2023-04-21 13:25:09 +00:00
{
"Event" : {
"analysis" : "2" ,
"date" : "2018-10-02" ,
"extends_uuid" : "" ,
"info" : "OSINT - CIG Circular 66 \u00e2\u20ac\u201c FASTCash ATM Cash Out Campaign" ,
"publish_timestamp" : "1538565940" ,
"published" : true ,
"threat_level_id" : "3" ,
"timestamp" : "1538565800" ,
"uuid" : "5bb3b566-b054-436e-aabf-4bd902de0b81" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#ffffff" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#6edb00" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "circl:topic=\"finance\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
}
] ,
"Attribute" : [
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1538504180" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5bb3b5f4-4388-4cd9-b681-4aa602de0b81" ,
"value" : "Treasury has identified a sophisticated cyber-enabled ATM cash out campaign we are calling FASTCash. FASTCash has been active since late 2016 targeting banks in Africa and Asia to remotely compromise payment switch application servers within banks to facilitate fraudulent transactions, primarily involving ATMs to steal cash equivalent to tens of millions of dollars"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"data" : " J V B E R i 0 x L j U N J e L j z 9 M N C j U z N S A w I G 9 i a g 0 8 P C 9 M a W 5 l Y X J p e m V k I D E v T C A z N j A 0 O D k v T y A 1 M z c v R S A x N z Y y N j Y v T i A x M S 9 U I D M 2 M D A z N C 9 I I F s g N T I 3 I D M 3 N F 0 + P g 1 l b m R v Y m o N I C A g I C A g I C A g I C A g D Q o 1 N T k g M C B v Y m o N P D w v R G V j b 2 R l U G F y b X M 8 P C 9 D b 2 x 1 b W 5 z I D U v U H J l Z G l j d G 9 y I D E y P j 4 v R m l s d G V y L 0 Z s Y X R l R G V j b 2 R l L 0 l E W z x E N j Y x M D d B N z c z Q j V E M T Q 0 O D I y N k U y M D M y O U E w N T k z N D 48 N T k 0 O E I z R T d E M T k 3 R D c 0 N T g 5 R T E y N z V C N D E 3 R j E 2 R T M + X S 9 J b m R l e F s 1 M z U g N D d d L 0 l u Z m 8 g N T M 0 I D A g U i 9 M Z W 5 n d G g g M T E 2 L 1 B y Z X Y g M z Y w M D M 1 L 1 J v b 3 Q g N T M 2 I D A g U i 9 T a X p l I D U 4 M i 9 U e X B l L 1 h S Z W Y v V 1 s x I D M g M V 0 + P n N 0 c m V h b Q 0 K a N 5 i Y m R g E G B g Y m B g L g W R j D P A 5 B w Q y b E R R D L J g 2 U r Q C R L H J j 8 C y a 1 w C p 1 w W x W M P k U r F 4 G z L 4 N J j N A J C v Y B E Z l E M k V B S I Z Q k E k / 2 s Q m d o A J B m r t o D Z J 4 D k / 5 w F D E y M D E z L w C o Z G A e A / M / A 8 P U N Q I A B A E w m E n E N C m V u Z H N 0 c m V h b Q 1 l b m R v Y m o N c 3 R h c n R 4 c m V m D Q o w D Q o l J U V P R g 0 K I C A g I C A g I C A g D Q o 1 O D E g M C B v Y m o N P D w v Q y A z M D k v R m l s d G V y L 0 Z s Y X R l R G V j b 2 R l L 0 k g M z M z L 0 x l b m d 0 a C A y O D U v U y A y M j c + P n N 0 c m V h b Q 0 K a N 5 i Y G B g A q L l D K w M D M K M D E I M C C D E w A I U Z W H g W O D G 0 K D A w b Q s m s H n a / Y d 1 n r G 50 B Z f g N G P W Z 9 h 78 f Z D h O 15 y 8 e b 0 B p q 2 j w n o + x 6 l E g T s / f Z T k 9 M q d j O Y 2 K T 56 V f z U O g D I f e l 3 U O B j 8 c 4 P P c s T 5 j i X K G u 2 P J I T e X 7 I a C 6 T 4 s 5 P M 1 x s L D / N Y G C O 6 O j o Y G C Q 6 O h o Y A Y y W F z B X D Y w y d H R w M B o A W Y C p R k Y N E B M k C A Q 43 Q e k C f L w M r C C 6 T F g F g S 7 M p Q B k G G x Y 3 X G S w d l A w U P P g W s K 9 i u M F 4 g + E J g 8 U D i w S F G f w a j H O 4 g E H C v L S n N X 3 q Z + 0 5 u S 29 l x h 3 M i n C v K n A w B r 4 E U g D 1 U h / Z Q A F I u s B B y C t z s B a m w m k G Y H 4 F 0 C A A Q D a G 1 z t D Q p l b m R z d H J l Y W 0 N Z W 5 k b 2 J q D T U z N i A w I G 9 i a g 0 8 P C 9 M Y W 5 n K P 7 / A E U A T g A t A F U A U y k v T W F y a 0 l u Z m 88 P C 9 N Y X J r Z W Q g d H J 1 Z T 4 + L 0 1 l d G F k Y X R h I D M 3 I D A g U i 9 Q Y W d l T G F 5 b 3 V 0 L 0 9 u Z U N v b H V t b i 9 Q Y W d l c y A 1 M z E g M C B S L 1 N 0 c n V j d F R y Z W V S b 290 I D c 1 I D A g U i 9 U e X B l L 0 N h d G F s b 2 c + P g 1 l b m R v Y m o N N T M 3 I D A g b 2 J q D T w 8 L 0 F u b m 90 c y A 1 N j A g M C B S L 0 N v b n R l b n R z W z U 0 M S A w I F I g N T Q y I D A g U i A 1 N D M g M C B S I D U 0 N S A w I F I g N T Q 2 I D A g U i A 1 N D g g M C B S I D U 0 O S A w I F I g N T U w I D A g U l 0 v Q 3 J v c E J v e F s w L j A g M C 4 w I D Y x M i 4 w I D c 5 M i 4 w X S 9 N Z W R p Y U J v e F s w L j A g M C 4 w I D Y x M i 4 w I D c 5 M i 4 w X S 9 Q Y X J l b n Q g N T M y I D A g U i 9 S Z X N v d X J j Z X M 8 P C 9 D b 2 x v c l N w Y W N l P D w v Q 1 M w I D U 2 M i A w I F I v Q 1 M x I D U 2 M y A w I F I + P i 9 F e H R H U 3 R h d G U 8 P C 9 H U z A g N T Y 0 I D A g U j 4 + L 0 Z v b n Q 8 P C 9 D M l 8 w I D U 2 O S A w I F I v V F Q w I D U 3 M S A w I F I v V F Q x I D U 3 M y A w I F I v V F Q y I D U 3 N S A w I F I v V F Q z I D U 3 N y A w I F I v V F Q 0 I D U 3 O S A w I F I + P i 9 Y T 2 J q Z W N 0 P D w v S W 0 w I D U 1 O C A w I F I + P j 4 + L 1 J v d G F 0 Z S A w L 1 N 0 c n V j d F B h c m V u d H M g M C 9 U Y W J z L 1 M v V H l w Z S 9 Q Y W d l P j 4 N Z W 5 k b 2 J q D T U z O C A w I G 9 i a g 0 8 P C 9 G a W x 0 Z X I v R m x h d G V E Z W N v Z G U v R m l y c 3 Q g M T c 0 L 0 x l b m d 0 a C A x O D c w L 0 4 g M j E v V H l w Z S 9 P Y m p T d G 0 + P n N 0 c m V h b Q 0 K a N 7 E W G 1 P G z k Q / i v + W F T B + t 27 p y p S E k o b q R R K 4 L g 7 x I e F b G H V k K B k e 5 R / f z P j l + y G B F q k u 1 M 0 s d c e z 4 w 945 l n 11 j O O D N W s A L + J R P a Q K u Y s B p a z U S u o D V M O p y 3 T C k B r W P G I V / O n M T n g j k F U h x n O a 53 g g m e g w A H A o 3 C D k h 0 F l k 0 k 4 W 0 t F 4 J A 0 I d C H U C p x x T h c C p n B n u s A P T S s B T D t O 51 O w C D e X s 5 P L d u 6 x P w / C Q D c b w O I b f 6 e N 9 l Q 3 m i 0 m 1 y M 4 Z 7 / X C w w X y 8 c v s Y z b K T q r r 5 g K s 21 O w K 23 y P S M E k 7 n a k 1 w z 7 c R e o Y r L b N w s v l 83 x + W i m j V M Z O P v V w 3 K / l T P v n k t / d l s 3 v R 6 F 9 l o O B y U y 2 r C j P G m d Y Z k s n Y 0 Z l / L 6 R L s O 8 w + z x d 35 T Q b 9 p n Y 49 n R c Z g 5 O j 5 E X X 0 G y q t s f F g u v w H r r P I a 3 / 9 o P o y b s q m y 65 L W z e / 9 u l 4 P 5 B / h P u v Z z Z v R B E y u m 8 c d 2 O l N v W w W j 2 / 6 k / l V t Q O b u L + f V n e 4 I 0 5 r + s t r 2 h 7 n J h u O 9 s d V A x Y r O t J h e f + x q m 9 u G + Y 4 z / Y r z 7 k r J c 8 O p u X N k u n s Y D 5 r B o P 5 D z h c H G d C C E W y L m n q o L y r p 49 v x o 93 V / P p j h + q p 5 U E F Z p U 4 M j n 8 q 7 K z g e D w d m X t 57 z 8 J Q m 4 P y r 5 v o 2 n h Q O n X t 7 N N g z a s p p f d 2 f 3 U w r x s F X 1 d 3 v z B l / T M i K 9 i 7 q + 2 a + y P 4 I 2 z D c 7 x k d g y x P t O I B P C 5 B 1 G j 2 d U 4 h T + c w 2 j + d f x j t H 5 b 3 W T z Z b P 8 c 98 n X V N H 1 w D U x W G A t c q B V c m V b d n 4 h J L / Q l l 9 e Q v z g X Q o h s t U 0 f / y T E k 4 Q p p d 0 71 D R + 9 n 1 f A I + T 5 b t f k z K U R / P T u d n s x q Y K m a 0 P / V k R z c C V N F y u V V y 5 X L F b X A 5 j C a f 7 x p R 0 B w T U n M S 0 H H 7 E B x 0 t a i 7 f j d d v 48 P h q M v f 74 N r L u D + X T y g u / d F t + D D c 86 X z v Z d f 4 m 1 e k 0 z + t Z f 7 a s 0 / N B v V g 2 w 9 t y E U + g 7 X P n U 9 C n M r A I K V c + g G t M Z r X c o I q u G 0 D b p L l d X k i J w b P p J w 16 W 1 K c + B 8 k x / Q f W + m 66 y 24 B p O l k Q X 4 k z O d 55 D t s O + A R J K n p W I 5 J G W L c 5 h z l a R 6 o O D Q g A o D M 1 A B C q g P K N G g x H U L d Q E Z H u R q T N X Q G q 4 g t 1 u Q 4 M e l R t s 0 Z G v s 5 Z A m i E s F b i A F s a G K g i n t n 1 G 304 Y s R i m q c J f d g N W 8 H b C 2E7 A u B q x u B y x c G p x j k O c t C e g E 7 G l 9 V y 3 Z 5 + q B n c z v y t n O K k x p B i Z o / H j 86 g S V 8 + d j V O f d G H 2 q 9 y c i 9 G l S c r I b o N K Y D Q G 6 H o 4 O a v D / S d J w g B o Q g B y x A C f K 4 R n n R O 7 n k G g O Y E r k x 1 a 61 Z q X C H m J P 8 A d J A 2 p s g B Y 46 S E y H J E 1 A e g Y I y l P h L Z k B d p L g 99 p M i H a 7 G P 83 G u A P m x j + N k N 9 h A + w U o h X Z R H / i w 327 T n t u 2 h 77 b s O 9 o Y / t M y L 7 Q R 5 l 0 M b m / o E a D P S a s D W c a + b D m d Q T 7 A W P p A X e P K 2 h H Z r U 67 o S s D 5 J p I U 4 U 6 E p c i K 7 F I z V e F f Z l S 33 H Z S 0 L E F J i 5 o t h E M f I Z B z T I B t 5 A z + C T W 1 U M o z G R T g W s y L d c t E 64 U Y p L G C j b U o y A 21 b T 8 d v t 8 v H A 0 2 u 2 U C o e 9 N 4 D I d 2 W G w l X b x 0 N d b y r b T b A Y L b C B C g C F C + D Q B B 2 p c B g u 0 C h I 9 n n 87 G Z 7 F K / 0 t p 17 p u 2 l 1 T + k p U o N d Q g e H P o g L N n 0 M F m o s V G o D E p L C + c h X Q A U a 3 h R Z u T 24 J D f w M S S i H k n A k V X C o 9 z l W c X z j w n Q D 8 W u F a a E G i H G p v B Z A f o g B N F A O d d t C O Y U C z I w g V K K V r 9 o 53 B A t 6 V 0 x L 2 B c + D G d d C J u w L 5 G n d I Q E q E W R h U 3 + C 5 G z x I Q j A T Y p I 3 v u 8 L z G + l C C 9 g B 73 m B d 9 A / a 7 D T o f 2 Y f P C + F 2 Y L u u J b U R c n P I N E l j 6 H P 5 y w r f s g z a b 7 Y O G N A u c w f / G n + K O / q M t p C 3 X Q 8 + u x R v 78 y 5 A o u k E f t b 0 O Y d h X I Q z T T b n / N c U 0 i d C T U i 5 Q T O 2 i a K V z G D O 5 T h U 6 p d e w 5 i V K / P g 9 J J J B B A r x 2 Y Y X C W 4 g V M B y j j U w 5 P E I I / J Y V 2 C c 1 g W + t C
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1538504215" ,
"to_ids" : false ,
"type" : "attachment" ,
"uuid" : "5bb3b617-5ba0-4774-9507-43fd02de0b81" ,
"value" : "CIG Circular 66 - FASTCash Campaign.pdf"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1538504582" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "5bb3b786-b320-4be2-974a-4a7a02de0b81" ,
"value" : "75.99.63.27"
} ,
{
"category" : "Network activity" ,
"comment" : "In addition to the analysis of the artifacts above, t he below IP addresses may be associated with the FASTCash Camp aign . 3 Mail servers in the compromised network made reverse proxy connections to these IPs but we do not have specific date and time stamps or other information to associate them with malicious activity :" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1538505033" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "5bb3b949-b1f4-415d-b4d3-4c1402de0b81" ,
"value" : "167.114.33.205"
} ,
{
"category" : "Network activity" ,
"comment" : "In addition to the analysis of the artifacts above, t he below IP addresses may be associated with the FASTCash Camp aign . 3 Mail servers in the compromised network made reverse proxy connections to these IPs but we do not have specific date and time stamps or other information to associate them with malicious activity :" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1538505033" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "5bb3b949-a6bc-4572-9e21-486302de0b81" ,
"value" : "180.235.133.108"
} ,
{
"category" : "Network activity" ,
"comment" : "In addition to the analysis of the artifacts above, t he below IP addresses may be associated with the FASTCash Camp aign . 3 Mail servers in the compromised network made reverse proxy connections to these IPs but we do not have specific date and time stamps or other information to associate them with malicious activity :" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1538505034" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "5bb3b94a-2574-4243-bf26-40f902de0b81" ,
"value" : "219.255.99.9"
}
] ,
"Object" : [
{
"comment" : "Themida\r\npacked 32\r\n-\r\nbit Windows executable designed to unpack itself and run a service \r\nproxy module in memory. The proxy module accepts command line parameters and is \r\ndesigned to modify the Windows Firewall on the compromised system to allow \r\nincoming connections an\r\nd function as a backdoor. The malware listens on a specified \r\nport for incoming traffic containing instructions to perform any of the following \r\nfunctions: r\r\netrieve system information; \r\nexecute command\r\ns; execute \r\nand terminate \r\nprocess\r\nes; \r\nsearch for files\r\n; read, write, and delete files\r\n; download and upload files\r\n; and, \r\ncompress and decompress files\r\n. " ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "15" ,
"timestamp" : "1538504510" ,
"uuid" : "5bb3b67c-f634-4e0b-9364-48a202de0b81" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "5bb3b67c-f634-4e0b-9364-48a202de0b81" ,
"referenced_uuid" : "5bb3b727-276c-4fd5-a23f-436d02de0b81" ,
"relationship_type" : "signed-by" ,
"timestamp" : "1538504506" ,
"uuid" : "5bb3b73a-ae98-4741-9f4a-4b3d02de0b81"
}
] ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538504316" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5bb3b67c-b8d0-4a55-bd11-45d102de0b81" ,
"value" : "5cfa1c2cb430bec721063e3e2d144feb"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "state" ,
"timestamp" : "1538504317" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5bb3b67d-3584-4e9c-8963-436e02de0b81" ,
"value" : "Malicious"
}
]
} ,
{
"comment" : "Themida packed 64\r\n-\r\nbit Windows executable with the same functionality as \r\n5cfa1c2cb430bec721063e3e2d144feb\r\n and is signed with a valid X509 certificate issues \r\nto \u00e2\u20ac\u0153A\r\n-Z Hire Ltd\u00e2\u20ac\u009d with serial number:" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "15" ,
"timestamp" : "1538504375" ,
"uuid" : "5bb3b6b7-914c-4958-9c8b-4a0502de0b81" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538504375" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5bb3b6b7-d25c-4b7c-8c9e-4e2b02de0b81" ,
"value" : "4f67f3e4a7509af1b2b1c6180a03b3e4"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "state" ,
"timestamp" : "1538504376" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5bb3b6b8-5ae4-45a2-aba0-491e02de0b81" ,
"value" : "Malicious"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "x509 object describing a X.509 certificate" ,
"meta-category" : "network" ,
"name" : "x509" ,
"template_uuid" : "d1ab756a-26b5-4349-9f43-765630f0911c" ,
"template_version" : "7" ,
"timestamp" : "1538504487" ,
"uuid" : "5bb3b727-276c-4fd5-a23f-436d02de0b81" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "x509-fingerprint-md5" ,
"timestamp" : "1538504487" ,
"to_ids" : true ,
"type" : "x509-fingerprint-md5" ,
"uuid" : "5bb3b727-0b84-428e-b85c-407702de0b81" ,
"value" : "ecafe723703614e0a4fb5c2a8f7da018"
}
]
} ,
{
"comment" : "32\r\n-\r\nbit Windows \r\nexecutable designed to execute as a service named \u00e2\u20ac\u0153helpsvcs\u00e2\u20ac\u009d. The \r\nmalware binds and listens on port 443 for incoming connections, providing remote \r\ncommand and control capabilities through this connection. The malware uses the RC4 \r\nencryption algorithm to en\r\ncrypt and decrypt a portion of its communications and has \r\nthe ability to exfiltrate data, install and run secondary payloads, and provided proxy \r\nservices on the compromised system. This malware can perform the following \r\nfunctions based on specified command\r\ns from a remote operator: retrieve system \r\ninformation\r\n; execute command\r\ns; execute \r\nand terminate process\r\nes; \r\nsearch for files\r\n; \r\nread, write, and delete files\r\n; download and upload files\r\n; compress and decompress \r\nfiles\r\n; and, change the listening port for Remove Desktop via registry modification." ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "15" ,
"timestamp" : "1538504618" ,
"uuid" : "5bb3b771-2540-4c8f-b659-4cfe02de0b81" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "5bb3b771-2540-4c8f-b659-4cfe02de0b81" ,
"referenced_uuid" : "5bb3b786-b320-4be2-974a-4a7a02de0b81" ,
"relationship_type" : "connected-to" ,
"timestamp" : "1538504615" ,
"uuid" : "5bb3b7a7-a584-491a-ba54-482302de0b81"
}
] ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538504561" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5bb3b771-b234-43b9-ab64-42be02de0b81" ,
"value" : "d0a8e0b685c2ea775a74389973fc92ca"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "state" ,
"timestamp" : "1538504561" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5bb3b771-2118-456a-92e4-448602de0b81" ,
"value" : "Malicious"
}
]
} ,
{
"comment" : "Malicious 64\r\n-\r\nbit Windows Dynamic Link Library designed to runs as a Windows services \r\nunder \u00e2\u20ac\u0153svchost.exe\u00e2\u20ac\u009d and load an RC4 decrypted payload into memory. " ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "15" ,
"timestamp" : "1538504773" ,
"uuid" : "5bb3b845-fac4-4dbf-8471-4a5e02de0b81" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538504774" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5bb3b846-1b48-4d2b-b264-463502de0b81" ,
"value" : "8efaabb7b1700686efedadb7949eba49"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "state" ,
"timestamp" : "1538504776" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5bb3b848-e21c-41e4-b3ec-4dcf02de0b81" ,
"value" : "Malicious"
}
]
} ,
{
"comment" : "AIX\r\nexecutable intended for a proprietary UNIX operating system developed by IBM. \r\nThis\r\n application injects a library into a currently running process. " ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "15" ,
"timestamp" : "1538504825" ,
"uuid" : "5bb3b879-d6e4-4962-a53c-457e02de0b81" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "filename" ,
"timestamp" : "1538504826" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5bb3b87a-6674-45e0-bb57-445c02de0b81" ,
"value" : "Injection_API_executable_e"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538504827" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5bb3b87b-2fe8-4358-a13e-4c2f02de0b81" ,
"value" : "b3efec620885e6cf5b60f72e66d908a9"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "state" ,
"timestamp" : "1538504827" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5bb3b87b-7fb4-4863-b9a2-41d302de0b81" ,
"value" : "Malicious"
}
]
} ,
{
"comment" : "AIX executable, intended for a proprietary UNIX operating system developed by IBM\r\nand is designed to update a proprietary data structure on a\r\n UNIX system known as \r\n\"PVPA.\"" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "15" ,
"timestamp" : "1538504872" ,
"uuid" : "5bb3b8a8-4274-400b-8c6b-4fb502de0b81" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "filename" ,
"timestamp" : "1538504872" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5bb3b8a8-6cd8-4d54-b880-4bd002de0b81" ,
"value" : "inject_api"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538504872" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5bb3b8a8-f4b8-49e4-b485-4e7a02de0b81" ,
"value" : "58bb2236e5aee39760d3e4fc6ee94a79"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "state" ,
"timestamp" : "1538504873" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5bb3b8a9-8660-443a-aec8-4c2502de0b81" ,
"value" : "Malicious"
}
]
} ,
{
"comment" : "AIX executable, intended for a proprietary UNIX operating system developed by IBM. \r\nThis file is a library application \r\ndesigned to provide export functions. These functions \r\nallow an application to perform transactions on financial systems using the\r\n ISO\r\n 8583 \r\nstandard." ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "15" ,
"timestamp" : "1538504922" ,
"uuid" : "5bb3b8da-0df8-4186-aeaa-497602de0b81" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "filename" ,
"timestamp" : "1538504922" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5bb3b8da-6d04-444e-9591-49d502de0b81" ,
"value" : "Lost_File1_so_file"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538504922" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5bb3b8da-d958-4516-91f6-481b02de0b81" ,
"value" : "d790997dd950bb39229dc5bd3c2047ff"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "state" ,
"timestamp" : "1538504923" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5bb3b8db-d988-4446-9077-469502de0b81" ,
"value" : "Malicious"
}
]
} ,
{
"comment" : "AIX executable, intended for a proprietary UNIX operating system developed by IBM. \r\nThe application provides several\r\n exported \r\nmethods permitting the interaction with \r\nfinancial systems that utilize the ISO\r\n 8583 standard." ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "15" ,
"timestamp" : "1538504964" ,
"uuid" : "5bb3b904-7f40-4c7d-bc43-494f02de0b81" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "filename" ,
"timestamp" : "1538504964" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5bb3b904-4fa8-417b-a116-44be02de0b81" ,
"value" : "2.so"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538504964" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5bb3b904-cc78-4c9e-b03c-4e5302de0b81" ,
"value" : "b66be2f7c046205b01453951c161e6cc"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "state" ,
"timestamp" : "1538504965" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5bb3b905-0344-45b6-ab83-4fbc02de0b81" ,
"value" : "Malicious"
}
]
} ,
{
"comment" : "COFF executable, a format for executable, object code, and shared libraries used on\r\nUNIX\r\n systems. The executable provides several exported methods that enable \r\ninteractions with financial systems utilizing the ISO \r\n8583 \r\nstandard." ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "15" ,
"timestamp" : "1538505003" ,
"uuid" : "5bb3b92b-6c04-4ccd-ae7e-48e502de0b81" ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "filename" ,
"timestamp" : "1538505003" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5bb3b92b-ca38-497f-9031-461702de0b81" ,
"value" : "Lost_File.so"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538505003" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5bb3b92b-bfcc-40b6-8e2b-406c02de0b81" ,
"value" : "46b318bbb72ee68c9d9183d78e79fb5a"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "state" ,
"timestamp" : "1538505003" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5bb3b92b-d988-460e-9e6f-431702de0b81" ,
"value" : "Malicious"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1538505125" ,
"uuid" : "dc4223ad-358d-4e78-adc2-5a96853cc541" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "dc4223ad-358d-4e78-adc2-5a96853cc541" ,
"referenced_uuid" : "dee7180d-629e-45d4-a5ac-7662d0324e21" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1538505134" ,
"uuid" : "5bb3b9af-0810-49c1-93ec-44ae02de0b81"
}
] ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538505122" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "cf970f74-c682-43aa-87ce-4b4860e9d025" ,
"value" : "b66be2f7c046205b01453951c161e6cc"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1538505122" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "0a26da24-088b-4846-839b-31fdb04c432e" ,
"value" : "ec5784548ffb33055d224c184ab2393f47566c7a"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1538505123" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "750264bb-1819-4c56-ab33-87093e6e92a4" ,
"value" : "ca9ab48d293cc84092e8db8f0ca99cb155b30c61d32a1da7cd3687de454fe86c"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1538505123" ,
"uuid" : "dee7180d-629e-45d4-a5ac-7662d0324e21" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1538505123" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "97fe9519-6d0d-4b4e-9711-2a1d84060aef" ,
"value" : "2017-11-15T12:57:52"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1538505124" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "33b603b2-e14e-4f14-975e-5c0cad9d3597" ,
"value" : "https://www.virustotal.com/file/ca9ab48d293cc84092e8db8f0ca99cb155b30c61d32a1da7cd3687de454fe86c/analysis/1510750672/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1538505124" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "aef16d9b-5ae9-467f-9a8d-2d746fd44b72" ,
"value" : "0/59"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1538505127" ,
"uuid" : "96b33272-dac7-42f2-8ea4-4c699d8361a3" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "96b33272-dac7-42f2-8ea4-4c699d8361a3" ,
"referenced_uuid" : "98df9145-7b26-40e6-b7d7-f0352dd331e5" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1538505135" ,
"uuid" : "5bb3b9af-d244-43a4-bd89-444302de0b81"
}
] ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538505124" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "453d4ef7-d21b-4937-8d19-9ccecd23073b" ,
"value" : "46b318bbb72ee68c9d9183d78e79fb5a"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1538505125" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "646da333-d6b6-4c39-9a9c-fd92ccb44cd7" ,
"value" : "5375ad3746ce42a6f262f55c4f1f0d273fb69c54"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1538505125" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "73b484f0-84f0-47ee-aa9c-293f9e8a8564" ,
"value" : "10ac312c8dd02e417dd24d53c99525c29d74dcbc84730351ad7a4e0a4b1a0eba"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1538505126" ,
"uuid" : "98df9145-7b26-40e6-b7d7-f0352dd331e5" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1538505126" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "c46d73ba-b8b1-48a2-84cc-5b31bb2ae61f" ,
"value" : "2018-10-01T18:10:22"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1538505126" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "78d2846f-b7b8-4cb7-883c-eb8c6cbbd6e2" ,
"value" : "https://www.virustotal.com/file/10ac312c8dd02e417dd24d53c99525c29d74dcbc84730351ad7a4e0a4b1a0eba/analysis/1538417422/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1538505127" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "f81acdf2-8862-471a-86ad-96fedc156030" ,
"value" : "0/58"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1538505130" ,
"uuid" : "ce96db4c-7e5a-4b24-afec-83f8428772a5" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "ce96db4c-7e5a-4b24-afec-83f8428772a5" ,
"referenced_uuid" : "ad0d0fc0-5058-4ba7-9138-5128409e0e0d" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1538505135" ,
"uuid" : "5bb3b9af-8cb8-4255-ad95-413502de0b81"
}
] ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538505127" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "c72e7c04-a458-4217-9a9f-6b03a6eecb35" ,
"value" : "8efaabb7b1700686efedadb7949eba49"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1538505127" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "36be672c-45b8-4832-8360-d5e6da41a87f" ,
"value" : "7b17d63694eee51010bcad143bc72e355e17cb50"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1538505128" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "bef8d2fb-b9d2-46f8-aa62-76c182362b71" ,
"value" : "a9bc09a17d55fc790568ac864e3885434a43c33834551e027adb1896a463aafc"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1538505128" ,
"uuid" : "ad0d0fc0-5058-4ba7-9138-5128409e0e0d" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1538505128" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "2bf73c7b-221d-4d4d-97b8-6a9a884b33e6" ,
"value" : "2018-09-05T03:11:47"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1538505129" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "279cf9ad-5611-4cd0-8e89-c8871950c187" ,
"value" : "https://www.virustotal.com/file/a9bc09a17d55fc790568ac864e3885434a43c33834551e027adb1896a463aafc/analysis/1536117107/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1538505129" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "5b2ebb6f-dd62-405f-b4d2-b3dfe7303c9f" ,
"value" : "34/66"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1538505132" ,
"uuid" : "10851b56-6ec9-4eef-825e-543c2bdc30c8" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "10851b56-6ec9-4eef-825e-543c2bdc30c8" ,
"referenced_uuid" : "e756ef0d-4237-40bf-912d-765fdde949c2" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1538505135" ,
"uuid" : "5bb3b9af-9c0c-40fd-bb92-477402de0b81"
}
] ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538505129" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5805d9c4-adb2-4a9e-b85c-793cd420abb8" ,
"value" : "5cfa1c2cb430bec721063e3e2d144feb"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1538505130" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "fc50fe00-ba96-47c9-8292-82f351ed7e3c" ,
"value" : "c1a9044f180dc7d0c87e256c4b9356463f2cb7c6"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1538505130" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "0fab4c4f-b7f9-4b33-9638-d028cd587a76" ,
"value" : "820ca1903a30516263d630c7c08f2b95f7b65dffceb21129c51c9e21cf9551c6"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1538505131" ,
"uuid" : "e756ef0d-4237-40bf-912d-765fdde949c2" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1538505131" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "8b285a5a-1f7a-4592-9f4c-fe81f31b0138" ,
"value" : "2018-09-28T04:05:30"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1538505131" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "a5725421-131c-4e35-9a87-6b654c71a416" ,
"value" : "https://www.virustotal.com/file/820ca1903a30516263d630c7c08f2b95f7b65dffceb21129c51c9e21cf9551c6/analysis/1538107530/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1538505132" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "9d7ecb97-c890-40c8-89e3-00baf51a40b8" ,
"value" : "41/69"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "File object describing a file with meta-information" ,
"meta-category" : "file" ,
"name" : "file" ,
"template_uuid" : "688c46fb-5edb-40a3-8273-1af7923e2215" ,
"template_version" : "11" ,
"timestamp" : "1538505135" ,
"uuid" : "413d8d43-fceb-4e3a-b94c-711ae4a2baaf" ,
"ObjectReference" : [
{
"comment" : "" ,
"object_uuid" : "413d8d43-fceb-4e3a-b94c-711ae4a2baaf" ,
"referenced_uuid" : "d31ed776-eddf-4bfa-93c3-3fe3531239ef" ,
"relationship_type" : "analysed-with" ,
"timestamp" : "1538505135" ,
"uuid" : "5bb3b9af-24b8-484b-a3ab-438502de0b81"
}
] ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "md5" ,
"timestamp" : "1538505132" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "cbdd4aa9-53e3-43ac-8658-1eacd2001419" ,
"value" : "4f67f3e4a7509af1b2b1c6180a03b3e4"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha1" ,
"timestamp" : "1538505132" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "bf0829ac-7208-4c2c-8d28-933db24ce190" ,
"value" : "1c9a437ed876a0ce0e5374bd93acdfd9e9023f1f"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "sha256" ,
"timestamp" : "1538505133" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "fa9829a5-e50b-4db0-974d-c51c8450ed23" ,
"value" : "4a740227eeb82c20286d9c112ef95f0c1380d0e90ffb39fc75c8456db4f60756"
}
]
} ,
{
"comment" : "" ,
"deleted" : false ,
"description" : "VirusTotal report" ,
"meta-category" : "misc" ,
"name" : "virustotal-report" ,
"template_uuid" : "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4" ,
"template_version" : "2" ,
"timestamp" : "1538505133" ,
"uuid" : "d31ed776-eddf-4bfa-93c3-3fe3531239ef" ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "last-submission" ,
"timestamp" : "1538505133" ,
"to_ids" : false ,
"type" : "datetime" ,
"uuid" : "538d9de4-f10c-4b3f-b314-091a78c1aef0" ,
"value" : "2018-09-28T04:06:38"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"object_relation" : "permalink" ,
"timestamp" : "1538505134" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "a0497fc0-f81d-4369-a48b-eed85e2b8721" ,
"value" : "https://www.virustotal.com/file/4a740227eeb82c20286d9c112ef95f0c1380d0e90ffb39fc75c8456db4f60756/analysis/1538107598/"
} ,
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : true ,
"object_relation" : "detection-ratio" ,
"timestamp" : "1538505134" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "ba794a1f-cdc7-43c8-ae9f-56704a3e61b7" ,
"value" : "36/69"
}
]
}
]
}
}
