2023-04-21 13:25:09 +00:00
|
|
|
{
|
|
|
|
|
"Event": {
|
|
|
|
|
"analysis": "0",
|
|
|
|
|
"date": "2018-12-22",
|
|
|
|
|
"extends_uuid": "",
|
|
|
|
|
"info": "Malicious ELF binary (Mirai) - 2018-12-22 (collected on a router)",
|
|
|
|
|
"publish_timestamp": "1545466449",
|
|
|
|
|
"published": true,
|
|
|
|
|
"threat_level_id": "3",
|
|
|
|
|
"timestamp": "1545466408",
|
|
|
|
|
"uuid": "5c1def50-7570-4012-bbe0-46e202de0b81",
|
|
|
|
|
"Orgc": {
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
|
|
|
},
|
|
|
|
|
"Tag": [
|
|
|
|
|
{
|
|
|
|
|
"colour": "#0088cc",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "misp-galaxy:tool=\"Mirai\"",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#0088cc",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "misp-galaxy:malpedia=\"Mirai\"",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#0088cc",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "misp-galaxy:botnet=\"Mirai\"",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#ffffff",
|
2023-05-19 09:05:37 +00:00
|
|
|
"local": "0",
|
|
|
|
|
"name": "tlp:white",
|
|
|
|
|
"relationship_type": ""
|
2023-04-21 13:25:09 +00:00
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545465716",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5c1def74-e454-428d-8915-3dd202de0b81",
|
|
|
|
|
"value": "tutos.sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545465717",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5c1def75-ee28-4f8d-a610-3dd202de0b81",
|
|
|
|
|
"value": "purenetworks.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545465717",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5c1def75-68b0-451a-96db-3dd202de0b81",
|
|
|
|
|
"value": "adb.sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545465718",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5c1def76-2cb4-4473-a5f2-3dd202de0b81",
|
|
|
|
|
"value": "gpon8080.sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545465718",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5c1def76-2ca0-4717-9662-3dd202de0b81",
|
|
|
|
|
"value": "rce.trade"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545465719",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5c1def77-d8e0-4e42-a98c-3dd202de0b81",
|
|
|
|
|
"value": "realtek.sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545465719",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5c1def77-c78c-4723-90a3-3dd202de0b81",
|
|
|
|
|
"value": "airlink.sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545465720",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5c1def78-126c-4caa-ae75-3dd202de0b81",
|
|
|
|
|
"value": "dlink.sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545465721",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "domain",
|
|
|
|
|
"uuid": "5c1def79-5d98-4f86-9579-3dd202de0b81",
|
|
|
|
|
"value": "dzs.sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545465832",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c1defe8-91ec-459f-a759-3ee202de0b81",
|
|
|
|
|
"value": "http://145.239.138.69/bins/rift.m68k"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545465833",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c1defe9-3338-43ec-b9ef-3ee202de0b81",
|
|
|
|
|
"value": "http://rce.trade/bins/rift.m68k"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545466343",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5c1df1e7-9e28-4d57-8210-48ca02de0b81",
|
|
|
|
|
"value": "145.239.138.69"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "related samples collected the 2018-12-22",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545466343",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c1df1e7-6cf8-4335-a539-424702de0b81",
|
|
|
|
|
"value": "dd56f13b244a2b8a33fe5a112156fd89c9157406198f053354e6471b75c24554"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "related samples collected the 2018-12-22",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545466344",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c1df1e8-46d4-4a00-a2d4-453502de0b81",
|
|
|
|
|
"value": "e82a45de78fbf8b1b9577270924b100d1c094c6d1a84086a168543aed23c264b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "related samples collected the 2018-12-22",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545466344",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c1df1e8-1d9c-457e-b592-454a02de0b81",
|
|
|
|
|
"value": "5c03fa1d9b7d551f738fa8cf0937aff842b019789ffa15cb97823f921dcdedcb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "related samples collected the 2018-12-22",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545466345",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c1df1e9-1178-45a9-87c0-4ff102de0b81",
|
|
|
|
|
"value": "0a1c9cc1d2ff521996cf46fe40e0ba9dc010a9b67b45f56bc4824a8e6c505524"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "related samples collected the 2018-12-22",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545466345",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c1df1e9-1568-451c-a1bf-44d602de0b81",
|
|
|
|
|
"value": "22c6b6bd77ee2fcd16dcbb3f2ae400eafd741a4fc92a5ee167445334145e4242"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "related samples collected the 2018-12-22",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545466346",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c1df1ea-4d64-4f4e-aac4-44fe02de0b81",
|
|
|
|
|
"value": "f57ad9b7c5ca6bf64b32860298a88e2912800ce564890e4f44da46490af205a4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "related samples collected the 2018-12-22",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545466346",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c1df1ea-50e4-426c-89bb-4c4302de0b81",
|
|
|
|
|
"value": "cd31099d2dd701e259ab0bf490467a5fcf6ecebeb387e7b6b295ad53e5f83687"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "related samples collected the 2018-12-22",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545466347",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c1df1eb-be1c-4091-ba0e-486702de0b81",
|
|
|
|
|
"value": "21c8d8ca54284ca7aa92f5d1c2f8b931c13150cc8561f5bab4dc21cebba1fb27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "related samples collected the 2018-12-22",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1545466347",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c1df1eb-59b4-47bf-ad3e-439202de0b81",
|
|
|
|
|
"value": "6f81576fe9e215ab361150385eb0542e3fe07507f8a96fd2642d70ac3568106a"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Object": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "15",
|
|
|
|
|
"timestamp": "1545466381",
|
|
|
|
|
"uuid": "5c1defb7-6034-48ab-87a7-3de502de0b81",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c1defb7-6034-48ab-87a7-3de502de0b81",
|
|
|
|
|
"referenced_uuid": "5c1def75-68b0-451a-96db-3dd202de0b81",
|
|
|
|
|
"relationship_type": "related-to",
|
|
|
|
|
"timestamp": "1545466019",
|
|
|
|
|
"uuid": "5c1df0a3-6050-4b8a-bee7-4ee002de0b81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c1defb7-6034-48ab-87a7-3de502de0b81",
|
|
|
|
|
"referenced_uuid": "5c1defe9-3338-43ec-b9ef-3ee202de0b81",
|
|
|
|
|
"relationship_type": "related-to",
|
|
|
|
|
"timestamp": "1545466033",
|
|
|
|
|
"uuid": "5c1df0b1-97f4-456b-bd85-47b502de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAGJAlk15z0bLozUBAJBIAwAgABwAYjIwZTMzNjlkNzJjYTc5ZGYwMzYyMzk4YWU4MWQ0YzhVVAkAA7fvHVy37x1cdXgLAAEEIQAAAAQhAAAAPvHHrxRQ/U4nYMa26p68qZ2MEH1N9BS1rROz3iazsAqFNrFiBWNYr8ZkCtxb0P5jtFYr0MhdhEBoqJcK57y6dPAOijs8zfstQFZ6HARPz7yFnqgMFl4SeBYPzxyHyXdZysoycE27smXO/8KVMZDmZGDc9tLDzqpRDHEcTmTQpTT4ZXe88Kwx7C0TV+dG4GgAhuO6WNl8WcLVwQC7QrShTV3qp7cZSyKXUODOU+IUjsXRbKMzYmYjrY9eRAB+F3x+NBMBzS5oP/3nq6kXBouuJsMwj3NxFsyJSCABNcq7ZD4ry1NNjnegt5wMUC5OCGvRdkz01XJJGEJwl9dnngI6HOeGzmGBYOTdIx7QzhhO2uPPgCExzuXGARAMRBkVutBszdrtlWVwZTn40JswnDOYDirKz3TQqYdORsKDwQR4uHl3c81D3aW37mY28lDzdN7Gz8xnQrrIbPv2SpS+NxWXF0ScTRYJpVnfM9disGr9lz4EkxYsZsQ9aIhd9qDUCpnsiH1Sv+aWT1Xzpg4lXKd5fsXEoOjEfLWcI7Lwl4raJOCdQRtPb3TlkfpCOMAbxU+Ol3HWtG9QIoXhZFvbo620lwHyXijgrKRscKLoQrTFHddMX03tPvpkCqx+zWRQ0SPtc7Ll4BjAytNbCw/Or1GXlFu8I6NzryFE7Q2nzBE5eaUSrPZdo9Wljv27e+epdiL+538wacfXNvavZg37oySedK9s325HL8vFjwzDsGpMtw7WeUztdsPdkWPz7BEYpHwB+A7hHpY2ztTJBsjgJBV0Uz3OPHkPODg3L4onWblmh1lm11RZHe5ftOTkD3jTxwBNVfMDJcCNGtOE8azjKaKq9wrL1J+ird5oyvP5RmuQJS08VPR1j3ss9ep26scwDNJ2M4UmS2XlCnnWfXVsGsfXkMOG5LE6qqErtNKEysMLIMUsGeatRG3nib3smgBPkWmApuh85oDRuSVUUpK/lfHRviRkEiBAfJGGWfm8BSvt+7M5ncd5ZFlQ1rC3sC2f79Lg+GyQCb/fmSX3OxCmGuvh4HJXON8+DunhEA0MVC85e3ikFzWJ0b32kWd9sXZyhCSmoMvK6YnO2a8ROF9YsmAuijeMvwtbqVTP17t0SHxC2VPlawm/hi1+YXYcv2l1DvxYW5gS9CciI5zUgW1ZKMIMuKqunmIhBIZyq7uWf/hbMZdLY62IRHo8RUqYSQlUM/5K/0k0GCCpMrCOd6HcbkZzpUT5VsdeUd6faJxgjynGQjsvwDNSygJSEpiPU2eEoMqnvNn+N652fm57Pqr6dsNOZgXgoxraQf72YDrXHeWoQQVzOLGGQJGIuPdxWTM5nK2Ay2ClSOkssXXSsJyhq9r91Du2wyB8gqoc2b4OPZkG9ThJmfYxwF44J1VWI6o+Hb+KuM1jjv3OGc6pyjnfGWR73Z4B01l2GZ09ZRao3xHyU12Xbj9/uTxPYWCpK3z9LrwcxvVNriUFGwv6QCEx5QGVzu2AYd2nSG3CAqrONWy2XhFVbEM2AUg+GAJ3Rtm0ov/yUlRVL7MDx/AAc2gOn/MBxKZAqCUnd11W0lzhnVpr1t9JTBHo3OGs6ueMGiRpOI7JshVzhCLs1UDcHQ/0iBBjqsNpzc0kEzXFSDxPqfrFRThFOhhMI2cIdMog9BzS7BzUWh7mJ+n/lnUq5POEBFvgAMPt7TrxofjOHjf2dXrP//cUULd07Q0iC1r5God8sWCpXIMeH8HJtb8sjUMFtVL6YdIrO2twOSaLSBnCrNXK6ZbmyTjaXXDtGKPISZpfpK8GBvdck6EsW8nBB6aQE2KAZBBrRq4E+BwOGvBq3uFo1Djn+UAG+pXF52ocPyTWi0PhpygjvRxtXX+EkFXKTzacaUli+sy2gO7ZOXHQ535gGQMcLC1+t5XTTb51Z2M9ijJRbVsigf0e1ruEmGuzD/et/ndJpWmqvIcXTVBttD7Cq3XFnwP6Fykr1G4igI4ELjsh4TXNl/DJRgyCZHI1Z4jgBIjvURLg5jURrDbb8G445qbOl1RCKxhb4eQXQP4FSyZ6V4XHLV1l8/WppLWNm4Wzx3F4TZdfJhehTHe5a9Ng0GxpzSpJ6zeEsPUvN7NgRANex2tmoQzd1QtJm2OTLJ1dxhvRtBmE0QZC3IfKw5KfBwTDhhE0ruz+u35uuNwSj6M3QVGHOy6RBn6fPC/Ye98Jj0WZvrySzMwk63hyVmKMSRM4jU4f9mE7LjnGzjOuSYZ8Yxag/hMWBkD7SPPNYUFjSwjIvMmYZRnzTsc3FFe3b4rvO1qZJXeGK/EBqVx6k1D5LnTrpCFg+CkA/6kHh5KdibqIsW1i9pNcU7CPqGIdNooTCzR/zrBfjro2lQk7v2fVlh89/JQT90EZw4zEJO8QzzfnKMNBm+HTXihkSxwDnjxf8ge7UCu7J2hwLVLzOrTTVa35k+Uu7QSCQXADjkifMsI8K1jz5lLxEHJTgaPN43gUAXfZZNMCOVLMuzdtRuDxAZkw1jFjmdFm88Temdm9XuxjxG2vklcFOZ+9KowIk3lMHvvL/A6J/rviiyzYIxTavSttdabxYY4ghg+x0tGo62f5SrGyAOFrlO98qiBvtElFNo0QxNzm/Tqq1xnUwMc2xsRuLMcLcXdxBTFNR5fT9/Po09aPgcN39SpEKhW8GmJfIYXBQcnsjh5oTSuxxRwzFNx3Ke4CipJ0Z1OL2UhYFvrY2kwgpR+CUq6ktUAp0AflASQuJtBaCByJoCzQCb4ReZCYcsw07/oMaT5E/YrwEqe97OtT3pykWq08gjJQheuHQW1bYG+fqfSvLlgjwNNk6wLHD3PalT4cFvGvuGyPfVw8oo4kA0XJvGoUs2UVnY5T1fteSXtR6df9xow6M4UDDngyT9eC04n8pIgRjmpG8BDrC+T17bV/uJIsE5feZWPsGk2RszdwJ0TZ2d4+hbPwtUmZGfMq0dIcecDrcuCFZ8+490qDHphsDSmUrobToPltDF0i5Y5hkJ5WJxZ/WVYc5Xsq9ehzPmF5Env/+0/qsNcDMapX5idjKSCYhqNlDBagJzVfuTYfd0301V6vhewzuR4xkbLidjh9gg6ImD3x3Uo8oD6mb5yyvtTlow1SUURxADPQoEEzGWV7oN73VWsHxL7M59CNzbK13nGKO5Ylb6rhC0Bk+Lrw/lER2ibq1tIoVplPfznXPEBQqCWORo7VRQAUpwvYBp3/a3+nZVfNoIt1X4nee18Iic1VPCyn17vBEZ9q83Eg/himSPBaphJqwCJy0NgTf619J701y7ca5uHfaejRfpLWbkaHD+M/sqgcAMbTDQ7lhEYYZRAp7su4JGo92W7FOVgyiVBgMJ11TV8RT07nqaFtSIdmQ+4dpLZotRSFrt52sQzqBcjfmhoKraI++oaZlKc5qOg8BS+HrcTMcykS8YK5edOIYGyBiifJsiAhET0lIXCkrF2FWHaJYPESRjtZLp98QkdbSVqZm/6+ZN6UC3pw/PZ9HSD0bZbrlL7imjNa2hVhSOTlmvFiEFNsTtZbsRdLxx5iVu+PL4+LTEbZswu27XL/dviaTjCk2EJsIw/EGhz7lBZhYgcBqcvBuhBvat/lwwB7/wB+UsRUp1NMlst5tjtzZ8E8iCoMBLifyALEADnaz6TvliQ2MERbBuGpf49bFUcdL5O7n/AxUWwM8+McEH0rLWvU7Iq1PKxqlOqUxaxgYnehn56J6yAlxEHeSpUZhHRVam9s95Z9jlWvQP0jlZJwugd4xChom9PtKImJvFe9ZnVCgJkOGztkVTBWV8senejWLR662itMBpYzISMpPgEW+g/au+GC42JZVnozmQVT5OdKjVNjlvIIo6BR2YPHaySGvyfGMWDyUlvcdDC40CvpVMuVOqbkoOqLXh8iP5rTvO2YbLXqHYjYwjgOKDGvM269cr7vK2Gzf5/x1AdxOLJQFFUdgH65nLCUfo
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1545465783",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c1defb7-3ff0-4e60-9060-3de502de0b81",
|
|
|
|
|
"value": "1c484f5eab8549071f2c1643daf947d7fde459080a0b87337342a8e629c9a9d0|b20e3369d72ca79df0362398ae81d4c8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1545465784",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c1defb8-7ff4-41ce-b9ee-3de502de0b81",
|
|
|
|
|
"value": "1c484f5eab8549071f2c1643daf947d7fde459080a0b87337342a8e629c9a9d0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1545465786",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c1defba-c9ac-46c2-84ac-3de502de0b81",
|
|
|
|
|
"value": "b20e3369d72ca79df0362398ae81d4c8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1545465786",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c1defba-a848-4244-97ca-3de502de0b81",
|
|
|
|
|
"value": "f6a079a809e65ca8007d7959f5eedacf852e7351"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1545465787",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c1defbb-f820-4807-8979-3de502de0b81",
|
|
|
|
|
"value": "1c484f5eab8549071f2c1643daf947d7fde459080a0b87337342a8e629c9a9d0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1545465787",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c1defbb-46cc-43fc-85fb-3de502de0b81",
|
|
|
|
|
"value": "215184"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1545466381",
|
|
|
|
|
"uuid": "ffb32990-7cd3-4e8c-960c-3be57bf8cf63",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1545466381",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "045c8d4b-8b92-404e-b6e8-3b405ea8b660",
|
|
|
|
|
"value": "a6574b0af5a2d91c52d59b8e68e21387"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1545466382",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5d13cd22-7a1a-42d3-9143-220b48c13ec6",
|
|
|
|
|
"value": "b3f89c2cbf180251d3ce60cc275cfa37faceadf6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1545466382",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "3e4832aa-6550-4189-9b13-4bb7654751be",
|
|
|
|
|
"value": "cd31099d2dd701e259ab0bf490467a5fcf6ecebeb387e7b6b295ad53e5f83687"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1545466383",
|
|
|
|
|
"uuid": "a9ebf3b6-c4b9-4cc5-a1d8-1f85b24c1b84",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1545466383",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "c80f0c78-cefd-4226-aee1-3d197cc264fe",
|
|
|
|
|
"value": "2018-12-22T06:27:45"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1545466383",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5d21b982-03ca-4fe6-8d5d-ef928f0f6691",
|
|
|
|
|
"value": "https://www.virustotal.com/file/cd31099d2dd701e259ab0bf490467a5fcf6ecebeb387e7b6b295ad53e5f83687/analysis/1545460065/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1545466384",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2e5f2514-eb71-412f-96eb-79bb48e1578b",
|
|
|
|
|
"value": "17/56"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1545466384",
|
|
|
|
|
"uuid": "02667750-2846-4aa3-9b4d-e3bc900d83ac",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1545466384",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "1cdbecea-6f8f-4b6e-aedf-fcfc23a229f1",
|
|
|
|
|
"value": "32a075fb231e42678581b83f0be2c001"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1545466384",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "762db284-550f-42c5-9705-85013ee14642",
|
|
|
|
|
"value": "21fd9c9332ba3b9da8f169a5a9e926fd4f25b8e0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1545466385",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "c45d1c7a-2489-4c31-8577-78ae46d7c539",
|
|
|
|
|
"value": "f57ad9b7c5ca6bf64b32860298a88e2912800ce564890e4f44da46490af205a4"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1545466385",
|
|
|
|
|
"uuid": "cbb33856-2445-495d-a539-8beb680ddcf2",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1545466385",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "cd5513f4-fb38-4c97-9313-66b3d747c52c",
|
|
|
|
|
"value": "2018-12-22T06:33:55"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1545466386",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "01619c73-072e-46b3-a208-2313e9f1cb66",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f57ad9b7c5ca6bf64b32860298a88e2912800ce564890e4f44da46490af205a4/analysis/1545460435/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1545466386",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "98bbf5c1-d931-498c-adce-5ba514b3e183",
|
|
|
|
|
"value": "20/58"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1545466386",
|
|
|
|
|
"uuid": "5a461f37-ea74-4114-8f56-dec17767d75a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1545466386",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "0225510e-f177-402b-a677-0639cdaaed83",
|
|
|
|
|
"value": "e2ddf17217c528e08cf13b9cb55937f2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1545466388",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f0830ae4-d219-48ea-ab91-8670b470d6ad",
|
|
|
|
|
"value": "b236d8b3e4ceab7d2d6729a8a955aa36ee871ce6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1545466388",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "de908ac3-706b-4e94-9936-732dc4bf7127",
|
|
|
|
|
"value": "dd56f13b244a2b8a33fe5a112156fd89c9157406198f053354e6471b75c24554"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1545466389",
|
|
|
|
|
"uuid": "da3b0176-135b-49c4-acf4-9f397271c19b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1545466389",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5754190d-81f5-481b-90e6-f1eb32f5925f",
|
|
|
|
|
"value": "2018-12-22T07:12:20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1545466390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "1cf12112-a093-4939-bb5e-edab6a62235d",
|
|
|
|
|
"value": "https://www.virustotal.com/file/dd56f13b244a2b8a33fe5a112156fd89c9157406198f053354e6471b75c24554/analysis/1545462740/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1545466390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ab32b420-39ad-40ea-90ab-d8d7caab2a8d",
|
|
|
|
|
"value": "22/56"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1545466390",
|
|
|
|
|
"uuid": "65ffa251-69ee-4531-ba89-98c6169d959e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1545466390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "ec07de4f-fa2a-4623-b271-a20552fd3060",
|
|
|
|
|
"value": "c09bc77edcb32573a10da99197c51162"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1545466391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "4ea8ef59-254e-43ee-9720-eed3448a7bfe",
|
|
|
|
|
"value": "65f218fd4c85c565270ca1b2ba5271bf9792da62"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1545466391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "07db7ec0-7146-4e1d-a6bd-6975db66ba68",
|
|
|
|
|
"value": "0a1c9cc1d2ff521996cf46fe40e0ba9dc010a9b67b45f56bc4824a8e6c505524"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1545466392",
|
|
|
|
|
"uuid": "dfefbb21-10b8-4bc9-b81b-fbe0ca7f1569",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1545466392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5ffa5231-2e39-4f3b-9fda-efd22ba6852e",
|
|
|
|
|
"value": "2018-12-22T06:41:28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1545466392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "94f8cdf6-1a5b-48df-a939-f3271596ae59",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0a1c9cc1d2ff521996cf46fe40e0ba9dc010a9b67b45f56bc4824a8e6c505524/analysis/1545460888/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1545466393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2f7f44e8-b43e-4f2b-a54b-f4308810f205",
|
|
|
|
|
"value": "16/56"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1545466393",
|
|
|
|
|
"uuid": "23a97df0-169d-4dd6-8b75-9a29d76b669b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1545466393",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "d794b53f-4005-4015-b4d8-39d39b08288e",
|
|
|
|
|
"value": "5dfc1bc753a257824c8010ed4bdd4092"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1545466393",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "54e39d78-81d6-4d4a-9aaa-0a9a97996017",
|
|
|
|
|
"value": "ff782a7c66eb769ab6542948da3f33a0f83bc497"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1545466394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "6384ee77-90e3-450e-858d-527dd3bc997c",
|
|
|
|
|
"value": "6f81576fe9e215ab361150385eb0542e3fe07507f8a96fd2642d70ac3568106a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1545466394",
|
|
|
|
|
"uuid": "be8f89c6-f7cd-4e0d-bea3-e1fb1510b9fa",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1545466394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "a3374a39-e472-4b6d-a58c-cd2401fe8e5c",
|
|
|
|
|
"value": "2018-12-22T06:22:14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1545466395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "386018e1-0346-4fec-b77b-19cfa3b65bec",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6f81576fe9e215ab361150385eb0542e3fe07507f8a96fd2642d70ac3568106a/analysis/1545459734/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1545466395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0f902e65-c349-4519-8702-fab4ce47f821",
|
|
|
|
|
"value": "16/56"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1545466395",
|
|
|
|
|
"uuid": "a7a85b34-4c6a-49f1-ada4-cd1a2cfe5cc1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1545466395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "e02cf85c-31a8-4c6c-9c6b-2153dc6196e5",
|
|
|
|
|
"value": "2018-12-22T07:43:25"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1545466396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "280516f8-86d7-4d90-9339-a8462a1cac0f",
|
|
|
|
|
"value": "https://www.virustotal.com/file/1c484f5eab8549071f2c1643daf947d7fde459080a0b87337342a8e629c9a9d0/analysis/1545464605/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1545466396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "df45df49-855e-4165-aa01-4ecd55864c59",
|
|
|
|
|
"value": "22/55"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1545466396",
|
|
|
|
|
"uuid": "d46c5216-771c-498b-93a7-c2ae86b8fc85",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1545466396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "0f21da2c-f6a1-44b7-a397-4abf3819b5e3",
|
|
|
|
|
"value": "d201a06381a07c96a0ca0527f8ec2912"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1545466397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "24f74c25-90ae-48df-843f-67f354b3a5a6",
|
|
|
|
|
"value": "dc52f94c6a0e44aae56b78109113c4b8e39ff4da"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1545466397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "2b2e5c27-cb22-4aae-b82a-a39375a1b2eb",
|
|
|
|
|
"value": "21c8d8ca54284ca7aa92f5d1c2f8b931c13150cc8561f5bab4dc21cebba1fb27"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1545466398",
|
|
|
|
|
"uuid": "70dae729-bf15-4fdb-8b17-88b25ad655f9",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1545466398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "ea341628-bc26-4d88-81c1-c1f955ad33b3",
|
|
|
|
|
"value": "2018-12-22T06:22:47"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1545466398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "de0c14e1-6e22-4d65-9773-1193074fcc9c",
|
|
|
|
|
"value": "https://www.virustotal.com/file/21c8d8ca54284ca7aa92f5d1c2f8b931c13150cc8561f5bab4dc21cebba1fb27/analysis/1545459767/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1545466399",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "77a3f3a1-1ff1-4ce9-865a-3a9f8bf10cee",
|
|
|
|
|
"value": "10/57"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1545466399",
|
|
|
|
|
"uuid": "3dc38322-437e-49e6-9d44-c21cd68cb10a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1545466400",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "77b9e9e4-283c-4c4a-84c4-40c31c06a401",
|
|
|
|
|
"value": "4ee9d50632e0c7c36899cecf1b8f2547"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1545466400",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "9a380ee0-b6a8-463b-b8ec-059f75df6ebe",
|
|
|
|
|
"value": "c200a35d1dbbfe9639fc942755701dee3f1c415e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1545466401",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ec531bbb-e8cb-4163-b5f9-20f1525e7966",
|
|
|
|
|
"value": "e82a45de78fbf8b1b9577270924b100d1c094c6d1a84086a168543aed23c264b"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1545466401",
|
|
|
|
|
"uuid": "506d006d-bc83-4e3a-8cd5-ec4f98e0a081",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1545466401",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "1d6891d5-a90a-4608-b49d-fb6fc776fb07",
|
|
|
|
|
"value": "2018-12-22T06:55:01"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1545466402",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "05f2bee3-95e7-4953-912c-14c1f4f4bdb5",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e82a45de78fbf8b1b9577270924b100d1c094c6d1a84086a168543aed23c264b/analysis/1545461701/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1545466403",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "416e7bc8-308f-4add-b03f-a08967caf518",
|
|
|
|
|
"value": "11/55"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1545466403",
|
|
|
|
|
"uuid": "fcab5eef-60e1-4685-a6eb-0d8a2ac9bbce",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1545466403",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f7cc0b9e-77a7-47f1-be40-9f826506ba23",
|
|
|
|
|
"value": "48db654726a8758af7f2b3b31d1476f2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1545466404",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "db71cc00-941d-405c-995e-5ddf5f639b5b",
|
|
|
|
|
"value": "1229375497e371eb2ce3e8e670fb554804eea42d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1545466404",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "a5c248e0-d789-443f-8600-78e9bc389a50",
|
|
|
|
|
"value": "22c6b6bd77ee2fcd16dcbb3f2ae400eafd741a4fc92a5ee167445334145e4242"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1545466405",
|
|
|
|
|
"uuid": "5da3946b-e14b-44e0-b9c0-c1ebe8318907",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1545466405",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "447eecca-7803-47d1-b37c-c5b9d480e6cc",
|
|
|
|
|
"value": "2018-12-22T06:33:59"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1545466405",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "378938a3-856a-4b92-9550-01d388d07893",
|
|
|
|
|
"value": "https://www.virustotal.com/file/22c6b6bd77ee2fcd16dcbb3f2ae400eafd741a4fc92a5ee167445334145e4242/analysis/1545460439/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1545466406",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8737dce0-10c8-4725-947f-aebc44b028b8",
|
|
|
|
|
"value": "20/58"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1545466406",
|
|
|
|
|
"uuid": "eed9e7c8-7134-4d41-96b8-48f149ff2bf5",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1545466406",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "54b44d6d-8761-44ad-a463-1a1c89cc0b52",
|
|
|
|
|
"value": "ad124ff5c8d0a2afab61bb8c29b8a8a8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1545466406",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "aa283773-cd8e-4255-8ebb-e86d9ab59331",
|
|
|
|
|
"value": "ddf38f8cc07b05085ca6b9508975449c474a49d4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1545466407",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "4dac6011-9401-47ce-93e5-0c8852625ac3",
|
|
|
|
|
"value": "5c03fa1d9b7d551f738fa8cf0937aff842b019789ffa15cb97823f921dcdedcb"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1545466407",
|
|
|
|
|
"uuid": "92a95325-d5d0-476c-8998-16eb966d1706",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1545466408",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "746f860a-6825-4c2d-ac85-0b8ecf01b3ba",
|
|
|
|
|
"value": "2018-12-22T06:45:30"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1545466408",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "24611e72-2e99-44ac-84f4-0c65da414aa2",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5c03fa1d9b7d551f738fa8cf0937aff842b019789ffa15cb97823f921dcdedcb/analysis/1545461130/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1545466409",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bfd8765c-61eb-4474-b343-7f7216238673",
|
|
|
|
|
"value": "20/56"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
}
|
