{ "Event": { "analysis": "2", "date": "2015-03-04", "extends_uuid": "", "info": "OSINT Analysis of malcious CHM file by OpenDNS", "publish_timestamp": "1425570892", "published": true, "threat_level_id": "3", "timestamp": "1425565791", "uuid": "54f8662f-c7f0-4f59-a42a-a9a9950d210b", "Orgc": { "name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f" }, "Tag": [ { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565239", "to_ids": false, "type": "link", "uuid": "54f86637-1448-4984-ac4a-4b60950d210b", "value": "https://labs.opendns.com/2015/03/04/investigating-a-malicious-attachment-without-reversing/" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565257", "to_ids": false, "type": "link", "uuid": "54f86649-4d08-4813-8439-40af950d210b", "value": "https://www.virustotal.com/en-gb/file/0d18bc9bd50080598f9d69032de95b2ed438e77884a6389755f523f3901c0b39/analysis/" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565257", "to_ids": false, "type": "link", "uuid": "54f86649-d82c-4c2c-8b9a-40af950d210b", "value": "https://www.virustotal.com/en-gb/file/8e801b9171291c11b0a3fcbd4314a078ff2c43305808fd49434858654e4e4bde/analysis/" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565340", "to_ids": true, "type": "md5", "uuid": "54f8669c-1318-4b59-8502-4bcf950d210b", "value": "5c27e49a1229999bc799e0907f2faca8" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565340", "to_ids": true, "type": "sha1", "uuid": "54f8669c-d5d4-4077-a370-4246950d210b", "value": "9f1e233a61b00a189d24b419049df347d00ff2e2" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565340", "to_ids": true, "type": "sha256", "uuid": "54f8669c-598c-4139-a69b-4ffa950d210b", "value": "8e801b9171291c11b0a3fcbd4314a078ff2c43305808fd49434858654e4e4bde" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565340", "to_ids": true, "type": "md5", "uuid": "54f8669c-5c70-44e4-9f6f-4936950d210b", "value": "d2c7479e9494ec3d9868c6dcccc45c25" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565340", "to_ids": true, "type": "sha1", "uuid": "54f8669c-f134-4945-b05a-44d7950d210b", "value": "bc6808522c433aa0759b087c9001637989139809" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565340", "to_ids": true, "type": "sha256", "uuid": "54f8669c-2e1c-44ff-9200-404f950d210b", "value": "0d18bc9bd50080598f9d69032de95b2ed438e77884a6389755f523f3901c0b39" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565368", "to_ids": true, "type": "domain", "uuid": "54f866b8-b2d0-456a-a3f4-48a0950d210b", "value": "igloofire.com" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565386", "to_ids": false, "type": "link", "uuid": "54f866ca-428c-473e-b286-f7b4950d210b", "value": "https://malwr.com/analysis/MTY5MTAxZjE3OTk5NGVkZDkyYTFhNGMwZTVjOTBjNzc/#" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565461", "to_ids": true, "type": "domain", "uuid": "54f86715-ce44-41ab-ab92-40af950d210b", "value": "perviylich.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565480", "to_ids": true, "type": "ip-dst", "uuid": "54f86728-43b8-4d79-a0b6-4e0d950d210b", "value": "62.76.187.73" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565509", "to_ids": true, "type": "ip-dst", "uuid": "54f86745-f8f8-4804-a538-4df2950d210b", "value": "193.169.86.178" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565570", "to_ids": true, "type": "domain", "uuid": "54f86782-3b80-4abf-a020-4aa4950d210b", "value": "cvelasiren.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565570", "to_ids": true, "type": "domain", "uuid": "54f86782-b898-4576-9c58-4e9b950d210b", "value": "cvelasiren.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565570", "to_ids": true, "type": "domain", "uuid": "54f86782-78fc-4641-8560-4d44950d210b", "value": "dobriytsar.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565570", "to_ids": true, "type": "domain", "uuid": "54f86782-b474-4783-978c-47c0950d210b", "value": "dobriytsar.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565570", "to_ids": true, "type": "domain", "uuid": "54f86782-0b3c-43f1-bb0d-47fc950d210b", "value": "dobroeutro.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565570", "to_ids": true, "type": "domain", "uuid": "54f86782-2d9c-41c2-83a4-4dd2950d210b", "value": "eplayavodka.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565570", "to_ids": true, "type": "domain", "uuid": "54f86782-d4bc-457e-a3a2-4bf5950d210b", "value": "gromkiyzvuk.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565571", "to_ids": true, "type": "domain", "uuid": "54f86783-d8e4-4b71-b361-4e4d950d210b", "value": "gromkiyzvuk.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565571", "to_ids": true, "type": "domain", "uuid": "54f86783-dbbc-4b4d-a4af-45a3950d210b", "value": "holodnoepivo.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565571", "to_ids": true, "type": "domain", "uuid": "54f86783-d590-44ef-a951-46c7950d210b", "value": "horoshiyden.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565571", "to_ids": true, "type": "domain", "uuid": "54f86783-98d0-4918-9338-4c9f950d210b", "value": "horoshiyden.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565571", "to_ids": true, "type": "domain", "uuid": "54f86783-19b0-41df-a7f7-4444950d210b", "value": "korichneviyrassvet.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565571", "to_ids": true, "type": "domain", "uuid": "54f86783-fed8-4857-bbd0-498b950d210b", "value": "korichneviyrassvet.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565571", "to_ids": true, "type": "domain", "uuid": "54f86783-7ad0-416c-9d89-4c2e950d210b", "value": "krepkiystul.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565571", "to_ids": true, "type": "domain", "uuid": "54f86783-ad40-4fd4-a0be-43e5950d210b", "value": "krepkiystul.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565571", "to_ids": true, "type": "domain", "uuid": "54f86783-4ac0-4beb-9a49-477f950d210b", "value": "krugovayaporuka.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565571", "to_ids": true, "type": "domain", "uuid": "54f86783-eff4-42ab-8800-41a6950d210b", "value": "krugovayaporuka.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565572", "to_ids": true, "type": "domain", "uuid": "54f86784-e96c-4bff-866c-415d950d210b", "value": "lasiren.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565572", "to_ids": true, "type": "domain", "uuid": "54f86784-6118-44ff-b1de-4f73950d210b", "value": "letniydozhd.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565572", "to_ids": true, "type": "domain", "uuid": "54f86784-b37c-439c-9dde-468b950d210b", "value": "letniydozhd.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565572", "to_ids": true, "type": "domain", "uuid": "54f86784-3dd0-491d-9882-427c950d210b", "value": "nogaknoge.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565572", "to_ids": true, "type": "domain", "uuid": "54f86784-dd28-4f14-bfec-44c7950d210b", "value": "nogaknoge.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565572", "to_ids": true, "type": "domain", "uuid": "54f86784-72ec-4c1f-a79c-411a950d210b", "value": "perviyclass.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565572", "to_ids": true, "type": "domain", "uuid": "54f86784-5920-4d24-869c-4e7a950d210b", "value": "perviylich.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565572", "to_ids": true, "type": "domain", "uuid": "54f86784-ab60-4217-b843-467b950d210b", "value": "perviysneg.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565572", "to_ids": true, "type": "domain", "uuid": "54f86784-84e4-4a57-9b94-4142950d210b", "value": "podliyvrag.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565572", "to_ids": true, "type": "domain", "uuid": "54f86784-95b4-43b4-a2ce-438a950d210b", "value": "rozoviyzakat.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565573", "to_ids": true, "type": "domain", "uuid": "54f86785-b544-4bb7-9c4b-438f950d210b", "value": "rozoviyzakat.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565573", "to_ids": true, "type": "domain", "uuid": "54f86785-c470-43b7-adf0-485e950d210b", "value": "shumelkamish.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565573", "to_ids": true, "type": "domain", "uuid": "54f86785-af34-4738-86e2-45d9950d210b", "value": "shumelkamish.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565573", "to_ids": true, "type": "domain", "uuid": "54f86785-2508-47b9-a262-4ece950d210b", "value": "silniygrom.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565573", "to_ids": true, "type": "domain", "uuid": "54f86785-3ffc-43d6-aa6e-4ada950d210b", "value": "silniygrom.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565573", "to_ids": true, "type": "domain", "uuid": "54f86785-2f04-472d-bc4f-4c66950d210b", "value": "techetreka.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565573", "to_ids": true, "type": "domain", "uuid": "54f86785-5030-4a6c-994a-44db950d210b", "value": "techetreka.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565573", "to_ids": true, "type": "domain", "uuid": "54f86785-4658-492e-8358-49f5950d210b", "value": "temnayanoch.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565573", "to_ids": true, "type": "domain", "uuid": "54f86785-d5d0-44fa-b8d6-4fd9950d210b", "value": "temnayanoch.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565573", "to_ids": true, "type": "domain", "uuid": "54f86785-5c28-49b0-8f07-4083950d210b", "value": "temniyles.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565574", "to_ids": true, "type": "domain", "uuid": "54f86786-9f10-49d9-933f-4e57950d210b", "value": "temniyles.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565574", "to_ids": true, "type": "domain", "uuid": "54f86786-dd18-4181-a05d-4e5d950d210b", "value": "teplayavodka.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565574", "to_ids": true, "type": "domain", "uuid": "54f86786-4b70-4397-aa04-4048950d210b", "value": "teplayavodka.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565574", "to_ids": true, "type": "domain", "uuid": "54f86786-8e74-46cb-827c-4a1d950d210b", "value": "tihiyshepot.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565574", "to_ids": true, "type": "domain", "uuid": "54f86786-df38-4781-a97a-4029950d210b", "value": "tihiyshepot.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565574", "to_ids": true, "type": "domain", "uuid": "54f86786-cba8-41b9-b507-4edf950d210b", "value": "tomniyvecher.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565574", "to_ids": true, "type": "domain", "uuid": "54f86786-44ec-490d-bf2b-412c950d210b", "value": "tomniyvecher.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565574", "to_ids": true, "type": "domain", "uuid": "54f86786-7074-411a-9ad1-41ba950d210b", "value": "truhlyaviypen.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565574", "to_ids": true, "type": "domain", "uuid": "54f86786-8910-4c43-a636-48c3950d210b", "value": "truhlyaviypen.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565574", "to_ids": true, "type": "domain", "uuid": "54f86786-6f1c-48d1-b7b3-4c0f950d210b", "value": "trusliviyzayac.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565575", "to_ids": true, "type": "domain", "uuid": "54f86787-d3c0-4f7f-9096-4120950d210b", "value": "trusliviyzayac.su" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565575", "to_ids": true, "type": "domain", "uuid": "54f86787-f42c-4929-ab9d-40e1950d210b", "value": "utliycheln.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565575", "to_ids": true, "type": "domain", "uuid": "54f86787-8d44-4185-a155-442d950d210b", "value": "utliycheln.su" }, { "category": "Attribution", "comment": "Registrant", "deleted": false, "disable_correlation": false, "timestamp": "1425565623", "to_ids": false, "type": "text", "uuid": "54f867b7-c3b8-4e0b-8055-947e950d210b", "value": "domains.globality87234@yopmail.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565695", "to_ids": true, "type": "domain", "uuid": "54f867ff-9850-4c13-af41-3c19950d210b", "value": "johny-mrroinson.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565695", "to_ids": true, "type": "domain", "uuid": "54f867ff-2484-4be9-b140-3c19950d210b", "value": "dnsbbbbdns.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565695", "to_ids": true, "type": "domain", "uuid": "54f867ff-b648-44c7-b9d4-3c19950d210b", "value": "dnsdomainserv12.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565695", "to_ids": true, "type": "domain", "uuid": "54f867ff-29cc-4dfb-8b88-3c19950d210b", "value": "dnskkop12.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565696", "to_ids": true, "type": "domain", "uuid": "54f86800-32f8-429e-9d9d-3c19950d210b", "value": "dns-pupkin-vasya.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565696", "to_ids": true, "type": "domain", "uuid": "54f86800-d7a4-4060-abb9-3c19950d210b", "value": "dnsservice7736.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565696", "to_ids": true, "type": "domain", "uuid": "54f86800-d630-41f6-b906-3c19950d210b", "value": "financeoutfeet.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565696", "to_ids": true, "type": "domain", "uuid": "54f86800-fcd4-4175-9daf-3c19950d210b", "value": "jhon-russel.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565696", "to_ids": true, "type": "domain", "uuid": "54f86800-7074-4c67-9cf4-3c19950d210b", "value": "jopanikstor.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565696", "to_ids": true, "type": "domain", "uuid": "54f86800-d590-461e-a270-3c19950d210b", "value": "nick-stoll.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565696", "to_ids": true, "type": "domain", "uuid": "54f86800-4c50-43d6-a64b-3c19950d210b", "value": "nsserver-noserver.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1425565733", "to_ids": false, "type": "AS", "uuid": "54f86825-c80c-47cf-a795-48c1950d210b", "value": "48031" } ] } }