
"value": "e981fd64b4c1f1d50cdf3f21d3cd07dfb04dec58c518bee8697a187069997498"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215283",
|
|
|
|
|
"uuid": "1d03fb64-13be-4f35-87e1-ad4700b35b8c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9adf3-f334-4561-9f0a-468a02de0b81",
|
|
|
|
|
"value": "2017-10-24T01:51:21"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9adf3-74b0-471d-95d5-4a7b02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e981fd64b4c1f1d50cdf3f21d3cd07dfb04dec58c518bee8697a187069997498/analysis/1508809881/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215284",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9adf4-3420-46f9-8c26-444102de0b81",
|
|
|
|
|
"value": "54/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215287",
|
|
|
|
|
"uuid": "1d4884a7-3654-4522-9024-5916811aa592",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "1d4884a7-3654-4522-9024-5916811aa592",
|
|
|
|
|
"referenced_uuid": "b4b37264-5f7b-43ed-9857-782b9d942a9d",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215461",
|
|
|
|
|
"uuid": "5ad9aea5-bae8-48d9-bf9f-45d402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215284",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9adf4-5034-4f7f-9187-47b202de0b81",
|
|
|
|
|
"value": "0e42f545f20a7066e80b1cb0ee73c00a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215284",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9adf4-f930-40fc-8262-4d8602de0b81",
|
|
|
|
|
"value": "880afff080d249f26514e4d26a8211d43f7ca1fe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215285",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9adf5-7038-40d8-82bb-451102de0b81",
|
|
|
|
|
"value": "1ca88b2c00b625bf596b93abafae873a6aec5bf1afeee1e116dc402cae69f83a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215285",
|
|
|
|
|
"uuid": "b4b37264-5f7b-43ed-9857-782b9d942a9d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215285",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9adf5-1ee0-4033-a947-466402de0b81",
|
|
|
|
|
"value": "2017-10-25T01:46:22"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215286",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9adf6-3c4c-48f6-a875-4a4e02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/1ca88b2c00b625bf596b93abafae873a6aec5bf1afeee1e116dc402cae69f83a/analysis/1508895982/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215286",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9adf6-7d1c-4aa2-9e17-47ea02de0b81",
|
|
|
|
|
"value": "52/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215289",
|
|
|
|
|
"uuid": "b5665818-45ad-4e55-872a-d64f9564f57c",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "b5665818-45ad-4e55-872a-d64f9564f57c",
|
|
|
|
|
"referenced_uuid": "e2c5a4be-2cfe-4eed-8a62-52f5a8918745",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-87ac-43f0-a042-4aac02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215286",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9adf6-dc70-4ad7-9c1f-462b02de0b81",
|
|
|
|
|
"value": "053e2d245b3192f430ee06c33865f531"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215287",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9adf7-5f4c-46e3-8fbb-401102de0b81",
|
|
|
|
|
"value": "120718cc4ca8df9dd7b11108e632bb7b0981f2ce"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215287",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9adf7-be60-4064-a457-4bd202de0b81",
|
|
|
|
|
"value": "174286f1a0bd66552237da989be39ef821b11fc6acccef5eabc00448991d1876"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215287",
|
|
|
|
|
"uuid": "e2c5a4be-2cfe-4eed-8a62-52f5a8918745",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215288",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9adf8-b854-462a-bb6a-464f02de0b81",
|
|
|
|
|
"value": "2017-10-31T09:17:46"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215288",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9adf8-5e7c-4bc2-b802-4a5602de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/174286f1a0bd66552237da989be39ef821b11fc6acccef5eabc00448991d1876/analysis/1509441466/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215288",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9adf8-7490-4581-9e8d-472d02de0b81",
|
|
|
|
|
"value": "42/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215291",
|
|
|
|
|
"uuid": "ce15aa39-ec50-4981-8929-3019908b5ceb",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "ce15aa39-ec50-4981-8929-3019908b5ceb",
|
|
|
|
|
"referenced_uuid": "00da20c8-dd00-4c56-bfb0-46add8af6839",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-023c-49e9-a085-403702de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215288",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9adf8-69a4-42ae-bc34-4b5902de0b81",
|
|
|
|
|
"value": "ee9803dab96dba5f4acc1323d9dfc2c3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215289",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9adf9-62a8-4c04-8c27-411802de0b81",
|
|
|
|
|
"value": "b4d3075cf211fca5556a5ceb4e59672052860a43"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215289",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9adf9-d3a4-4621-9b6f-406a02de0b81",
|
|
|
|
|
"value": "85d0021f75a2d312a27bc1c17702d09520006aff590d439a90d8045d2325a04e"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215290",
|
|
|
|
|
"uuid": "00da20c8-dd00-4c56-bfb0-46add8af6839",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215290",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9adfa-126c-4d15-9e77-469902de0b81",
|
|
|
|
|
"value": "2017-12-25T00:10:35"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215290",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9adfa-5e68-4ff7-859b-4eb902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/85d0021f75a2d312a27bc1c17702d09520006aff590d439a90d8045d2325a04e/analysis/1514160635/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215291",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9adfb-4c28-42b5-b992-4cd002de0b81",
|
|
|
|
|
"value": "56/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215294",
|
|
|
|
|
"uuid": "1c88e6ef-671c-48e1-a0d0-9932be1a8cc5",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "1c88e6ef-671c-48e1-a0d0-9932be1a8cc5",
|
|
|
|
|
"referenced_uuid": "452c6b20-11a0-41ca-bc89-a8e7de5f2779",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-a7b4-45fb-b54d-4c8302de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215291",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9adfb-8c58-49b6-94e4-43e702de0b81",
|
|
|
|
|
"value": "01cb31d2516e8a3e4d4340dd698809ad"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215291",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9adfb-e844-42f4-899e-466f02de0b81",
|
|
|
|
|
"value": "db2c7e74092e6a4499fb8bfe53985850f2121c0b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215292",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9adfc-0258-46b9-a9c1-4dea02de0b81",
|
|
|
|
|
"value": "41bf7b4e4d7a87395cc8867e026ed9d586830420a70325a672d07ea9c1a351e0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215292",
|
|
|
|
|
"uuid": "452c6b20-11a0-41ca-bc89-a8e7de5f2779",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215292",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9adfc-fe08-4477-a286-40e902de0b81",
|
|
|
|
|
"value": "2018-02-18T22:32:22"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215292",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9adfc-7b98-45ee-b7b7-472502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/41bf7b4e4d7a87395cc8867e026ed9d586830420a70325a672d07ea9c1a351e0/analysis/1518993142/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215293",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9adfd-1cbc-4301-a0fd-47c502de0b81",
|
|
|
|
|
"value": "18/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215296",
|
|
|
|
|
"uuid": "f128ac41-042d-495c-939c-11d3d83d1b19",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "f128ac41-042d-495c-939c-11d3d83d1b19",
|
|
|
|
|
"referenced_uuid": "05cc5c9e-5cf4-406f-8a8e-c7653cb7dcb5",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-e288-4e13-81e5-494902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215293",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9adfd-989c-4331-8d2e-4e0802de0b81",
|
|
|
|
|
"value": "8d0fb621ee78ad8e35aa4965cbf4e475"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215293",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9adfd-4aa4-4fa3-9a61-4e9302de0b81",
|
|
|
|
|
"value": "9b3389de25b4f5248760ad9c520d4e52db0c0b9e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215294",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9adfe-6ec8-4864-9de7-443902de0b81",
|
|
|
|
|
"value": "ba0a2f6e001bc9c02ee8c5fbcd6cceaa74ced5ec058dfda71623146f06ff2490"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215294",
|
|
|
|
|
"uuid": "05cc5c9e-5cf4-406f-8a8e-c7653cb7dcb5",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215294",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9adfe-8ad8-4d9d-81ec-45fc02de0b81",
|
|
|
|
|
"value": "2017-10-26T13:23:04"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215295",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9adff-a1d4-453c-a066-492d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/ba0a2f6e001bc9c02ee8c5fbcd6cceaa74ced5ec058dfda71623146f06ff2490/analysis/1509024184/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215295",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9adff-7ff8-49cf-86bb-46b702de0b81",
|
|
|
|
|
"value": "55/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215298",
|
|
|
|
|
"uuid": "e0f188cf-3ab6-4014-9327-4c09757acf99",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "e0f188cf-3ab6-4014-9327-4c09757acf99",
|
|
|
|
|
"referenced_uuid": "08068585-edc1-40fa-a64d-5080ad1e0311",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-3d24-4be4-ac8d-416302de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215295",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9adff-cd68-423d-bfa5-43ca02de0b81",
|
|
|
|
|
"value": "0a2f5b366536bf0d7c2d9bcf04ba0281"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215296",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae00-b678-4c28-ac74-4e9f02de0b81",
|
|
|
|
|
"value": "e7ca93029ce7c3e83cfbf2f5ee97e0e813092c29"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215296",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae00-69ac-4f5b-a8e6-4de402de0b81",
|
|
|
|
|
"value": "4696ddd4a7ed96a86a09413f14657c7e01053213f6f1f6008a3a3bbe4fe45229"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215296",
|
|
|
|
|
"uuid": "08068585-edc1-40fa-a64d-5080ad1e0311",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215296",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae00-f274-4da3-868e-47c502de0b81",
|
|
|
|
|
"value": "2018-02-22T01:57:24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215297",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae01-956c-403d-b41c-471802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4696ddd4a7ed96a86a09413f14657c7e01053213f6f1f6008a3a3bbe4fe45229/analysis/1519264644/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215297",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae01-c770-49a8-ae00-4f8602de0b81",
|
|
|
|
|
"value": "37/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215300",
|
|
|
|
|
"uuid": "efdd79ca-bfbd-425d-816a-1de5a615d4f8",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "efdd79ca-bfbd-425d-816a-1de5a615d4f8",
|
|
|
|
|
"referenced_uuid": "ee5376c5-6962-420f-aec1-e6ac03cf5ab3",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-89b0-4264-ac66-42c902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215297",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae01-c088-407e-8ad0-471c02de0b81",
|
|
|
|
|
"value": "969552b1ace8c8b73aa1e65a7b5cdaed"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215298",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae02-59dc-48db-a18d-436e02de0b81",
|
|
|
|
|
"value": "592b6d0d075e3f724cca9115a0f678984206e6a9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215298",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae02-6310-4eb8-b5c3-41db02de0b81",
|
|
|
|
|
"value": "877d9c4195c38a9dc55c472f7c72ec3d6ad0d95a544458a2050edf22df3aac5c"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215299",
|
|
|
|
|
"uuid": "ee5376c5-6962-420f-aec1-e6ac03cf5ab3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215299",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae03-c13c-4e90-ae0e-498f02de0b81",
|
|
|
|
|
"value": "2017-12-10T07:51:34"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215299",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae03-456c-49b4-9af0-4ba002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/877d9c4195c38a9dc55c472f7c72ec3d6ad0d95a544458a2050edf22df3aac5c/analysis/1512892294/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215299",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae03-1e80-4f54-9937-493d02de0b81",
|
|
|
|
|
"value": "31/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215302",
|
|
|
|
|
"uuid": "513cd9b4-6715-4444-81de-c6d9f0a86318",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "513cd9b4-6715-4444-81de-c6d9f0a86318",
|
|
|
|
|
"referenced_uuid": "f7d51df1-5efb-42cb-891d-24f914eb835f",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-07d8-4275-b753-468502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215300",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae04-c73c-417a-9a91-4a4602de0b81",
|
|
|
|
|
"value": "049be07740c4928fec7cee21a07cc414"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215300",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae04-fad4-4537-ac62-4aea02de0b81",
|
|
|
|
|
"value": "bd1c84b7fa1baefcede8e4be89b7cc73001ca3f2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215300",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae04-63f0-4ab7-9977-472302de0b81",
|
|
|
|
|
"value": "6b6eb4cc4aa8e3d71a97a8657ffcd27d2bd12466faf3b1f7fcbcd274a4b9561c"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215301",
|
|
|
|
|
"uuid": "f7d51df1-5efb-42cb-891d-24f914eb835f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215301",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae05-5334-407f-90e6-4f7b02de0b81",
|
|
|
|
|
"value": "2017-11-20T17:36:46"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215301",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae05-f330-47b6-a1a5-46de02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6b6eb4cc4aa8e3d71a97a8657ffcd27d2bd12466faf3b1f7fcbcd274a4b9561c/analysis/1511199406/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215302",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae06-2b38-409c-9b60-4f4802de0b81",
|
|
|
|
|
"value": "59/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215305",
|
|
|
|
|
"uuid": "8009eae4-08fe-4674-8c61-3d790fdeb86a",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "8009eae4-08fe-4674-8c61-3d790fdeb86a",
|
|
|
|
|
"referenced_uuid": "13ef15ad-c73c-4ae3-b7bb-4827d33f81f3",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-56bc-450a-8ef8-458d02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215302",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae06-7e7c-4d48-8be8-4f8702de0b81",
|
|
|
|
|
"value": "aa971830a71ac5ed72a41008e817d68e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215302",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae06-34ac-4482-a8a2-435402de0b81",
|
|
|
|
|
"value": "545674151c18be26a234873cabd26836a0304aab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215303",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae07-50c0-4174-99e2-479102de0b81",
|
|
|
|
|
"value": "a854a9702c14be3508d35873e80577ee9b1296c993ee2a4269c283884775564e"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215303",
|
|
|
|
|
"uuid": "13ef15ad-c73c-4ae3-b7bb-4827d33f81f3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215303",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae07-ab30-4947-8ef5-4a0d02de0b81",
|
|
|
|
|
"value": "2017-12-24T06:39:27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215304",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae08-3c50-4be5-899c-44d802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a854a9702c14be3508d35873e80577ee9b1296c993ee2a4269c283884775564e/analysis/1514097567/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215304",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae08-5524-4061-b587-44c002de0b81",
|
|
|
|
|
"value": "55/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215307",
|
|
|
|
|
"uuid": "f1f3104e-c6b4-4111-a006-5c69509c7f75",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "f1f3104e-c6b4-4111-a006-5c69509c7f75",
|
|
|
|
|
"referenced_uuid": "b7e219d4-82e9-40f3-9812-d833f1c4bf60",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-4a08-496d-a2e0-49aa02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215304",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae08-11b8-41a2-a496-49f102de0b81",
|
|
|
|
|
"value": "c106bebb5cc2b4e9787c6f81159ae21b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215304",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae08-9218-4758-96cd-4ca102de0b81",
|
|
|
|
|
"value": "dba4bbb120f9ef22c58d4570c86a89514ebfbc8a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215305",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae09-1540-42cb-8f7c-499b02de0b81",
|
|
|
|
|
"value": "683339b58c7cbc066f84c625efa0248eb89bfcd24de916f5fe600c33867084e7"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215305",
|
|
|
|
|
"uuid": "b7e219d4-82e9-40f3-9812-d833f1c4bf60",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215305",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae09-a990-4e1c-9324-44a602de0b81",
|
|
|
|
|
"value": "2017-12-10T13:16:52"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215306",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae0a-eec0-4d8b-bb6e-498b02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/683339b58c7cbc066f84c625efa0248eb89bfcd24de916f5fe600c33867084e7/analysis/1512911812/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215306",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae0a-e9b4-4877-8b86-43a002de0b81",
|
|
|
|
|
"value": "30/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215309",
|
|
|
|
|
"uuid": "73ac235c-e3db-4617-a968-47e2ea6f6b8b",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "73ac235c-e3db-4617-a968-47e2ea6f6b8b",
|
|
|
|
|
"referenced_uuid": "279cd6bd-aa55-47a5-af76-2826253108bc",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-6110-4105-966a-450c02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215306",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae0a-408c-42ea-b52a-423902de0b81",
|
|
|
|
|
"value": "d5d05a6827c5dfff19ae5726295afef7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215307",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae0b-0114-4a3f-b0ca-40aa02de0b81",
|
|
|
|
|
"value": "0763ddfca3fedcbadbf91f2946d6701e7425e7de"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215307",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae0b-7918-4777-94c8-4b4902de0b81",
|
|
|
|
|
"value": "1d7a1a4181706379a7f80ed926c47cb0ebc7beb953739c9b41cec20093c63914"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215307",
|
|
|
|
|
"uuid": "279cd6bd-aa55-47a5-af76-2826253108bc",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215308",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae0c-5634-4b92-a9d0-426b02de0b81",
|
|
|
|
|
"value": "2018-03-12T07:16:27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215308",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae0c-4534-4495-95c4-49c302de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/1d7a1a4181706379a7f80ed926c47cb0ebc7beb953739c9b41cec20093c63914/analysis/1520838987/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215308",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae0c-55fc-4eee-8e29-4a5b02de0b81",
|
|
|
|
|
"value": "55/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215311",
|
|
|
|
|
"uuid": "e2119423-0173-4009-b875-e913f911653d",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "e2119423-0173-4009-b875-e913f911653d",
|
|
|
|
|
"referenced_uuid": "47f144bd-561a-4e14-b508-d7313f28add9",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-0678-434f-8449-4a1302de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215308",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae0c-1d60-496f-96af-43f302de0b81",
|
|
|
|
|
"value": "f361c249ee3d8f4e5aa365e7dc8eb1cb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215309",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae0d-8228-428c-a0f8-4bbd02de0b81",
|
|
|
|
|
"value": "6f6eaee7ae811898f9e9bb30715ae3d8303c7687"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215309",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae0d-b444-4591-9744-429202de0b81",
|
|
|
|
|
"value": "b1d0bfdd95f168cea0df0e138ee627cb7feb0a26ac7a736baa031547bb6fb08d"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215310",
|
|
|
|
|
"uuid": "47f144bd-561a-4e14-b508-d7313f28add9",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215310",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae0e-e674-40c7-940e-431902de0b81",
|
|
|
|
|
"value": "2018-03-12T07:33:00"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215310",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae0e-f470-4517-ae95-43f102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b1d0bfdd95f168cea0df0e138ee627cb7feb0a26ac7a736baa031547bb6fb08d/analysis/1520839980/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215310",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae0e-194c-447d-a78f-4fac02de0b81",
|
|
|
|
|
"value": "54/65"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215313",
|
|
|
|
|
"uuid": "526cfc6f-1c12-422e-89ba-f6de05aab48f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "526cfc6f-1c12-422e-89ba-f6de05aab48f",
|
|
|
|
|
"referenced_uuid": "42544fa3-e8aa-4f6b-8869-2b12571c968f",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-bff4-48b7-a9b3-4d0f02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215311",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae0f-72b0-4115-b19b-4a4402de0b81",
|
|
|
|
|
"value": "6ed420bce873b34153f076776fe6b91d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215311",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae0f-281c-4cf0-9a00-431302de0b81",
|
|
|
|
|
"value": "43d1813f848e5d1fa639a8b09c964e33e95d8dee"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215311",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae0f-f8c4-45de-b9ea-42a902de0b81",
|
|
|
|
|
"value": "f68b0c32da95c0fb06c4cefb992e1a0039afed32f6cfcef083db39a0702a06c7"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215312",
|
|
|
|
|
"uuid": "42544fa3-e8aa-4f6b-8869-2b12571c968f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215312",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae10-23d8-4329-899e-4f4b02de0b81",
|
|
|
|
|
"value": "2017-10-26T12:15:21"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215312",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae10-aecc-4bf8-a63b-46ee02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f68b0c32da95c0fb06c4cefb992e1a0039afed32f6cfcef083db39a0702a06c7/analysis/1509020121/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215313",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae11-aa7c-442e-ac2f-4aa102de0b81",
|
|
|
|
|
"value": "53/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215316",
|
|
|
|
|
"uuid": "68952c57-5f30-4f16-b04a-6cadc596e4c6",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "68952c57-5f30-4f16-b04a-6cadc596e4c6",
|
|
|
|
|
"referenced_uuid": "0745ebfe-aea5-421a-8e0f-0c298339d924",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-8278-461c-9425-407602de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215313",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae11-43e4-48ec-b32f-469902de0b81",
|
|
|
|
|
"value": "d939dc2d8297c32805f7182f13c56891"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215313",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae11-0974-464f-a50e-44e702de0b81",
|
|
|
|
|
"value": "1c2c3f3d4efe36ab51263a502a4670c444041121"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215313",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae12-cb6c-428e-9688-48c702de0b81",
|
|
|
|
|
"value": "1a1144444adb05aee9ef8adfb3c892a97d32b870d1ee300975a5f3597f2ed638"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215314",
|
|
|
|
|
"uuid": "0745ebfe-aea5-421a-8e0f-0c298339d924",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215314",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae12-a7ec-4bed-9096-417e02de0b81",
|
|
|
|
|
"value": "2017-10-28T17:04:59"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215314",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae12-9bc8-498f-82da-457802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/1a1144444adb05aee9ef8adfb3c892a97d32b870d1ee300975a5f3597f2ed638/analysis/1509210299/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215315",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae13-6edc-43e2-8ca0-4bd502de0b81",
|
|
|
|
|
"value": "29/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215318",
|
|
|
|
|
"uuid": "7d22be2e-b385-4542-bafd-8cda3281f8af",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "7d22be2e-b385-4542-bafd-8cda3281f8af",
|
|
|
|
|
"referenced_uuid": "6c18a448-9381-44bb-b7ba-97b81413fc84",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-3028-4ac4-9f52-490e02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215315",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae13-7d3c-4fbc-996d-40af02de0b81",
|
|
|
|
|
"value": "0236820e0e54b9db96afebbee3719673"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215315",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae13-4ac8-4de8-b5e0-454902de0b81",
|
|
|
|
|
"value": "ab279e125a2aa2cd86934da9f27d36184a01813f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215316",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae14-0b8c-4893-9459-417c02de0b81",
|
|
|
|
|
"value": "f1dbfaf0378434cd1758feaabe050171df1c234ddc6215df494c6592a9e92547"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215316",
|
|
|
|
|
"uuid": "6c18a448-9381-44bb-b7ba-97b81413fc84",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215316",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae14-fa3c-46a3-8735-48c702de0b81",
|
|
|
|
|
"value": "2018-02-18T10:09:16"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215317",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae15-dd90-4fb2-aa92-45a402de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f1dbfaf0378434cd1758feaabe050171df1c234ddc6215df494c6592a9e92547/analysis/1518948556/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215317",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae15-a610-474e-a15f-483102de0b81",
|
|
|
|
|
"value": "9/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215320",
|
|
|
|
|
"uuid": "b0b5debd-236b-418d-8531-a3bca58059e6",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "b0b5debd-236b-418d-8531-a3bca58059e6",
|
|
|
|
|
"referenced_uuid": "4d5cd1b8-e117-411c-afae-a3d69e619e90",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-d4dc-4a4e-8465-4ed202de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215317",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae15-6584-4d40-90ab-477902de0b81",
|
|
|
|
|
"value": "13d7c9aacc6ff7e6da96c31a8a48d70d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215317",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae15-dc9c-4879-bf17-44a902de0b81",
|
|
|
|
|
"value": "edcf28f99ac96b162385a63b4a323b8167ad6808"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215318",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae16-afac-4b2d-9142-463f02de0b81",
|
|
|
|
|
"value": "7bc897c2c55ff708cbccff1461d2406aaef7953686817bd2d6a39ad58af393f9"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215318",
|
|
|
|
|
"uuid": "4d5cd1b8-e117-411c-afae-a3d69e619e90",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae17-a4f4-45e1-adc5-458a02de0b81",
|
|
|
|
|
"value": "2017-12-10T12:07:53"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae17-5350-4dd2-94b9-432602de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7bc897c2c55ff708cbccff1461d2406aaef7953686817bd2d6a39ad58af393f9/analysis/1512907673/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae17-5154-46c5-8a3c-425902de0b81",
|
|
|
|
|
"value": "28/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215322",
|
|
|
|
|
"uuid": "aa497e72-a431-479b-8077-5ac653a7ef21",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "aa497e72-a431-479b-8077-5ac653a7ef21",
|
|
|
|
|
"referenced_uuid": "451113c2-f016-43ed-a80e-dd42f3b61bf3",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-ac34-45b9-bdd8-45a102de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae17-df84-45d1-9ec4-4c7a02de0b81",
|
|
|
|
|
"value": "4ca8f7fc1d0e14356266b2a0297bbefa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae18-8a48-4738-b301-4fd002de0b81",
|
|
|
|
|
"value": "7079a3f9b57f039d8ab418ea51867e87fc5faf46"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae18-2e30-49ff-83f2-468402de0b81",
|
|
|
|
|
"value": "33ab8e652c16836caf3b22518485757f417fab73a92e916f0c6aaf27b57f3be4"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215321",
|
|
|
|
|
"uuid": "451113c2-f016-43ed-a80e-dd42f3b61bf3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae19-2738-4b6c-aa71-4c1402de0b81",
|
|
|
|
|
"value": "2018-03-16T16:17:53"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae19-64ec-4e85-bd29-45e002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/33ab8e652c16836caf3b22518485757f417fab73a92e916f0c6aaf27b57f3be4/analysis/1521217073/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae1a-1c80-4eef-8068-415102de0b81",
|
|
|
|
|
"value": "34/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215325",
|
|
|
|
|
"uuid": "a1283755-9512-4fb4-952b-2f4d65e1281e",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "a1283755-9512-4fb4-952b-2f4d65e1281e",
|
|
|
|
|
"referenced_uuid": "24d66f9a-7b0a-4668-8c5c-6ca6050b9148",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "5ad9aea6-4c5c-4c62-aefc-41d702de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae1a-c3d0-4046-8cbb-4b3902de0b81",
|
|
|
|
|
"value": "13cbd91b4636b937355217faefe28355"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae1a-814c-4905-a81c-494c02de0b81",
|
|
|
|
|
"value": "b7e552c45906412cfb5aeac079fe8d3aadfe178d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae1a-7df4-4dcf-a3f5-469002de0b81",
|
|
|
|
|
"value": "db5b0bb4d05292e6649fa84f076195d7a0cfb15516ce386f214dc2dd96a5e467"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215323",
|
|
|
|
|
"uuid": "24d66f9a-7b0a-4668-8c5c-6ca6050b9148",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215323",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae1b-3b48-446c-9630-411502de0b81",
|
|
|
|
|
"value": "2018-02-15T05:29:05"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215323",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae1b-c150-46d8-8c3c-439d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/db5b0bb4d05292e6649fa84f076195d7a0cfb15516ce386f214dc2dd96a5e467/analysis/1518672545/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae1c-6208-47d0-ae52-48d602de0b81",
|
|
|
|
|
"value": "33/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215327",
|
|
|
|
|
"uuid": "9942e1a6-6aff-4d41-9c65-ac96ad725488",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "9942e1a6-6aff-4d41-9c65-ac96ad725488",
|
|
|
|
|
"referenced_uuid": "ea2d92b0-2297-4284-9a47-20f003e7649f",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-8454-44cf-b828-4fc802de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae1c-3d5c-45a8-bab1-449302de0b81",
|
|
|
|
|
"value": "ccd6b858459e00abf2a59da56ba85bc6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae1c-01a8-4385-9564-42a902de0b81",
|
|
|
|
|
"value": "16b6585515546689f69111d049bf01b357c2145a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215325",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae1d-c5ec-4de5-9c63-4d7702de0b81",
|
|
|
|
|
"value": "0a6cabedfabfbab3fba2057d30b1faab2f1b2d2d47a6227aa3b677af45f92da2"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215325",
|
|
|
|
|
"uuid": "ea2d92b0-2297-4284-9a47-20f003e7649f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215325",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae1d-4ad4-4163-99a0-43ab02de0b81",
|
|
|
|
|
"value": "2017-12-10T07:37:35"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215326",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae1e-6f3c-484b-be5a-486502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0a6cabedfabfbab3fba2057d30b1faab2f1b2d2d47a6227aa3b677af45f92da2/analysis/1512891455/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215326",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae1e-0378-4b36-b421-466f02de0b81",
|
|
|
|
|
"value": "26/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215329",
|
|
|
|
|
"uuid": "ef41bd1f-8663-4df6-a8f0-a32f05ee2929",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "ef41bd1f-8663-4df6-a8f0-a32f05ee2929",
|
|
|
|
|
"referenced_uuid": "c7efea86-38e8-48f9-bbf4-7ed8e0cccd7d",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-d4e8-42dd-9413-470002de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215326",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae1e-be08-49bf-b3c5-4a4402de0b81",
|
|
|
|
|
"value": "01721c6ccbbb56f63476aa17a3cb7dba"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215326",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae1e-f220-4a70-81f8-451802de0b81",
|
|
|
|
|
"value": "e537d1bc24836778059e89a891232feef7529fc0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215327",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae1f-86f8-4e28-af4e-45cb02de0b81",
|
|
|
|
|
"value": "6c8ca3ba14ee685739ea32a3ddc613d4544c69194a97c55365c570c053609938"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215327",
|
|
|
|
|
"uuid": "c7efea86-38e8-48f9-bbf4-7ed8e0cccd7d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215327",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae1f-cd24-49ed-87b1-44a402de0b81",
|
|
|
|
|
"value": "2018-02-18T22:26:07"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215328",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae20-afb0-4b11-8083-4c9902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6c8ca3ba14ee685739ea32a3ddc613d4544c69194a97c55365c570c053609938/analysis/1518992767/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215328",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae20-1328-49ca-8f7a-42c702de0b81",
|
|
|
|
|
"value": "17/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215331",
|
|
|
|
|
"uuid": "40076ee5-8c95-4b32-830d-016ea2cebaf2",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "40076ee5-8c95-4b32-830d-016ea2cebaf2",
|
|
|
|
|
"referenced_uuid": "1b50d528-62f5-4f78-9df4-40a2e5a095bd",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-5ea8-4b76-87ed-441b02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215328",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae20-1128-46d0-8be0-483a02de0b81",
|
|
|
|
|
"value": "02d70e303afff2a186d4459bf384ddc7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215329",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae21-161c-45b7-8b37-463d02de0b81",
|
|
|
|
|
"value": "b71a6988660ac18b1ad6fe0667f958727eaed6ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215329",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae21-5a58-4c34-ac86-4e7a02de0b81",
|
|
|
|
|
"value": "e586da2bd9fd73223281176033b97e6e4e137249f9aff8430004099b31508e12"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215329",
|
|
|
|
|
"uuid": "1b50d528-62f5-4f78-9df4-40a2e5a095bd",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215330",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae22-c1b0-48a7-bec9-4a3602de0b81",
|
|
|
|
|
"value": "2018-02-18T16:34:15"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215330",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae22-d2dc-4c72-97e4-429a02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e586da2bd9fd73223281176033b97e6e4e137249f9aff8430004099b31508e12/analysis/1518971655/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215330",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae22-13b4-492b-a28a-4f3e02de0b81",
|
|
|
|
|
"value": "10/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215333",
|
|
|
|
|
"uuid": "c4ce6a07-a96e-491d-912d-93b9c2853c3b",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "c4ce6a07-a96e-491d-912d-93b9c2853c3b",
|
|
|
|
|
"referenced_uuid": "35102d8f-3918-45f0-b06f-e56249794342",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-e098-4f32-8cc5-4f2e02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215330",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae22-42cc-4faa-a083-4a0a02de0b81",
|
|
|
|
|
"value": "989c3e07b6440efd432220e312e8df1d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215331",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae23-492c-4e78-a8dc-4db702de0b81",
|
|
|
|
|
"value": "5714754b2d8dd7976d78a76fe846888857510cb4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215331",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae23-7914-4acd-8e29-4ed202de0b81",
|
|
|
|
|
"value": "4605f6041d93c6390c1ed856336c01a6cf3982bea1987c6de846752ca7006882"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215332",
|
|
|
|
|
"uuid": "35102d8f-3918-45f0-b06f-e56249794342",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215332",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae24-a9d0-4089-9a0e-4d1b02de0b81",
|
|
|
|
|
"value": "2017-12-01T05:29:50"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215332",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae24-c3b0-49cc-8270-4afb02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4605f6041d93c6390c1ed856336c01a6cf3982bea1987c6de846752ca7006882/analysis/1512106190/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215333",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae25-5fd4-44b7-8a91-4e7102de0b81",
|
|
|
|
|
"value": "15/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215336",
|
|
|
|
|
"uuid": "f93d9038-ecd3-4445-86e9-3887a797a5b7",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "f93d9038-ecd3-4445-86e9-3887a797a5b7",
|
|
|
|
|
"referenced_uuid": "5c3c3c27-41c9-4498-be03-8b7e20ef7a01",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-a234-4b8c-937d-45e502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215333",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae25-4a10-46f8-88f5-4db902de0b81",
|
|
|
|
|
"value": "d4ecd35ba98595ce86442c472ef2113d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215333",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae25-8d1c-466d-87d5-408002de0b81",
|
|
|
|
|
"value": "78dc8028af915547543310b96a79e69b861da70a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215333",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae25-0ec0-4ff1-95a2-4c3802de0b81",
|
|
|
|
|
"value": "9af34cdb7f0b01c044fdeb64f0b733d78e8b9be854c4beeee679f8ee083530b1"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215334",
|
|
|
|
|
"uuid": "5c3c3c27-41c9-4498-be03-8b7e20ef7a01",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215334",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae26-34a0-4acc-ac8b-4da302de0b81",
|
|
|
|
|
"value": "2018-03-12T07:32:52"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215334",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae26-a024-49db-bf24-4c6d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9af34cdb7f0b01c044fdeb64f0b733d78e8b9be854c4beeee679f8ee083530b1/analysis/1520839972/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215335",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae27-524c-48ac-9c62-4bc102de0b81",
|
|
|
|
|
"value": "58/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215338",
|
|
|
|
|
"uuid": "4a801296-d29c-4f5f-8b79-cb38789995ae",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "4a801296-d29c-4f5f-8b79-cb38789995ae",
|
|
|
|
|
"referenced_uuid": "b23c1243-8546-43e6-b6ac-bdc9a52e5bd4",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-b5fc-47e1-9f61-496702de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215335",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae27-4360-457d-8a51-428002de0b81",
|
|
|
|
|
"value": "00613dd1637c16fe5abc5a7d3e838626"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215335",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae27-c818-44a3-997b-402402de0b81",
|
|
|
|
|
"value": "bec0a96f3877b587656be58aef2da475032343ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215335",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae28-0bb8-43b9-a497-41f102de0b81",
|
|
|
|
|
"value": "b622971e681f9e2fa5f84bfcb9e7144b6198d3fb554de8d4488117ca1e3f51c8"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215336",
|
|
|
|
|
"uuid": "b23c1243-8546-43e6-b6ac-bdc9a52e5bd4",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215336",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae28-76e0-4b5d-ae74-4b7602de0b81",
|
|
|
|
|
"value": "2018-02-19T10:40:33"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215336",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae28-8394-4662-bb83-4e5402de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b622971e681f9e2fa5f84bfcb9e7144b6198d3fb554de8d4488117ca1e3f51c8/analysis/1519036833/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215337",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae29-1478-464c-962e-422902de0b81",
|
|
|
|
|
"value": "19/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215340",
|
|
|
|
|
"uuid": "c9b13b31-1a5d-4a7e-a46f-d8dea222c73f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "c9b13b31-1a5d-4a7e-a46f-d8dea222c73f",
|
|
|
|
|
"referenced_uuid": "edd1a003-7c62-43a9-a8a4-f00159990874",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-e1d8-4f72-bd24-412502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215337",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae29-41d0-462f-9a61-442d02de0b81",
|
|
|
|
|
"value": "36661ea762fcfb7bfee99a90696c5caa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215337",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae29-21a0-4d20-8894-488b02de0b81",
|
|
|
|
|
"value": "16ec8afa964a524f40e4dcfd285415c299a3315d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215338",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae2a-9634-4cbc-84ad-418502de0b81",
|
|
|
|
|
"value": "4632c1023c0baaa1e227defd4923098c4f3c49317964ff1cb088b40b9df7a605"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215338",
|
|
|
|
|
"uuid": "edd1a003-7c62-43a9-a8a4-f00159990874",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215338",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae2a-e654-4195-987e-440f02de0b81",
|
|
|
|
|
"value": "2017-11-01T02:32:20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215339",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae2b-c284-4c8e-8e2b-452802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4632c1023c0baaa1e227defd4923098c4f3c49317964ff1cb088b40b9df7a605/analysis/1509503540/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215339",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae2b-9ff0-4b9e-8f92-4edd02de0b81",
|
|
|
|
|
"value": "40/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215342",
|
|
|
|
|
"uuid": "9766aaf4-2b4d-42a8-b271-07a8430ff750",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "9766aaf4-2b4d-42a8-b271-07a8430ff750",
|
|
|
|
|
"referenced_uuid": "9f9e8c03-a143-42d7-b717-70ed7682d916",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-9564-462c-a470-40d102de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215339",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae2b-7324-4725-979f-4c7102de0b81",
|
|
|
|
|
"value": "32e4fc7790f9c8a19967fad355bd6a3a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215340",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae2c-be44-40ee-a88f-498f02de0b81",
|
|
|
|
|
"value": "99543608d4ae2ffb43b3742f671a5574121a8189"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215340",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae2c-56e8-4da5-b14f-472b02de0b81",
|
|
|
|
|
"value": "84c269a1661a987058f51dea4644ec2703b28170324fbeab6920e40ad1a05a54"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215340",
|
|
|
|
|
"uuid": "9f9e8c03-a143-42d7-b717-70ed7682d916",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215340",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae2c-4b28-46f2-bd85-45f002de0b81",
|
|
|
|
|
"value": "2017-12-08T13:10:41"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215341",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae2d-181c-4011-8045-414e02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/84c269a1661a987058f51dea4644ec2703b28170324fbeab6920e40ad1a05a54/analysis/1512738641/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215341",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae2d-4b14-4932-9aa4-4d7202de0b81",
|
|
|
|
|
"value": "28/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215344",
|
|
|
|
|
"uuid": "de30466c-306a-4ff8-a134-3016bd00c2da",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "de30466c-306a-4ff8-a134-3016bd00c2da",
|
|
|
|
|
"referenced_uuid": "d77bdd19-aec1-4b36-b72e-1d67bb46e2ee",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-b91c-4eaa-b786-431902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215341",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae2d-f664-4b8f-90e1-458e02de0b81",
|
|
|
|
|
"value": "015fd37556083555fe11ad6dd0a144e0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215342",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae2e-7f54-4476-b5a4-40f602de0b81",
|
|
|
|
|
"value": "57fb04b626594b1ef374073a4c4f85dfd4dd4543"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215342",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae2e-d4b0-4c57-8258-4c3702de0b81",
|
|
|
|
|
"value": "79a50327843a8ccf58147971d1c86945f9a40cd0d4ee35084b8af26c9f5ab210"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215342",
|
|
|
|
|
"uuid": "d77bdd19-aec1-4b36-b72e-1d67bb46e2ee",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215343",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae2f-3948-448d-a6b1-4dc902de0b81",
|
|
|
|
|
"value": "2017-12-21T01:16:39"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215343",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae2f-4b8c-4788-b869-4da302de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/79a50327843a8ccf58147971d1c86945f9a40cd0d4ee35084b8af26c9f5ab210/analysis/1513818999/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215343",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae2f-562c-455b-822d-40d002de0b81",
|
|
|
|
|
"value": "60/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215346",
|
|
|
|
|
"uuid": "be24abb2-78bb-4d0a-9dff-b8d9d47ac518",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "be24abb2-78bb-4d0a-9dff-b8d9d47ac518",
|
|
|
|
|
"referenced_uuid": "7988c9d7-a714-433c-a302-4a38a99896d7",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-fd30-4da0-9444-4cea02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215343",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae2f-9854-4dba-a93f-4e7a02de0b81",
|
|
|
|
|
"value": "91bea40c811de97826177159d8bbdde1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215344",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae30-8650-4474-a360-489d02de0b81",
|
|
|
|
|
"value": "307eced0088f03a1c535a050f794e49e3cb6e248"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215344",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae30-d60c-49bd-b249-400a02de0b81",
|
|
|
|
|
"value": "ff5d541f260063a88b04a892cacfb3bcb13b8dd83c5f29ed5000737dbd6662c4"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215345",
|
|
|
|
|
"uuid": "7988c9d7-a714-433c-a302-4a38a99896d7",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215345",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae31-a5f4-49fa-b6ea-4a9002de0b81",
|
|
|
|
|
"value": "2017-11-03T06:07:20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215345",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae31-353c-4587-b6d7-4b0102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/ff5d541f260063a88b04a892cacfb3bcb13b8dd83c5f29ed5000737dbd6662c4/analysis/1509689240/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215345",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae31-c894-448e-a5a1-409b02de0b81",
|
|
|
|
|
"value": "49/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215348",
|
|
|
|
|
"uuid": "ff8766ca-b4b6-4c3d-a8db-7c64fa5d5166",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "ff8766ca-b4b6-4c3d-a8db-7c64fa5d5166",
|
|
|
|
|
"referenced_uuid": "82da5b6c-dc6e-4612-be44-ee4bbd7a65e8",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-32f4-4c50-a4dc-4b3002de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215346",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae32-4a44-4a5a-a77e-4b1102de0b81",
|
|
|
|
|
"value": "665a7013308c25b7b08173d58218e34c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215346",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae32-3bd4-4d96-9877-474f02de0b81",
|
|
|
|
|
"value": "37998b9399096642ec6f961f9354f9dea4a067de"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215346",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae32-0100-403e-8ead-471202de0b81",
|
|
|
|
|
"value": "afcdd2fda5b3c9e78a977df31be307ea7323b746e07e35e4d3c39a3a3f4b4b79"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215347",
|
|
|
|
|
"uuid": "82da5b6c-dc6e-4612-be44-ee4bbd7a65e8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215347",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae33-fd64-4d58-b52b-43af02de0b81",
|
|
|
|
|
"value": "2017-12-13T06:17:05"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215347",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae33-d254-4069-8602-472202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/afcdd2fda5b3c9e78a977df31be307ea7323b746e07e35e4d3c39a3a3f4b4b79/analysis/1513145825/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215348",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae34-5250-4d4e-bb7c-4dd302de0b81",
|
|
|
|
|
"value": "55/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215351",
|
|
|
|
|
"uuid": "c33e937c-3313-4bd8-9d42-8a213ad27271",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "c33e937c-3313-4bd8-9d42-8a213ad27271",
|
|
|
|
|
"referenced_uuid": "a9affe73-79d3-46e1-9175-550e62f9d545",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-d05c-4f4f-951d-4efe02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215348",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae34-cc40-45d7-96ab-4c8102de0b81",
|
|
|
|
|
"value": "0f102fc1cc92f69ee36e08fcdd3e1968"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215348",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae34-aabc-49fb-8b3b-43e002de0b81",
|
|
|
|
|
"value": "a0d18993251ae90c83bf97008cf08d35188a6714"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215348",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae34-b1a0-456c-a746-4b5a02de0b81",
|
|
|
|
|
"value": "0863bf4a5476b5de02a15c3bdec1604c7d8ab7c8ca1c0546edf2f16a756e0d8f"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215349",
|
|
|
|
|
"uuid": "a9affe73-79d3-46e1-9175-550e62f9d545",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215349",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae35-3bb0-4f2c-9dbf-462d02de0b81",
|
|
|
|
|
"value": "2018-02-19T06:10:40"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215349",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae35-dee8-41d8-9da0-400a02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0863bf4a5476b5de02a15c3bdec1604c7d8ab7c8ca1c0546edf2f16a756e0d8f/analysis/1519020640/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215350",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae36-dcfc-45e2-bc0a-4c5402de0b81",
|
|
|
|
|
"value": "8/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215353",
|
|
|
|
|
"uuid": "5e70ded6-3a06-4520-86d4-77316815da01",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5e70ded6-3a06-4520-86d4-77316815da01",
|
|
|
|
|
"referenced_uuid": "a6d5940d-d687-4031-89c7-d527a7cb1083",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-9344-452c-b8b2-4e5f02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215350",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae36-7180-4880-a7cd-4f7902de0b81",
|
|
|
|
|
"value": "f4c9124b5e37043d05d2d30f63a86c82"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215350",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae36-82e4-46dc-949a-4c3d02de0b81",
|
|
|
|
|
"value": "2348d1cf008df2d9a6a438cbfb576751bca00ab2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215351",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae37-2dd0-4d18-9e7e-469202de0b81",
|
|
|
|
|
"value": "05be7b2de818dcb358a4f24d6050ae2b91d728c80a8af279894b5e701b060926"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215351",
|
|
|
|
|
"uuid": "a6d5940d-d687-4031-89c7-d527a7cb1083",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae37-a758-4f42-a1b5-4ac502de0b81",
|
|
|
|
|
"value": "2017-12-03T10:13:57"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae38-70a0-4c3d-9205-4aa902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/05be7b2de818dcb358a4f24d6050ae2b91d728c80a8af279894b5e701b060926/analysis/1512296037/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae38-5868-462c-83ce-4cfc02de0b81",
|
|
|
|
|
"value": "24/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215355",
|
|
|
|
|
"uuid": "31abe87c-b601-4581-ba6c-55e716214d8e",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "31abe87c-b601-4581-ba6c-55e716214d8e",
|
|
|
|
|
"referenced_uuid": "d6f9fda9-bb3e-4a6d-951a-ef2b7b91810b",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-b0f8-45ac-a66d-486002de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae38-0994-4ae7-8173-4b6e02de0b81",
|
|
|
|
|
"value": "06475fb6c697ecbe07baad0014d507f5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215353",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae39-34a8-438f-9867-46b902de0b81",
|
|
|
|
|
"value": "92ead94fed5ef97166bf31b318400dc83f7c5b69"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215353",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae39-d870-42ae-866f-496f02de0b81",
|
|
|
|
|
"value": "404746279f7d963489d1d7d2d9be4bd1b1dd82e81e21f6ebf09091ee7b059988"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215353",
|
|
|
|
|
"uuid": "d6f9fda9-bb3e-4a6d-951a-ef2b7b91810b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215353",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae39-6620-4763-88fc-416b02de0b81",
|
|
|
|
|
"value": "2018-02-18T20:48:11"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae3a-2eb0-414c-8a80-4d8702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/404746279f7d963489d1d7d2d9be4bd1b1dd82e81e21f6ebf09091ee7b059988/analysis/1518986891/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae3a-4b58-45f3-aaf4-487f02de0b81",
|
|
|
|
|
"value": "16/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215357",
|
|
|
|
|
"uuid": "ea39a79f-3211-4917-8ba8-11798108d030",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "ea39a79f-3211-4917-8ba8-11798108d030",
|
|
|
|
|
"referenced_uuid": "36ca324b-a75e-40dc-a318-a368d201799b",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-13d4-4f07-9c8c-48e002de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215354",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae3a-e9ec-4484-9dee-4db802de0b81",
|
|
|
|
|
"value": "05d7f6cb4e4711de53515e9587442dee"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215355",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae3b-6ff8-4d5e-9194-40e402de0b81",
|
|
|
|
|
"value": "662ac4eebb5060027016d9875594832741d0e687"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215355",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae3b-3b68-4486-af2e-475c02de0b81",
|
|
|
|
|
"value": "739f27ac00dc449895f589ff28e86d78ea17ca298ffc0b40021136d7c77ed679"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215355",
|
|
|
|
|
"uuid": "36ca324b-a75e-40dc-a318-a368d201799b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae3c-d11c-4ab2-891e-461102de0b81",
|
|
|
|
|
"value": "2018-02-20T20:11:38"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae3c-6900-4f73-a658-413902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/739f27ac00dc449895f589ff28e86d78ea17ca298ffc0b40021136d7c77ed679/analysis/1519157498/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae3c-0fd0-42c7-9d0a-41e902de0b81",
|
|
|
|
|
"value": "33/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215359",
|
|
|
|
|
"uuid": "ba5fa1e3-8824-42b7-8158-8885efa936dc",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "ba5fa1e3-8824-42b7-8158-8885efa936dc",
|
|
|
|
|
"referenced_uuid": "4b6521e7-b216-4bb7-8b2e-d03294f7a176",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-bcd4-48ca-bba8-470a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215356",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae3c-2364-4fe4-badf-45bf02de0b81",
|
|
|
|
|
"value": "4ef158b4573016629ad7e98ac8745bf6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae3d-5b34-4f99-afc6-491102de0b81",
|
|
|
|
|
"value": "8084b94e5dfab7e19e9f55c20f66db700af70949"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae3d-cc40-4e1c-b027-430302de0b81",
|
|
|
|
|
"value": "b4abd9556f093b7d80bdc755d502917310a807d5ee9d9f9bac19bb0c8d596dbc"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215358",
|
|
|
|
|
"uuid": "4b6521e7-b216-4bb7-8b2e-d03294f7a176",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae3e-63d0-4db0-b37d-445902de0b81",
|
|
|
|
|
"value": "2018-03-15T17:54:15"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae3e-5d90-463c-84d7-4e6f02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b4abd9556f093b7d80bdc755d502917310a807d5ee9d9f9bac19bb0c8d596dbc/analysis/1521136455/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae3f-8b5c-4898-bf08-4c7902de0b81",
|
|
|
|
|
"value": "55/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215362",
|
|
|
|
|
"uuid": "049ddb48-7266-48ef-946e-c19acf93d44b",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "049ddb48-7266-48ef-946e-c19acf93d44b",
|
|
|
|
|
"referenced_uuid": "44a5a106-6496-434f-837c-f4b710cbcfac",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-8bb4-4788-9af2-41e802de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae3f-679c-47c5-980a-4d9202de0b81",
|
|
|
|
|
"value": "86e461c77c398bf314605556bb03cd9d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae3f-3908-4ef6-b35f-43e302de0b81",
|
|
|
|
|
"value": "d29cbf86f56d0cddab991028f941f05d49a2b1e3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae3f-41b8-4e90-9d71-4bd502de0b81",
|
|
|
|
|
"value": "3431065d2208123137714d2d432427d33cff576d202e1fc7ea2990b21847cce1"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215360",
|
|
|
|
|
"uuid": "44a5a106-6496-434f-837c-f4b710cbcfac",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215360",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae40-9f4c-457a-a137-416c02de0b81",
|
|
|
|
|
"value": "2017-11-29T04:35:23"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215360",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae40-d0e0-400c-906f-45ca02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3431065d2208123137714d2d432427d33cff576d202e1fc7ea2990b21847cce1/analysis/1511930123/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215361",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae41-0e90-4b0b-bbe6-47dd02de0b81",
|
|
|
|
|
"value": "53/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215364",
|
|
|
|
|
"uuid": "797ea4f5-30c7-40ac-baf6-28db7149f503",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "797ea4f5-30c7-40ac-baf6-28db7149f503",
|
|
|
|
|
"referenced_uuid": "1086f8ba-2d76-4d9b-b26a-5e18c595f194",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215463",
|
|
|
|
|
"uuid": "5ad9aea7-73dc-43c3-a30e-4d5102de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215361",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae41-7154-4403-93e2-423c02de0b81",
|
|
|
|
|
"value": "d29bf2c7365d0f4a381d34b088ba2796"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215361",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae41-fa28-4dc8-a8ec-474602de0b81",
|
|
|
|
|
"value": "e30e34e3a914de109585cd0421b5dec2ff7490aa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215362",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae42-b718-4adf-9048-47a502de0b81",
|
|
|
|
|
"value": "a10aefc70a3d3512cf54f74e39b3ee5cc5403c003179c57aeea7fb3895ed8ace"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215362",
|
|
|
|
|
"uuid": "1086f8ba-2d76-4d9b-b26a-5e18c595f194",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215362",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae42-e82c-411c-98bd-4a3302de0b81",
|
|
|
|
|
"value": "2017-12-01T05:25:35"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215363",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae43-aa5c-4cb2-948d-491202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a10aefc70a3d3512cf54f74e39b3ee5cc5403c003179c57aeea7fb3895ed8ace/analysis/1512105935/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215363",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae43-6948-438d-885e-4f4302de0b81",
|
|
|
|
|
"value": "21/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215366",
|
|
|
|
|
"uuid": "0ed8ca28-2829-4ca6-ba71-03b2a41bf521",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "0ed8ca28-2829-4ca6-ba71-03b2a41bf521",
|
|
|
|
|
"referenced_uuid": "d249aa60-eb0b-4861-a6b4-87b813998e73",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215464",
|
|
|
|
|
"uuid": "5ad9aea8-81e8-4cda-a556-448a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215363",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae43-3390-42db-a1aa-4bdb02de0b81",
|
|
|
|
|
"value": "00169225291abe1864627a2da79125a9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215363",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae43-6ed4-40bd-84a8-413e02de0b81",
|
|
|
|
|
"value": "7a589eb3487062f60ac1f98a309aed5227be1221"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215364",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae44-5278-4a3c-842f-46d702de0b81",
|
|
|
|
|
"value": "0fee9d67ef1967d2bee1f67b1dc5ae24dff5d6dba17b9247e33b87f5bf6e6856"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215364",
|
|
|
|
|
"uuid": "d249aa60-eb0b-4861-a6b4-87b813998e73",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215364",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae44-f018-47f9-9860-476102de0b81",
|
|
|
|
|
"value": "2018-02-19T13:02:52"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215365",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae45-3300-49d4-ba64-4c0602de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0fee9d67ef1967d2bee1f67b1dc5ae24dff5d6dba17b9247e33b87f5bf6e6856/analysis/1519045372/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215365",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae45-4fe4-44d0-b467-4fd102de0b81",
|
|
|
|
|
"value": "10/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215368",
|
|
|
|
|
"uuid": "a91eac4f-7259-4a12-8838-2b0f051d6696",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "a91eac4f-7259-4a12-8838-2b0f051d6696",
|
|
|
|
|
"referenced_uuid": "6088b568-f7ad-4a41-a8d8-d4522a466ac9",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215464",
|
|
|
|
|
"uuid": "5ad9aea8-ef3c-4b2e-862b-400e02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215365",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae45-071c-4fbf-a604-410402de0b81",
|
|
|
|
|
"value": "0a72951f5e1ed79de9f470ba42cdd606"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215366",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae46-9ef4-40ea-b1da-417402de0b81",
|
|
|
|
|
"value": "2be592e359a630f45b5a59b5953c1cbe9c7b3308"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215366",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae46-88b4-4ebc-9cac-42e702de0b81",
|
|
|
|
|
"value": "7b24f0523af239668ee8946c433c53d0c233b0290bbaca405885d39dff86fa1f"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215366",
|
|
|
|
|
"uuid": "6088b568-f7ad-4a41-a8d8-d4522a466ac9",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215366",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae46-94e8-4d6d-a553-465402de0b81",
|
|
|
|
|
"value": "2017-10-24T01:43:52"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215367",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae47-8418-427f-a911-442b02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7b24f0523af239668ee8946c433c53d0c233b0290bbaca405885d39dff86fa1f/analysis/1508809432/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215367",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae47-61b8-48af-9fa8-4bbb02de0b81",
|
|
|
|
|
"value": "48/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215370",
|
|
|
|
|
"uuid": "e6ea2fd2-8462-4e6f-9a19-cce766827d36",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "e6ea2fd2-8462-4e6f-9a19-cce766827d36",
|
|
|
|
|
"referenced_uuid": "16acc5bd-90ec-431b-bbca-953b2b06ece8",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215464",
|
|
|
|
|
"uuid": "5ad9aea8-2cf8-450d-a1a8-438902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215367",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae47-da40-454a-91d0-4aa602de0b81",
|
|
|
|
|
"value": "9de2f18b09633a5aa822df9df7cd52d2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215368",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae48-648c-49d7-9843-438202de0b81",
|
|
|
|
|
"value": "4c244838fd8588e6cc4b5107067e0025a01d536f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215368",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae48-5a88-43e2-bf92-437902de0b81",
|
|
|
|
|
"value": "24281907f8904bf6b9af4116f52ae2ba8b4b97ce586cd3b2b2777a8f3c76c8cc"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215369",
|
|
|
|
|
"uuid": "16acc5bd-90ec-431b-bbca-953b2b06ece8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215369",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae49-5570-40b2-887c-493f02de0b81",
|
|
|
|
|
"value": "2017-11-29T02:54:27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215369",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae49-7b60-4451-b72f-4d3002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/24281907f8904bf6b9af4116f52ae2ba8b4b97ce586cd3b2b2777a8f3c76c8cc/analysis/1511924067/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215370",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae4a-0884-465b-a4a8-414e02de0b81",
|
|
|
|
|
"value": "52/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215373",
|
|
|
|
|
"uuid": "ecdf5094-5fc6-44c6-8c47-412f3bb5b255",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "ecdf5094-5fc6-44c6-8c47-412f3bb5b255",
|
|
|
|
|
"referenced_uuid": "98a86f21-1cc1-4708-9b3e-74e14dfe7f48",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215464",
|
|
|
|
|
"uuid": "5ad9aea8-ecd8-4558-a9f0-41fc02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215370",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae4a-06b0-4711-acfb-42cc02de0b81",
|
|
|
|
|
"value": "fc1710d508e09f6744118738f7c90f63"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215370",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae4a-78ec-42b1-a149-457902de0b81",
|
|
|
|
|
"value": "c52e3af53b67c35337e5ef884b0ecfcd3b27ec20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215370",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae4a-cecc-4958-a9e3-4fa902de0b81",
|
|
|
|
|
"value": "e1e31a797b01f5f4ec694fb03d894e5ab331f41f3bc8c34bb407d390554bfe3a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215371",
|
|
|
|
|
"uuid": "98a86f21-1cc1-4708-9b3e-74e14dfe7f48",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215371",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae4b-6fd0-48a8-9742-40e602de0b81",
|
|
|
|
|
"value": "2017-12-10T15:10:25"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215371",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae4b-ea74-4327-be7f-43b002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e1e31a797b01f5f4ec694fb03d894e5ab331f41f3bc8c34bb407d390554bfe3a/analysis/1512918625/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215372",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae4c-2fc0-4c85-8407-455f02de0b81",
|
|
|
|
|
"value": "28/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215375",
|
|
|
|
|
"uuid": "77cfb676-5e8d-4566-84e1-4e6817db2990",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "77cfb676-5e8d-4566-84e1-4e6817db2990",
|
|
|
|
|
"referenced_uuid": "f604786f-c9dd-4c19-ab31-aa89044f4a1b",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-7c50-429f-be9d-4bc502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215372",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae4c-3bb0-44b2-99b9-40f002de0b81",
|
|
|
|
|
"value": "4f08735aa600f1c9ac4ce5af469e994e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215372",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae4c-0e04-4b58-ba93-4d0302de0b81",
|
|
|
|
|
"value": "70de718c364af5831fc7227d394df71424786f7f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215373",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae4d-b85c-4e12-b3f6-481402de0b81",
|
|
|
|
|
"value": "df58773cc519e82a8beebeca8035018168cb3cb26aa491aae89c8d68cec835a7"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215373",
|
|
|
|
|
"uuid": "f604786f-c9dd-4c19-ab31-aa89044f4a1b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215373",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae4d-b868-4c41-89da-420b02de0b81",
|
|
|
|
|
"value": "2017-10-25T01:50:14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215374",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae4e-251c-4c14-82d0-45fe02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/df58773cc519e82a8beebeca8035018168cb3cb26aa491aae89c8d68cec835a7/analysis/1508896214/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215374",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae4e-6888-49db-b19c-49bb02de0b81",
|
|
|
|
|
"value": "52/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215377",
|
|
|
|
|
"uuid": "96745ec9-e044-4f68-a3cb-383e0fa9f872",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "96745ec9-e044-4f68-a3cb-383e0fa9f872",
|
|
|
|
|
"referenced_uuid": "b55b4b48-6ba3-44f3-b8da-903bfd98ea29",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-9fec-433b-a02e-4b4c02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215374",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae4e-ffb0-4071-9ffe-430002de0b81",
|
|
|
|
|
"value": "0228d240888782fa29a9d1902986eeaa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215375",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae4f-74f8-49de-8459-4f2d02de0b81",
|
|
|
|
|
"value": "491ed32451e271c68726c60d47dd0e6d4e87da77"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215375",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae4f-7960-4d00-91ee-452e02de0b81",
|
|
|
|
|
"value": "e616d1e7e2b6e1d4f1ac2fea3e2041b842d27f5de05ff941b5661997cfe8a856"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215376",
|
|
|
|
|
"uuid": "b55b4b48-6ba3-44f3-b8da-903bfd98ea29",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215376",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae50-5950-45e6-941c-4ce502de0b81",
|
|
|
|
|
"value": "2018-02-18T10:56:14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215376",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae50-bd24-47dc-bc67-4bfb02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e616d1e7e2b6e1d4f1ac2fea3e2041b842d27f5de05ff941b5661997cfe8a856/analysis/1518951374/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215376",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae50-fbf8-4ced-94fb-46bc02de0b81",
|
|
|
|
|
"value": "8/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215379",
|
|
|
|
|
"uuid": "3f85b4db-24d4-40a8-a7d8-71d30219b53e",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "3f85b4db-24d4-40a8-a7d8-71d30219b53e",
|
|
|
|
|
"referenced_uuid": "c55b37c5-82e6-4fc8-a929-4118f95504af",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-0000-4069-9abe-416502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215376",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae50-c8c8-43bf-ac43-492502de0b81",
|
|
|
|
|
"value": "1a6c4aa20f4ec39be5ac38f409e10162"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215377",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae51-0674-457a-9d4e-422c02de0b81",
|
|
|
|
|
"value": "92de724b963b3c1114a48040305bd1a60461d59b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215377",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae51-3c28-49a9-8661-40cf02de0b81",
|
|
|
|
|
"value": "6bd49db136718b3cef01348bc839e206d566a1e1c32e0537be61dfa2ee87de6b"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215378",
|
|
|
|
|
"uuid": "c55b37c5-82e6-4fc8-a929-4118f95504af",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215378",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae52-1614-44e3-9bde-4f9702de0b81",
|
|
|
|
|
"value": "2017-12-08T13:07:14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215378",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae52-70cc-4f5f-a3b5-4f5002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6bd49db136718b3cef01348bc839e206d566a1e1c32e0537be61dfa2ee87de6b/analysis/1512738434/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215379",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae53-744c-4f96-8fb7-4b0302de0b81",
|
|
|
|
|
"value": "30/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215382",
|
|
|
|
|
"uuid": "1852f268-9a82-42b0-8a9e-d7e52d16abbd",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "1852f268-9a82-42b0-8a9e-d7e52d16abbd",
|
|
|
|
|
"referenced_uuid": "f6ec3f23-3273-49b5-8dea-910fbcf248b5",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-c53c-4c41-a21b-4f7602de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215379",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae53-f4b0-4383-a7b3-4b4a02de0b81",
|
|
|
|
|
"value": "82233a133847696c7ddbdf5a1241be17"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215379",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae53-d9bc-4506-a1ce-41b402de0b81",
|
|
|
|
|
"value": "c13f5e7a55857f2297d3282d672fe1e10304d49d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215379",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae53-6088-4d12-acd3-458202de0b81",
|
|
|
|
|
"value": "9b4536855237fe80447950bf86d1177489dbc1b231122e4a5d2157ba93c1b504"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215380",
|
|
|
|
|
"uuid": "f6ec3f23-3273-49b5-8dea-910fbcf248b5",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215380",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae54-2894-4246-a7ae-4a5002de0b81",
|
|
|
|
|
"value": "2017-12-20T01:25:42"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215380",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae54-138c-49f6-9e5c-43d102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9b4536855237fe80447950bf86d1177489dbc1b231122e4a5d2157ba93c1b504/analysis/1513733142/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215381",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae55-e7b0-43dd-90d1-4e9702de0b81",
|
|
|
|
|
"value": "31/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215384",
|
|
|
|
|
"uuid": "37bf3b5d-cb41-409f-94e9-f50be725a4af",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "37bf3b5d-cb41-409f-94e9-f50be725a4af",
|
|
|
|
|
"referenced_uuid": "f354861e-6452-4a92-a456-69b235657f4d",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-2188-4084-a563-41eb02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215381",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae55-9aec-4173-9c43-4fe402de0b81",
|
|
|
|
|
"value": "4472d7dcfc811e1b0da7d62fa3ce486b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215381",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae55-d820-424e-b9fc-453a02de0b81",
|
|
|
|
|
"value": "ae79399cc079dbb20d6ab3b50b30236e9d015038"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215382",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae56-ae60-49f1-bddf-40fc02de0b81",
|
|
|
|
|
"value": "86746d7dfa923b5b1e0e5a0d27f19eb40979dcf342f2fba01ccbb09175b9363c"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215382",
|
|
|
|
|
"uuid": "f354861e-6452-4a92-a456-69b235657f4d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215382",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae56-1598-49ed-94df-444002de0b81",
|
|
|
|
|
"value": "2017-11-02T02:55:35"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215382",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae56-a994-48c2-926c-49ae02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/86746d7dfa923b5b1e0e5a0d27f19eb40979dcf342f2fba01ccbb09175b9363c/analysis/1509591335/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215383",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae57-525c-4994-a1ce-4fc502de0b81",
|
|
|
|
|
"value": "45/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215386",
|
|
|
|
|
"uuid": "fd71e68d-d005-441d-8ee0-7b5c1812bf8b",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "fd71e68d-d005-441d-8ee0-7b5c1812bf8b",
|
|
|
|
|
"referenced_uuid": "4c74c847-cc7b-492c-87b0-f33694b4c6ec",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-d8fc-4f3c-8f5e-441d02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215383",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae57-9304-4680-988c-481d02de0b81",
|
|
|
|
|
"value": "edfaea51fd99182341fe5c0b503b738c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215383",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae57-666c-4154-bb30-412e02de0b81",
|
|
|
|
|
"value": "fe6bd0ecd3dc1be10d3fbadf08075e22bac98ca3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215384",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae58-e6fc-4e8c-9077-4f6f02de0b81",
|
|
|
|
|
"value": "530607f9b54be981e420a7bca1d33d0fa180e6c42877beddeb23836cc440f062"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215384",
|
|
|
|
|
"uuid": "4c74c847-cc7b-492c-87b0-f33694b4c6ec",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215384",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae58-1588-4412-b726-4e8402de0b81",
|
|
|
|
|
"value": "2017-12-01T04:41:40"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215385",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae59-ac34-4d5d-b2f3-4d2802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/530607f9b54be981e420a7bca1d33d0fa180e6c42877beddeb23836cc440f062/analysis/1512103300/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215385",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae59-4bd8-45cf-8cf9-476302de0b81",
|
|
|
|
|
"value": "58/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215388",
|
|
|
|
|
"uuid": "139196f6-be99-47ed-b809-73d2853fa944",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "139196f6-be99-47ed-b809-73d2853fa944",
|
|
|
|
|
"referenced_uuid": "0a753999-8af3-41ac-8ddd-dcc50453ed70",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-6dac-486a-b1bc-4d2b02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215385",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae59-0964-45b6-8117-417002de0b81",
|
|
|
|
|
"value": "e65541fea778be35e24b5dc27b866819"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215386",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae5a-d020-4aab-8868-4cee02de0b81",
|
|
|
|
|
"value": "79d8b1df541e1aadae1a59a4a10e24749803986e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215386",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae5a-3f1c-419c-b60d-428802de0b81",
|
|
|
|
|
"value": "e9a7b16189e27dff9ff67e31d09fa05e7f32658dfa56bb51feff8ca0cfb4eb85"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215386",
|
|
|
|
|
"uuid": "0a753999-8af3-41ac-8ddd-dcc50453ed70",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215386",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae5a-0c04-48b1-a181-43e602de0b81",
|
|
|
|
|
"value": "2017-10-28T04:51:14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215387",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae5b-1340-489b-a131-46af02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e9a7b16189e27dff9ff67e31d09fa05e7f32658dfa56bb51feff8ca0cfb4eb85/analysis/1509166274/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215387",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae5b-d124-476b-9894-4bf802de0b81",
|
|
|
|
|
"value": "24/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215390",
|
|
|
|
|
"uuid": "cc2b374f-3d33-44e7-a28a-aa0e6581036e",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "cc2b374f-3d33-44e7-a28a-aa0e6581036e",
|
|
|
|
|
"referenced_uuid": "78ef6597-c29d-407c-90da-5c9ac51c0d20",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-3970-4a07-a221-47a602de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215387",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae5b-382c-48cf-ab9f-4ef402de0b81",
|
|
|
|
|
"value": "0d2372f66e72cd334751ad39f9577686"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215388",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae5c-34a0-452a-a6db-4e3202de0b81",
|
|
|
|
|
"value": "3c792497664d6244ed4593d7c1a7ff47706aae24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215388",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae5c-4bec-443e-a8ff-4c7c02de0b81",
|
|
|
|
|
"value": "4694e19504a1bbc0335c213bad487727ab75faab3bf29d92cb7e3d14a2d3a8d0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215389",
|
|
|
|
|
"uuid": "78ef6597-c29d-407c-90da-5c9ac51c0d20",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215389",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae5d-4bb0-446c-9983-408f02de0b81",
|
|
|
|
|
"value": "2018-02-19T04:56:53"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215389",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae5d-15a8-4996-8d17-47c002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4694e19504a1bbc0335c213bad487727ab75faab3bf29d92cb7e3d14a2d3a8d0/analysis/1519016213/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215389",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae5d-11e4-48c1-b92a-428002de0b81",
|
|
|
|
|
"value": "12/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215392",
|
|
|
|
|
"uuid": "2b1058c5-64f7-4e3b-a392-29bf82262d28",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "2b1058c5-64f7-4e3b-a392-29bf82262d28",
|
|
|
|
|
"referenced_uuid": "d46ebad3-0ea9-4fa6-9449-2ed4fd77bda5",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-046c-4470-8a7d-49e902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae5e-a064-4fed-8b99-4d0e02de0b81",
|
|
|
|
|
"value": "7cdaf947fdcd6dbfc03f975a77d4a12d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae5e-592c-44d8-8217-491402de0b81",
|
|
|
|
|
"value": "3415c7bfc040b417006f5f4ca6dea6080a19348a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae5e-ac5c-46e2-b246-413202de0b81",
|
|
|
|
|
"value": "e5d34b53cb6e4e111e167cf13b608b87f7ab7d43d7f08f995ae9f2c1139e8f51"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215391",
|
|
|
|
|
"uuid": "d46ebad3-0ea9-4fa6-9449-2ed4fd77bda5",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae5f-c3bc-4e4e-bab9-4b2f02de0b81",
|
|
|
|
|
"value": "2017-10-20T04:39:40"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae5f-9cb4-47b1-bd2b-42fb02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e5d34b53cb6e4e111e167cf13b608b87f7ab7d43d7f08f995ae9f2c1139e8f51/analysis/1508474380/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae60-c144-441d-a561-40ae02de0b81",
|
|
|
|
|
"value": "47/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215395",
|
|
|
|
|
"uuid": "a2904375-8986-41ef-b6b7-4cafbad88a0e",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "a2904375-8986-41ef-b6b7-4cafbad88a0e",
|
|
|
|
|
"referenced_uuid": "dd8685d4-ae68-4e10-9a02-4ff2a38bd092",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-6a3c-46a6-a969-4db202de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215392",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae60-70b4-45e3-92a6-4ac302de0b81",
|
|
|
|
|
"value": "0be9f7aa72c6ad4e138282ebb971ef16"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215392",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae60-6920-4eab-9725-4f5802de0b81",
|
|
|
|
|
"value": "48b053a220182e475659502d1cacd4c30d50ee87"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215393",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae61-8934-4dab-b7d5-45e202de0b81",
|
|
|
|
|
"value": "a0365a881396fa66719255cd617e5ef7e175343f28b7ee7ec347bf87811274c0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215393",
|
|
|
|
|
"uuid": "dd8685d4-ae68-4e10-9a02-4ff2a38bd092",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae61-f448-4c57-88b1-450002de0b81",
|
|
|
|
|
"value": "2017-12-03T14:18:18"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae61-2700-4535-9534-41a002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a0365a881396fa66719255cd617e5ef7e175343f28b7ee7ec347bf87811274c0/analysis/1512310698/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae62-3c64-433f-ac73-442302de0b81",
|
|
|
|
|
"value": "29/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215397",
|
|
|
|
|
"uuid": "61c11e5f-54fb-43cc-9485-ccf4f7f6c41a",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "61c11e5f-54fb-43cc-9485-ccf4f7f6c41a",
|
|
|
|
|
"referenced_uuid": "23867c24-4af9-4a2f-bedc-dda5c1b39c75",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-1424-4b25-bf0b-4d2902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae62-3850-40d9-9490-4d0402de0b81",
|
|
|
|
|
"value": "d0fdb7548795050ae3e7b4029b3e98f1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae62-f2f4-430a-ac52-41eb02de0b81",
|
|
|
|
|
"value": "efd6815a6099d4d3a5f4e549bff436baa3be470a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215395",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae63-4704-443e-9372-404002de0b81",
|
|
|
|
|
"value": "fa8c301685d5ceb6a97b75f3bb665871e3ddf5b47410179dd7a55f4f3cebf4ab"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215395",
|
|
|
|
|
"uuid": "23867c24-4af9-4a2f-bedc-dda5c1b39c75",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae63-0ef4-4a38-a8f6-475802de0b81",
|
|
|
|
|
"value": "2017-12-10T18:42:31"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae64-d6c0-471b-84b9-4ca902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/fa8c301685d5ceb6a97b75f3bb665871e3ddf5b47410179dd7a55f4f3cebf4ab/analysis/1512931351/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae64-5600-48f5-a8ba-4d6e02de0b81",
|
|
|
|
|
"value": "37/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215399",
|
|
|
|
|
"uuid": "964d2d64-c17a-4c3e-91bd-80776bc6644f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "964d2d64-c17a-4c3e-91bd-80776bc6644f",
|
|
|
|
|
"referenced_uuid": "6c20a0c5-39a6-49c9-aaf2-9fb0b1938633",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-86d8-4bca-8d7e-424902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae64-c2ec-4188-b1b7-4ddc02de0b81",
|
|
|
|
|
"value": "0dceec9a6b080d4bd9d14696259386c9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae64-a76c-4c02-8c51-401602de0b81",
|
|
|
|
|
"value": "fe6672e154b70441b6d144ede426012cffec2e02"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae65-ec6c-4b5a-aa0e-495e02de0b81",
|
|
|
|
|
"value": "444147472ba54f1f58776a84e98152ae28dfbca23602cb440a830fddd4a283cf"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215397",
|
|
|
|
|
"uuid": "6c20a0c5-39a6-49c9-aaf2-9fb0b1938633",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae65-3d00-4242-8484-48ba02de0b81",
|
|
|
|
|
"value": "2017-10-20T04:30:04"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae66-1118-44c2-8463-414d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/444147472ba54f1f58776a84e98152ae28dfbca23602cb440a830fddd4a283cf/analysis/1508473804/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae66-a434-4cf5-959d-478202de0b81",
|
|
|
|
|
"value": "47/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215401",
|
|
|
|
|
"uuid": "9393f4f9-b9fc-416b-92bd-4c090307ae39",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "9393f4f9-b9fc-416b-92bd-4c090307ae39",
|
|
|
|
|
"referenced_uuid": "f22c7776-6135-4800-9901-5a4de6adee83",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-75c4-493b-8e96-49e202de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215398",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae66-8d7c-46e9-851d-476f02de0b81",
|
|
|
|
|
"value": "adac8ee518ffdc3d850fe66480df0d77"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215399",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae67-fd70-47e7-997f-4bb902de0b81",
|
|
|
|
|
"value": "46c92b1f400dc1af1e5563cded21a7b6d051eaec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215399",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae67-0dc8-4d70-a089-4ba702de0b81",
|
|
|
|
|
"value": "11117fe96292e5d5702f2c82e4b21c3cbc4234f13417b22ad963a9f746978482"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215399",
|
|
|
|
|
"uuid": "f22c7776-6135-4800-9901-5a4de6adee83",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215399",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae67-ea44-4f97-864b-4c9602de0b81",
|
|
|
|
|
"value": "2018-02-16T23:32:50"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215400",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae68-f8fc-4ea9-a17b-436502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/11117fe96292e5d5702f2c82e4b21c3cbc4234f13417b22ad963a9f746978482/analysis/1518823970/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215400",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae68-0a70-4d7d-9635-474302de0b81",
|
|
|
|
|
"value": "35/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215403",
|
|
|
|
|
"uuid": "c97afdae-f971-4e34-8ce8-c3f0151f6e38",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "c97afdae-f971-4e34-8ce8-c3f0151f6e38",
|
|
|
|
|
"referenced_uuid": "395fc03d-627f-47dd-a7db-71cf2e558e15",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-d7ac-4ca4-b52b-4b8b02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215400",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae68-1478-4b12-95ae-4f6e02de0b81",
|
|
|
|
|
"value": "0b2e3b4b0f7966745eab9308f9c7f563"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215401",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae69-5d0c-4cf6-93d6-41c802de0b81",
|
|
|
|
|
"value": "1ec05f2f0fd5cadb5ebd4d85d50989f69ad08661"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215401",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae69-67e8-4937-93b1-4ef802de0b81",
|
|
|
|
|
"value": "66af9dc27feb2b69729b82e4076dd699cc504c3c8dce943d2023c7bdeca00f2a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215402",
|
|
|
|
|
"uuid": "395fc03d-627f-47dd-a7db-71cf2e558e15",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215402",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae6a-5110-4eeb-ba12-421802de0b81",
|
|
|
|
|
"value": "2018-02-19T01:08:06"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215402",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae6a-c9e4-4967-84f1-4bea02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/66af9dc27feb2b69729b82e4076dd699cc504c3c8dce943d2023c7bdeca00f2a/analysis/1519002486/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215403",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae6b-680c-4667-8f1f-472702de0b81",
|
|
|
|
|
"value": "9/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215406",
|
|
|
|
|
"uuid": "e1867223-f5e0-4877-a819-9612307f3867",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "e1867223-f5e0-4877-a819-9612307f3867",
|
|
|
|
|
"referenced_uuid": "c3feebd9-263b-4900-a98c-8bec8b9440f8",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-1b3c-4b90-a66b-4db402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215403",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae6b-eb84-4643-9d18-4c1802de0b81",
|
|
|
|
|
"value": "818a695c9bf2b107c4394695a2f57528"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215403",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae6b-7bac-46b4-81ed-49cb02de0b81",
|
|
|
|
|
"value": "8fbf05caf42e5618cadb0343bcf4b249e33ceb22"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215403",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae6b-6de4-43fc-b81e-450e02de0b81",
|
|
|
|
|
"value": "431e6a8252837a5e1c7c98aa9b72c1df4b21e34ae8c7e73882294097f140466e"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215404",
|
|
|
|
|
"uuid": "c3feebd9-263b-4900-a98c-8bec8b9440f8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215404",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae6c-27e0-43fa-8aca-44f702de0b81",
|
|
|
|
|
"value": "2017-10-26T13:08:06"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215404",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae6c-5a44-45e1-9c82-496d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/431e6a8252837a5e1c7c98aa9b72c1df4b21e34ae8c7e73882294097f140466e/analysis/1509023286/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215405",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae6d-7d7c-4776-96b8-422502de0b81",
|
|
|
|
|
"value": "55/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215408",
|
|
|
|
|
"uuid": "b805ea51-f04a-4f6a-8ecf-c9ec51fa83cb",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "b805ea51-f04a-4f6a-8ecf-c9ec51fa83cb",
|
|
|
|
|
"referenced_uuid": "15222292-8bfb-4e86-91fa-b0e4ec0adc58",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-c11c-4278-8b81-497202de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215405",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae6d-bfc8-41d4-91cc-400d02de0b81",
|
|
|
|
|
"value": "feaa9e91b65701090f24d63b6454206a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215405",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae6d-c990-4ad0-b93b-456c02de0b81",
|
|
|
|
|
"value": "074e44100027996f616253eefe6ae4185b585899"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215406",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae6e-6cd0-4d33-b532-460a02de0b81",
|
|
|
|
|
"value": "7c83266775aceac7e54b9d7db2620245520a52e854a5e61f5c5f2452a60432de"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215406",
|
|
|
|
|
"uuid": "15222292-8bfb-4e86-91fa-b0e4ec0adc58",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215406",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae6e-64d8-4c6d-b94b-497902de0b81",
|
|
|
|
|
"value": "2017-11-20T04:33:23"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215407",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae6f-59b0-49b8-8d07-4f0602de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7c83266775aceac7e54b9d7db2620245520a52e854a5e61f5c5f2452a60432de/analysis/1511152403/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215407",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae6f-012c-4be2-ad51-487802de0b81",
|
|
|
|
|
"value": "53/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215410",
|
|
|
|
|
"uuid": "eb42f6f1-2c60-490e-8e04-79cdc4144a37",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "eb42f6f1-2c60-490e-8e04-79cdc4144a37",
|
|
|
|
|
"referenced_uuid": "8c0ecebc-54db-4732-b8e6-8a3e388aadaf",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215465",
|
|
|
|
|
"uuid": "5ad9aea9-e780-4924-99bb-48c702de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215407",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae6f-32a4-4a83-9904-4cdb02de0b81",
|
|
|
|
|
"value": "4633642e88630f65f9661d0117535446"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215407",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae6f-0600-4194-bde1-454002de0b81",
|
|
|
|
|
"value": "9d47f46a1e364eda6b2ead54e22a9ffc61111027"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215408",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae70-68b0-4edc-b67f-478702de0b81",
|
|
|
|
|
"value": "61cb5cbccb6d1c329cb1a641c3a74fd4a4521dee0d2d03e810f3f12303e0f1f1"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215408",
|
|
|
|
|
"uuid": "8c0ecebc-54db-4732-b8e6-8a3e388aadaf",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215408",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae70-31f4-4257-bf6e-4a5302de0b81",
|
|
|
|
|
"value": "2017-11-01T07:00:55"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215409",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae71-07b8-4652-a918-492f02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/61cb5cbccb6d1c329cb1a641c3a74fd4a4521dee0d2d03e810f3f12303e0f1f1/analysis/1509519655/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215409",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae71-837c-44e7-be71-447902de0b81",
|
|
|
|
|
"value": "45/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215412",
|
|
|
|
|
"uuid": "7967e5b8-00eb-4320-9412-e01a082c07ec",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "7967e5b8-00eb-4320-9412-e01a082c07ec",
|
|
|
|
|
"referenced_uuid": "7300f602-1abc-44a4-9093-a7e2165d7a91",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-997c-4a8f-b9eb-403002de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215409",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae71-ca5c-482e-a130-4bc302de0b81",
|
|
|
|
|
"value": "02ec2f2d6b01680a83378bd6c6c8144a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215410",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae72-8c0c-4588-aa56-461702de0b81",
|
|
|
|
|
"value": "a1f3c47e5ffde75e7285b6bd891b4c8336dd39cc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215410",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae72-bf60-4a23-8acd-4c2602de0b81",
|
|
|
|
|
"value": "a677a593cebda3734ab26828b65fd93b54bbc02199a080a26da61afcff29ae48"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215410",
|
|
|
|
|
"uuid": "7300f602-1abc-44a4-9093-a7e2165d7a91",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215411",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae73-7520-4e12-8f4f-4a5202de0b81",
|
|
|
|
|
"value": "2017-12-08T17:27:25"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215411",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae73-6c3c-43e0-a30d-432302de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a677a593cebda3734ab26828b65fd93b54bbc02199a080a26da61afcff29ae48/analysis/1512754045/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215411",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae73-f608-4a44-97ad-4bc802de0b81",
|
|
|
|
|
"value": "33/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215414",
|
|
|
|
|
"uuid": "6007d8cd-f034-477a-9e08-2fd715e5e884",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "6007d8cd-f034-477a-9e08-2fd715e5e884",
|
|
|
|
|
"referenced_uuid": "27e7462f-edef-4bff-b8fc-d526b1399b40",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-72f4-4889-9071-418502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215411",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae73-39c4-45a6-b3fd-48d802de0b81",
|
|
|
|
|
"value": "aebe8f53070a8e5687641789666e9482"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215412",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae74-23d8-4c12-be70-413402de0b81",
|
|
|
|
|
"value": "50f9f2eae65ccb06723a3f470ebf338978b23277"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215412",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae74-6bb8-44e3-8988-425f02de0b81",
|
|
|
|
|
"value": "97702356739358d428d1e7c7ddcc8aa08379562b290edb12348cae2bc0ddbb32"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215413",
|
|
|
|
|
"uuid": "27e7462f-edef-4bff-b8fc-d526b1399b40",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215413",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae75-b3d0-4c40-8ed8-4c1d02de0b81",
|
|
|
|
|
"value": "2018-03-27T08:43:40"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215413",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae75-6744-4ff7-a920-431502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/97702356739358d428d1e7c7ddcc8aa08379562b290edb12348cae2bc0ddbb32/analysis/1522140220/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215413",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae75-aabc-43b6-898a-4e0f02de0b81",
|
|
|
|
|
"value": "52/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215416",
|
|
|
|
|
"uuid": "04a6579c-e5e5-4b9f-8941-c896ddbea402",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "04a6579c-e5e5-4b9f-8941-c896ddbea402",
|
|
|
|
|
"referenced_uuid": "3c579ecb-1bdd-491f-bcae-9aeb77253f1d",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-1f2c-41d9-9b9f-425b02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215414",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae76-e868-489b-9651-428702de0b81",
|
|
|
|
|
"value": "107fac484f2ba8f2b8b80a52a8631707"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215414",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae76-be5c-4de5-ab60-476402de0b81",
|
|
|
|
|
"value": "c50ab16bb0fa34aead71090ccfbe0d5f5556cfbd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215414",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae76-57e8-4e89-baec-450802de0b81",
|
|
|
|
|
"value": "39974f2161bc0151692ae2f380d38b626f2b47904f92ce5706e29b2fe05122d3"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215415",
|
|
|
|
|
"uuid": "3c579ecb-1bdd-491f-bcae-9aeb77253f1d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215415",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae77-3804-4787-b417-435d02de0b81",
|
|
|
|
|
"value": "2018-02-18T16:45:10"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215415",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae77-abc4-4402-a2b3-49ed02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/39974f2161bc0151692ae2f380d38b626f2b47904f92ce5706e29b2fe05122d3/analysis/1518972310/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215416",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae78-8190-4174-80d1-4ebb02de0b81",
|
|
|
|
|
"value": "11/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215419",
|
|
|
|
|
"uuid": "95c00602-db58-40f5-91c5-3b5abeb62f34",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "95c00602-db58-40f5-91c5-3b5abeb62f34",
|
|
|
|
|
"referenced_uuid": "5ef6db2d-f867-495b-9515-aee0b0c69572",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-004c-4c0d-a0ef-487002de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215416",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae78-f0d0-488a-8732-4c6802de0b81",
|
|
|
|
|
"value": "1c4badb1eb960a07ddacdeeed29c2d6d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215416",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae78-5c5c-45f9-a6bd-40e902de0b81",
|
|
|
|
|
"value": "7cce23ad0e776f6d9bc4429cd657f164a589c948"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215416",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae78-1d7c-4fad-84ab-42f202de0b81",
|
|
|
|
|
"value": "a32a315ae45f62d26cdd22281a69932c83f147fc4e820a9cc7bf05bcc4680777"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215417",
|
|
|
|
|
"uuid": "5ef6db2d-f867-495b-9515-aee0b0c69572",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215417",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae79-01f8-4fd6-aff0-499a02de0b81",
|
|
|
|
|
"value": "2017-12-06T15:11:35"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215417",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae79-3330-4aa2-9567-4a2c02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a32a315ae45f62d26cdd22281a69932c83f147fc4e820a9cc7bf05bcc4680777/analysis/1512573095/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215418",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae7a-ac20-437d-aa5d-45e902de0b81",
|
|
|
|
|
"value": "29/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215421",
|
|
|
|
|
"uuid": "927a32d1-3581-4660-a7cb-b3b983b1d2b6",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "927a32d1-3581-4660-a7cb-b3b983b1d2b6",
|
|
|
|
|
"referenced_uuid": "f5e79c89-6ae1-40b3-8d64-7ccc44962818",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-d80c-4f90-a1fe-46df02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215418",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae7a-91c0-45a8-b38f-451302de0b81",
|
|
|
|
|
"value": "cff98f9196a16ae1aeb0fdba17121232"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215418",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae7a-cfb0-4891-ba78-40b502de0b81",
|
|
|
|
|
"value": "0f877673d6c362ebdf418e38143c5817c24917d0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215419",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae7b-1b64-4f59-81b0-4d1c02de0b81",
|
|
|
|
|
"value": "b4e2b99c18bf61acedaff5b1908a212470eb902ddfe8e164e01ffcfbab19834b"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215419",
|
|
|
|
|
"uuid": "f5e79c89-6ae1-40b3-8d64-7ccc44962818",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215419",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae7b-7a30-49f5-9b48-41ac02de0b81",
|
|
|
|
|
"value": "2017-12-26T03:58:13"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215419",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae7b-6f00-437e-a64f-445502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b4e2b99c18bf61acedaff5b1908a212470eb902ddfe8e164e01ffcfbab19834b/analysis/1514260693/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215420",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae7c-6f40-4ee6-8603-44d902de0b81",
|
|
|
|
|
"value": "37/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215423",
|
|
|
|
|
"uuid": "33ada061-a11c-4b80-bfe1-2a219c8b4216",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "33ada061-a11c-4b80-bfe1-2a219c8b4216",
|
|
|
|
|
"referenced_uuid": "4d75191a-9322-46a4-8bb1-28edd400300e",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-fc5c-4086-b9d1-46af02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215420",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae7c-29cc-4f30-bf8c-465402de0b81",
|
|
|
|
|
"value": "05bef52c0d184f19d99d55e90aa2a40f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215420",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae7c-c780-4c4b-a83e-45e302de0b81",
|
|
|
|
|
"value": "052c2631b3af54323f2514827b1413084fdaa62f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215421",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae7d-f21c-4ee2-beb8-44c702de0b81",
|
|
|
|
|
"value": "bc782f40d16fd6574c1e84edd0728470f426a31d2ff94e4bbb87a19cf3992048"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215421",
|
|
|
|
|
"uuid": "4d75191a-9322-46a4-8bb1-28edd400300e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215421",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae7d-5088-4dfc-9929-4ede02de0b81",
|
|
|
|
|
"value": "2018-02-20T17:54:27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215422",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae7e-9de8-40c7-9a5d-4f7302de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/bc782f40d16fd6574c1e84edd0728470f426a31d2ff94e4bbb87a19cf3992048/analysis/1519149267/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215422",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae7e-1948-452d-906e-491302de0b81",
|
|
|
|
|
"value": "30/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215425",
|
|
|
|
|
"uuid": "231da622-eca5-46f9-8b3d-7a60271bbf5a",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "231da622-eca5-46f9-8b3d-7a60271bbf5a",
|
|
|
|
|
"referenced_uuid": "d8b83106-c718-4884-bc69-e1ec3157b231",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-27b4-4a97-86bd-4b1502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215422",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae7e-2ad0-4bec-94c4-4a9a02de0b81",
|
|
|
|
|
"value": "d0f9b66595164fd1c9dac24d60feeba3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215422",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae7e-1fe4-49f0-8a50-414a02de0b81",
|
|
|
|
|
"value": "637fd31d870fda81f19378df838bf639dcfd3492"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215423",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae7f-cc0c-4094-a237-4bb802de0b81",
|
|
|
|
|
"value": "9c6def0cb6963372a10888e6f702d80381559a29db1da32ab149273b3d10ca34"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215423",
|
|
|
|
|
"uuid": "d8b83106-c718-4884-bc69-e1ec3157b231",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215423",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae7f-2a24-4506-a49f-459f02de0b81",
|
|
|
|
|
"value": "2017-10-25T01:58:13"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215424",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae80-3124-45f5-b863-459a02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9c6def0cb6963372a10888e6f702d80381559a29db1da32ab149273b3d10ca34/analysis/1508896693/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215424",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae80-d2a0-4d79-8ea4-419102de0b81",
|
|
|
|
|
"value": "52/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215427",
|
|
|
|
|
"uuid": "900b2299-4d91-4311-8eb6-3d8dcde3c53e",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "900b2299-4d91-4311-8eb6-3d8dcde3c53e",
|
|
|
|
|
"referenced_uuid": "ba9454c8-868b-4c61-99a5-7f1c6eaba02e",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-c734-41ad-a763-41c602de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215424",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae80-8c9c-4cfa-bdc3-4dd802de0b81",
|
|
|
|
|
"value": "5d02896f184bdc95400b10d02227177c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215425",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae81-c6b4-49df-9448-4b1802de0b81",
|
|
|
|
|
"value": "a129959a7e2b279273942088665fbebf521c2a1c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215425",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae81-61c4-4472-b473-4afe02de0b81",
|
|
|
|
|
"value": "e9bcf85599744033e320f5031ecc8157e0498a42d699cb175d7242c95b9f4358"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215425",
|
|
|
|
|
"uuid": "ba9454c8-868b-4c61-99a5-7f1c6eaba02e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215425",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae81-ac90-4144-a381-4dbc02de0b81",
|
|
|
|
|
"value": "2017-11-01T14:22:53"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215426",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae82-71d4-4701-9c9c-4a0002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e9bcf85599744033e320f5031ecc8157e0498a42d699cb175d7242c95b9f4358/analysis/1509546173/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215426",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae82-f644-4a06-b8f4-4e2402de0b81",
|
|
|
|
|
"value": "41/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215429",
|
|
|
|
|
"uuid": "123260f2-c093-487a-8da6-0a38a26956b0",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "123260f2-c093-487a-8da6-0a38a26956b0",
|
|
|
|
|
"referenced_uuid": "52bb8f52-813c-42b9-b810-935626ee2a80",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-d4dc-455b-8f0d-4c3902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215426",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae82-0b5c-4eaf-99fb-4bda02de0b81",
|
|
|
|
|
"value": "057f0c2b9a3377366ea36bc8f4454b40"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215427",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae83-f21c-4b0b-bda4-4e6d02de0b81",
|
|
|
|
|
"value": "9c385db869ef98dbe7df24e509f336d2307504c1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215427",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae83-0530-47e5-aa01-477602de0b81",
|
|
|
|
|
"value": "1d70d1eb3210984b8d2c3c62ca6ade7b018f44688d009cbde3c2c214224a3ffb"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215428",
|
|
|
|
|
"uuid": "52bb8f52-813c-42b9-b810-935626ee2a80",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215428",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae84-fb88-4f10-a31d-427b02de0b81",
|
|
|
|
|
"value": "2018-02-20T19:59:05"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215428",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae84-9d64-437f-92fd-453a02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/1d70d1eb3210984b8d2c3c62ca6ade7b018f44688d009cbde3c2c214224a3ffb/analysis/1519156745/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215428",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae84-5e44-4aca-9715-4aaf02de0b81",
|
|
|
|
|
"value": "30/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215431",
|
|
|
|
|
"uuid": "b9967b9a-c9d0-48cf-8c84-d7527995794e",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "b9967b9a-c9d0-48cf-8c84-d7527995794e",
|
|
|
|
|
"referenced_uuid": "bf02e3cf-264a-406b-bafe-860ff8d96eae",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-4bdc-4c30-8ff1-445202de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215429",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae85-5034-48fd-b1bf-4fd802de0b81",
|
|
|
|
|
"value": "59e614f10a687b16c08b684ffbf5c556"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215429",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae85-0324-4e90-950f-44de02de0b81",
|
|
|
|
|
"value": "239958c1d53838bee3c7559df1a4bd60333e0a3e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215429",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae85-a274-449e-946a-449802de0b81",
|
|
|
|
|
"value": "ad7c7472d980025e3edbab89988fec2d5776b4f72b0757c2b1dac54d1c991c37"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215430",
|
|
|
|
|
"uuid": "bf02e3cf-264a-406b-bafe-860ff8d96eae",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215430",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae86-10b8-4b4b-84dd-425302de0b81",
|
|
|
|
|
"value": "2018-01-07T00:34:15"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215430",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae86-b91c-48aa-bb52-4ef202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/ad7c7472d980025e3edbab89988fec2d5776b4f72b0757c2b1dac54d1c991c37/analysis/1515285255/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215431",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae87-cd30-4c96-85e7-451c02de0b81",
|
|
|
|
|
"value": "39/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215434",
|
|
|
|
|
"uuid": "1aa193f1-c768-4a16-a2cb-0c0381dba191",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "1aa193f1-c768-4a16-a2cb-0c0381dba191",
|
|
|
|
|
"referenced_uuid": "6bd8fb6f-dd9f-4d3f-aa56-e4c18e904991",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-685c-48dd-809c-4b7a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215431",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae87-e7fc-4a0b-8f7b-4be702de0b81",
|
|
|
|
|
"value": "bdaf573f5f56f4542196d69e9af17b60"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215431",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae87-f358-4fe6-8e52-480802de0b81",
|
|
|
|
|
"value": "0700816b242e950ca16e58e33f8c31d173b9371a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215431",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae87-5f94-49ab-9b66-41f202de0b81",
|
|
|
|
|
"value": "973c024f2af38334bfe80a5c1fc2f96b2215397124ff08110e3c96aa986e7440"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215432",
|
|
|
|
|
"uuid": "6bd8fb6f-dd9f-4d3f-aa56-e4c18e904991",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215432",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae88-925c-4dad-a805-4db802de0b81",
|
|
|
|
|
"value": "2017-12-06T18:52:52"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215432",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae88-c50c-4080-b3f4-419902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/973c024f2af38334bfe80a5c1fc2f96b2215397124ff08110e3c96aa986e7440/analysis/1512586372/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215433",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae89-63ac-4e9b-a6cb-475802de0b81",
|
|
|
|
|
"value": "55/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215436",
|
|
|
|
|
"uuid": "67459c2e-6974-4168-a4bb-0c94041b7a1c",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "67459c2e-6974-4168-a4bb-0c94041b7a1c",
|
|
|
|
|
"referenced_uuid": "d2ae4a97-361c-42ac-90f2-42867b1bec12",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-2480-49b5-bf98-4dd002de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215433",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae89-7384-4253-a8b5-4a6e02de0b81",
|
|
|
|
|
"value": "4e70fdc8daeb5407f94ae0fc08153a69"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215433",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae89-9fd4-47d2-b405-414902de0b81",
|
|
|
|
|
"value": "1bf33d2d59953981ceb693ae5a2c83f5050965e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215434",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae8a-14ac-4dda-b991-4e5002de0b81",
|
|
|
|
|
"value": "3ed671f4ea7e92ef0e0bf61e7bacc0b7a2a82ccea73a53e7cde66e3497a86520"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215434",
|
|
|
|
|
"uuid": "d2ae4a97-361c-42ac-90f2-42867b1bec12",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215434",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae8a-a5d0-4e20-ba24-495e02de0b81",
|
|
|
|
|
"value": "2017-10-25T01:50:11"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215434",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae8a-2fe8-4e4e-9052-4e9602de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3ed671f4ea7e92ef0e0bf61e7bacc0b7a2a82ccea73a53e7cde66e3497a86520/analysis/1508896211/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215435",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae8b-edc8-415e-bc6d-4f7f02de0b81",
|
|
|
|
|
"value": "49/63"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215438",
|
|
|
|
|
"uuid": "7ee2136a-174e-41ca-8e77-c55b330a2d7d",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "7ee2136a-174e-41ca-8e77-c55b330a2d7d",
|
|
|
|
|
"referenced_uuid": "4dcb2323-6adc-4e6f-9a4c-4da633df6bfa",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-fa28-477e-9bc6-481c02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215435",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae8b-1858-446a-9b35-454302de0b81",
|
|
|
|
|
"value": "021828ddd4e024644001a759bb4829bf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215435",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae8b-5658-4ba5-b8c5-440902de0b81",
|
|
|
|
|
"value": "ab2192f0ac57ebfb3a16062b1aad790c7acc9e96"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215436",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae8c-d1b0-4cbb-814a-469902de0b81",
|
|
|
|
|
"value": "06c65a259d7c96000fcec97a7d8c5b6c4d0c8b8e52ed1d45c934a50d0369b3eb"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215436",
|
|
|
|
|
"uuid": "4dcb2323-6adc-4e6f-9a4c-4da633df6bfa",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215436",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae8c-74ec-4a7d-a484-4f6d02de0b81",
|
|
|
|
|
"value": "2017-12-16T22:30:34"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215437",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae8d-71a0-4345-8b02-448902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/06c65a259d7c96000fcec97a7d8c5b6c4d0c8b8e52ed1d45c934a50d0369b3eb/analysis/1513463434/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215437",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae8d-a1d4-4713-b8b0-4db302de0b81",
|
|
|
|
|
"value": "59/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215440",
|
|
|
|
|
"uuid": "a558cc1a-df6e-4ddd-bd8c-694a27a2e298",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "a558cc1a-df6e-4ddd-bd8c-694a27a2e298",
|
|
|
|
|
"referenced_uuid": "ff7f2a21-2be3-447a-9137-7fd1eb8a7100",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-0000-40e1-abd1-40a202de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215437",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae8d-a438-4e4f-aabf-4e8302de0b81",
|
|
|
|
|
"value": "0bccb0c7a3e542a36ec6448c02efc415"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215438",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae8e-6848-4903-9d86-48bb02de0b81",
|
|
|
|
|
"value": "380d90a3fd1606c22c16ddc9f3b04426c37abee0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215438",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae8e-f060-4ea1-b7f5-494102de0b81",
|
|
|
|
|
"value": "a7d667e9d67d4b7db00c52572ca1e945b1aba8139dce9c647b8b9bce89ba45e0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215438",
|
|
|
|
|
"uuid": "ff7f2a21-2be3-447a-9137-7fd1eb8a7100",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215438",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae8e-29a4-457f-b45d-481b02de0b81",
|
|
|
|
|
"value": "2017-10-27T14:32:39"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215439",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae8f-f89c-431d-82b4-46ba02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a7d667e9d67d4b7db00c52572ca1e945b1aba8139dce9c647b8b9bce89ba45e0/analysis/1509114759/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215439",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae8f-2598-4825-8ef4-40ce02de0b81",
|
|
|
|
|
"value": "54/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215442",
|
|
|
|
|
"uuid": "966e7ca9-3fb4-4d2a-8c16-b8911848b40b",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "966e7ca9-3fb4-4d2a-8c16-b8911848b40b",
|
|
|
|
|
"referenced_uuid": "6b683fae-c19a-4048-a4df-87877482042a",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-5804-420f-9b41-436d02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215439",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae8f-d710-4599-8fd5-432f02de0b81",
|
|
|
|
|
"value": "30da06d9c1d3c8bd4f90256e56af0d8e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215440",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae90-1bcc-40dc-9825-46f402de0b81",
|
|
|
|
|
"value": "b13be4845ad3c6fe74719fcf13c8d69f4640c24f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215440",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae90-9358-404f-8ee5-42ac02de0b81",
|
|
|
|
|
"value": "19a5f6fc34e531409c787b00444671b44a5c11dec0dafab0e0ef699de29eea6d"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215441",
|
|
|
|
|
"uuid": "6b683fae-c19a-4048-a4df-87877482042a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215441",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae91-ed3c-42c2-96cf-422802de0b81",
|
|
|
|
|
"value": "2017-12-24T05:13:02"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215441",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae91-05d4-4b99-965d-4b3802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/19a5f6fc34e531409c787b00444671b44a5c11dec0dafab0e0ef699de29eea6d/analysis/1514092382/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Mikey-6502276-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae92-74ec-469d-ab7b-450302de0b81",
|
|
|
|
|
"value": "35/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215445",
|
|
|
|
|
"uuid": "871505a5-67b3-4e0e-a061-771e9e689bf3",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "871505a5-67b3-4e0e-a061-771e9e689bf3",
|
|
|
|
|
"referenced_uuid": "da838904-52a0-4aba-a34c-444c519ca9e9",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-9c7c-4a00-86af-464a02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae92-f294-47e8-8850-43a402de0b81",
|
|
|
|
|
"value": "ad21e171d278d27ccebfbc9b2d4d0992"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae92-c4ec-464c-9723-495c02de0b81",
|
|
|
|
|
"value": "8cdfd3e94086a82b4fc9579d7e6fbe42c0b253cb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae92-b524-4b5d-bd21-4cd102de0b81",
|
|
|
|
|
"value": "ba975d346f8f543f348e1e42f03bf50167045740b321ae6dc8a8497e608e8766"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215443",
|
|
|
|
|
"uuid": "da838904-52a0-4aba-a34c-444c519ca9e9",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae93-0bfc-44da-8f39-49ba02de0b81",
|
|
|
|
|
"value": "2017-10-30T16:49:06"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae93-d184-44b1-b0c8-493902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/ba975d346f8f543f348e1e42f03bf50167045740b321ae6dc8a8497e608e8766/analysis/1509382146/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae94-eb74-416a-8536-485702de0b81",
|
|
|
|
|
"value": "30/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215447",
|
|
|
|
|
"uuid": "b1c027bf-e678-4107-9332-782883a20df5",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "b1c027bf-e678-4107-9332-782883a20df5",
|
|
|
|
|
"referenced_uuid": "e18d455e-9797-4cfd-bc4e-7f58784671eb",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-713c-4231-aa93-49fc02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae94-97b4-4b05-bd2c-479b02de0b81",
|
|
|
|
|
"value": "01ebe810b6d69d0f6588191c333d6106"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae94-9ed8-4a21-80d0-4fe802de0b81",
|
|
|
|
|
"value": "af14fd59d99d16ff6fd967986d000bb8a773b6ba"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215445",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae95-3718-4b23-9b57-4ab802de0b81",
|
|
|
|
|
"value": "f0bfcb581935377def575a18a89290427d335c95da6781b11d1ad91711cb4a81"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215445",
|
|
|
|
|
"uuid": "e18d455e-9797-4cfd-bc4e-7f58784671eb",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae95-1f30-407a-8383-435c02de0b81",
|
|
|
|
|
"value": "2018-02-18T16:32:37"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae96-88a4-4dfb-a877-450702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f0bfcb581935377def575a18a89290427d335c95da6781b11d1ad91711cb4a81/analysis/1518971557/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae96-8874-4c70-bf40-4b4c02de0b81",
|
|
|
|
|
"value": "9/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215449",
|
|
|
|
|
"uuid": "2eaac486-82b0-49c2-8dc7-c0e0d1334bc5",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "2eaac486-82b0-49c2-8dc7-c0e0d1334bc5",
|
|
|
|
|
"referenced_uuid": "4880b0ee-33df-4e81-8a32-8f53fabe84e0",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-19ac-4f65-b131-400602de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215446",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae96-17c8-4526-9c35-4eff02de0b81",
|
|
|
|
|
"value": "bf09e291cb6a4aff8e1eab04efe7bf13"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae97-de24-4f59-a2d2-480202de0b81",
|
|
|
|
|
"value": "699171ae82700a702a02ba5cc0743f08814e4f18"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae97-d620-4faa-9a26-433102de0b81",
|
|
|
|
|
"value": "09574981553c2729c9779beee8e6007734f932a155de278eb46d9fc557c39400"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215447",
|
|
|
|
|
"uuid": "4880b0ee-33df-4e81-8a32-8f53fabe84e0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215447",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae97-ce3c-45fa-bfd8-470602de0b81",
|
|
|
|
|
"value": "2017-10-31T02:04:36"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae98-1b0c-4afa-8876-4e4202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/09574981553c2729c9779beee8e6007734f932a155de278eb46d9fc557c39400/analysis/1509415476/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae98-cc8c-4e46-aaf0-4d2c02de0b81",
|
|
|
|
|
"value": "52/67"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215451",
|
|
|
|
|
"uuid": "f74b8766-0e2c-48dd-97fe-7a6bcbd3683f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "f74b8766-0e2c-48dd-97fe-7a6bcbd3683f",
|
|
|
|
|
"referenced_uuid": "d5e5151a-6fe7-4aea-8c1b-f384641f3de1",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeaa-f33c-4a02-b97a-453402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae98-eef4-4591-a279-4da902de0b81",
|
|
|
|
|
"value": "05c9bafd172cd4832bf57ac9bc7e37c9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215449",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae99-55e0-42a3-b4ae-43ac02de0b81",
|
|
|
|
|
"value": "fcf95beedf57b54a8891eb8b1d91d9d9762e052b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215449",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae99-1210-40b0-9dac-4d5002de0b81",
|
|
|
|
|
"value": "04ead5ee82c762a26e1dc0e6a8b21c54669c771cca0291b5d41282d2e73a7fc0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215450",
|
|
|
|
|
"uuid": "d5e5151a-6fe7-4aea-8c1b-f384641f3de1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215450",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae9a-31f4-423c-a7e7-496602de0b81",
|
|
|
|
|
"value": "2018-04-01T08:09:24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215450",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae9a-1f84-4938-9069-4a2402de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/04ead5ee82c762a26e1dc0e6a8b21c54669c771cca0291b5d41282d2e73a7fc0/analysis/1522570164/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Startsurf-6502245-0",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215450",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae9a-533c-4b7c-af73-42a302de0b81",
|
|
|
|
|
"value": "48/64"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215453",
|
|
|
|
|
"uuid": "5e508395-c56b-44f3-8d8f-c27378c24948",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5e508395-c56b-44f3-8d8f-c27378c24948",
|
|
|
|
|
"referenced_uuid": "91d65c73-3c78-4c78-9b43-04795a21d2dc",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215466",
|
|
|
|
|
"uuid": "5ad9aeab-db88-4f05-b872-48e002de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215450",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae9a-bd0c-428e-9e94-406702de0b81",
|
|
|
|
|
"value": "ab282b76982e4d9dc477732a3aecd93a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215451",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae9b-b7e0-43ab-a2c2-4d0602de0b81",
|
|
|
|
|
"value": "3ee8a12b2110b21ceffb54942a0b925bc5a44c26"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215451",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae9b-a8d4-40ab-9608-4c9f02de0b81",
|
|
|
|
|
"value": "2df889657dd28f91ea10c08d5a72cf890bf142a6fb4928520ecdefcf708cc2b5"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215452",
|
|
|
|
|
"uuid": "91d65c73-3c78-4c78-9b43-04795a21d2dc",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215452",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae9c-0308-4a0e-b903-413802de0b81",
|
|
|
|
|
"value": "2017-11-30T02:21:49"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215452",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae9c-0444-43f1-808d-484602de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2df889657dd28f91ea10c08d5a72cf890bf142a6fb4928520ecdefcf708cc2b5/analysis/1512008509/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215453",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae9d-f4ec-4a77-a68d-473b02de0b81",
|
|
|
|
|
"value": "55/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215456",
|
|
|
|
|
"uuid": "ce1148cb-ccbb-4534-a264-987b0a02387e",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "ce1148cb-ccbb-4534-a264-987b0a02387e",
|
|
|
|
|
"referenced_uuid": "7b05f522-f1e9-4890-b0bc-3dcbcd58388e",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215467",
|
|
|
|
|
"uuid": "5ad9aeab-dee4-4349-82c5-4b4302de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215453",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae9d-a098-47e7-9213-41a702de0b81",
|
|
|
|
|
"value": "04b1767fc8c7576329d0d9f130570483"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215453",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae9d-a55c-43ea-808e-46ac02de0b81",
|
|
|
|
|
"value": "d564f1a814aa7ee497506900e9f6f08dac802a62"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215453",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9ae9d-a16c-4691-8302-47b402de0b81",
|
|
|
|
|
"value": "e122d91eb62a33c8b4ef56b2299caf2f58fd4e48694c97e06c92f858497cf860"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215454",
|
|
|
|
|
"uuid": "7b05f522-f1e9-4890-b0bc-3dcbcd58388e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215454",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9ae9e-f694-429e-b42d-4fd402de0b81",
|
|
|
|
|
"value": "2017-12-02T19:09:49"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215454",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9ae9e-2d60-4ad8-9350-427d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e122d91eb62a33c8b4ef56b2299caf2f58fd4e48694c97e06c92f858497cf860/analysis/1512241789/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Upatre-6498441-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215455",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9ae9f-10e0-42eb-bddd-453702de0b81",
|
|
|
|
|
"value": "59/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215458",
|
|
|
|
|
"uuid": "8ed19c62-1efa-47b5-bd86-5ce3ea96eea3",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "8ed19c62-1efa-47b5-bd86-5ce3ea96eea3",
|
|
|
|
|
"referenced_uuid": "ba0df232-2b85-4c6e-ad5f-0bf6e12cc26a",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215467",
|
|
|
|
|
"uuid": "5ad9aeab-f394-4d1c-9db6-471302de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215455",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9ae9f-9e60-49a4-9354-41db02de0b81",
|
|
|
|
|
"value": "9164bbb56803391261d42d9ee69b42da"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215455",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9ae9f-fb70-4589-9677-486b02de0b81",
|
|
|
|
|
"value": "b8aaf98dca8a84eee3bb4151fa66ae61d51e5331"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215456",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9aea0-ccb0-484b-bfdf-445602de0b81",
|
|
|
|
|
"value": "2593e0c6d66d36c7d8b3061f3c242875113310a2939f89aea73eda1397e44e31"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215456",
|
|
|
|
|
"uuid": "ba0df232-2b85-4c6e-ad5f-0bf6e12cc26a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215456",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9aea0-ef24-497a-8710-41e702de0b81",
|
|
|
|
|
"value": "2017-10-28T14:24:09"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215457",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9aea1-bf6c-46c8-a310-4f4202de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2593e0c6d66d36c7d8b3061f3c242875113310a2939f89aea73eda1397e44e31/analysis/1509200649/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Neutrinopos-6500704-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215457",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9aea1-73f4-416e-90ab-46c802de0b81",
|
|
|
|
|
"value": "40/68"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215460",
|
|
|
|
|
"uuid": "c750f8a8-1526-41bf-9e8c-3ac273664df7",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "c750f8a8-1526-41bf-9e8c-3ac273664df7",
|
|
|
|
|
"referenced_uuid": "1d1ce1a4-cf6c-4dee-83fd-c67c479b0e7b",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215467",
|
|
|
|
|
"uuid": "5ad9aeab-7b80-4ef2-b855-413c02de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215457",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9aea1-489c-499b-84c7-483f02de0b81",
|
|
|
|
|
"value": "ed1ef9158da2ef353c31613b649d906b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215457",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9aea1-02e8-4bde-9f7d-45b002de0b81",
|
|
|
|
|
"value": "3766378217eea6e7047771e0108983000c697321"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215458",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9aea2-4534-4079-9242-4a3102de0b81",
|
|
|
|
|
"value": "61ff6f5d48f02c0a5b7a28936f8aa9ebad2344f3552608fae2ce3f14a9bf14d4"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215458",
|
|
|
|
|
"uuid": "1d1ce1a4-cf6c-4dee-83fd-c67c479b0e7b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215458",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9aea2-54d8-4f03-8d4b-4d0c02de0b81",
|
|
|
|
|
"value": "2017-10-25T02:00:00"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215459",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9aea3-2c28-4930-9798-497902de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/61ff6f5d48f02c0a5b7a28936f8aa9ebad2344f3552608fae2ce3f14a9bf14d4/analysis/1508896800/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215459",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9aea3-5c50-408e-ba63-471302de0b81",
|
|
|
|
|
"value": "53/66"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "7",
|
|
|
|
|
"timestamp": "1524215462",
|
|
|
|
|
"uuid": "0b93c146-e37e-43df-8900-5c0faf08a5f5",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "0b93c146-e37e-43df-8900-5c0faf08a5f5",
|
|
|
|
|
"referenced_uuid": "066ffd6c-1f8a-4876-b8e7-4c6c950c58d8",
|
|
|
|
|
"relationship_type": "analysed-with",
|
|
|
|
|
"timestamp": "1524215467",
|
|
|
|
|
"uuid": "5ad9aeab-514c-45e4-bfa1-4e5902de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1524215459",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ad9aea3-20a8-42f1-9261-410c02de0b81",
|
|
|
|
|
"value": "4a6b63f1b4efaf59a4343f3fed896026"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1524215460",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5ad9aea4-8020-4f0c-8886-4dd002de0b81",
|
|
|
|
|
"value": "59e38dbfed36c465202cea50f908d445da969098"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1524215460",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ad9aea4-35ac-42e7-98ba-489402de0b81",
|
|
|
|
|
"value": "3f2925b26b0f0b0f141346d8a654a74704d9326492537de17518bd6fb11671e8"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "1",
|
|
|
|
|
"timestamp": "1524215460",
|
|
|
|
|
"uuid": "066ffd6c-1f8a-4876-b8e7-4c6c950c58d8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1524215460",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ad9aea4-1d30-4edb-bb10-45d702de0b81",
|
|
|
|
|
"value": "2017-10-18T15:51:50"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1524215461",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5ad9aea5-f118-412f-a4b3-490e02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3f2925b26b0f0b0f141346d8a654a74704d9326492537de17518bd6fb11671e8/analysis/1508341910/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Win.Dropper.Fareit-6500687-1",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1524215461",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ad9aea5-ed30-484a-babd-475e02de0b81",
|
|
|
|
|
"value": "50/63"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
}
|
