{
  "Event": {
    "analysis": "1",
    "date": "2016-09-01",
    "extends_uuid": "",
    "info": "Malware Posing as Human Rights Organizations and Commercial Software Targeting Iranians, Foreign Policy Institutions and Middle Eastern Countries (ExtremeDownloader and Strealer)",
    "publish_timestamp": "1472740551",
    "published": true,
    "threat_level_id": "1",
    "timestamp": "1472740516",
    "uuid": "57c8398d-2238-41df-bbc7-45b7950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#3a7300",
        "local": false,
        "name": "circl:incident-classification=\"malware\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Artifacts dropped",
        "comment": "Payloads",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740174",
        "to_ids": true,
        "type": "filename|sha256",
        "uuid": "57c83a33-f6d4-4791-a524-47fe950d210f",
        "value": "newlity.exe|a62dde31eecf650c2dd39eeda9daf8fd35b1dff5330e72035d1846579ea838dc"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Payloads",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740174",
        "to_ids": true,
        "type": "filename|sha256",
        "uuid": "57c83a33-53e8-4a85-88cb-4c30950d210f",
        "value": "private_chat.exe|1a24714fd99030bd63804ab96fc2612f148a5f08d1c2845152c3a0e168600db9"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Payloads",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740174",
        "to_ids": true,
        "type": "filename|sha256",
        "uuid": "57c83a34-7500-4033-a076-47f4950d210f",
        "value": "multiplay-register.exe|e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Payloads",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740174",
        "to_ids": true,
        "type": "filename|sha256",
        "uuid": "57c83a34-eb4c-4010-9c4f-432f950d210f",
        "value": "TeamSpeak.EXE|13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Extreme downloader",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740192",
        "to_ids": true,
        "type": "filename|sha256",
        "uuid": "57c83a34-3e24-4416-8f90-4a25950d210f",
        "value": "dwm.exe|e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Dropper / Moreoriz",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740201",
        "to_ids": true,
        "type": "filename|sha256",
        "uuid": "57c83a35-0c04-4523-8f40-42bb950d210f",
        "value": "contask.exe|b0afef1ee97c8a9a7a7d4a83b5d8aab3a710062d9df98f909a3306c031e2cc21"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Strealer",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740213",
        "to_ids": true,
        "type": "filename|sha256",
        "uuid": "57c83a35-4ab4-49b0-80a3-43c3950d210f",
        "value": "mozilla.exe|3a8995413b8e63dca766999c5a3220114e4ab4c446130c5bd7c852a618dd2fa7"
      },
      {
        "category": "Artifacts dropped",
        "comment": "TightVNC",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740216",
        "to_ids": true,
        "type": "filename|sha256",
        "uuid": "57c83a36-7eb8-418f-8181-4bb4950d210f",
        "value": "vn.exe|1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae"
      },
      {
        "category": "Network activity",
        "comment": "C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740003",
        "to_ids": true,
        "type": "domain",
        "uuid": "57c83aa3-897c-4a04-ba98-435d950d210f",
        "value": "apache-utility.com"
      },
      {
        "category": "Network activity",
        "comment": "C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740004",
        "to_ids": true,
        "type": "domain",
        "uuid": "57c83aa4-42e4-40b0-a045-470c950d210f",
        "value": "microsoft-hotfix.com"
      },
      {
        "category": "Network activity",
        "comment": "C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740004",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c83aa4-d7ac-4cb8-a9cb-4d31950d210f",
        "value": "5.152.202.53"
      },
      {
        "category": "Network activity",
        "comment": "C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740004",
        "to_ids": true,
        "type": "domain",
        "uuid": "57c83aa4-99b4-4d1a-9bbb-4542950d210f",
        "value": "update-finder.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740347",
        "to_ids": false,
        "type": "link",
        "uuid": "57c83bfb-4838-4a75-9522-41bc950d210f",
        "value": "https://iranthreats.github.io/resources/human-rights-impersonation-malware/"
      },
      {
        "category": "Artifacts dropped",
        "comment": "TightVNC - Xchecked via VT: 1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740516",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57c83ca4-d5bc-49b7-9778-48a102de0b81",
        "value": "b89d8b5bd6f9bf1c1d61f0d3851dec9cf4216b9b"
      },
      {
        "category": "Artifacts dropped",
        "comment": "TightVNC - Xchecked via VT: 1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740517",
        "to_ids": true,
        "type": "md5",
        "uuid": "57c83ca5-2308-4ce2-b870-4cc202de0b81",
        "value": "a2ff24322c12558eb1f29aea3ca6f24a"
      },
      {
        "category": "External analysis",
        "comment": "TightVNC - Xchecked via VT: 1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740517",
        "to_ids": false,
        "type": "link",
        "uuid": "57c83ca5-89ac-4e60-b7d0-4eda02de0b81",
        "value": "https://www.virustotal.com/file/1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae/analysis/1452468082/"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Extreme downloader - Xchecked via VT: e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740517",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57c83ca5-ec84-4e30-90f7-4f8d02de0b81",
        "value": "d5144c73f7e7c961bc2823cf002892eee70c4dbf"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Extreme downloader - Xchecked via VT: e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740517",
        "to_ids": true,
        "type": "md5",
        "uuid": "57c83ca5-f860-4991-b6ee-486302de0b81",
        "value": "ccaf21e122ca9d2e2397a9e28eb4cc87"
      },
      {
        "category": "External analysis",
        "comment": "Extreme downloader - Xchecked via VT: e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740517",
        "to_ids": false,
        "type": "link",
        "uuid": "57c83ca5-971c-45a8-89ae-428d02de0b81",
        "value": "https://www.virustotal.com/file/e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716/analysis/1470948989/"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Payloads - Xchecked via VT: 13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740518",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57c83ca6-be84-471d-bc23-428402de0b81",
        "value": "f2179dbba6a4f132864d8edd38c26991ac21559d"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Payloads - Xchecked via VT: 13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740518",
        "to_ids": true,
        "type": "md5",
        "uuid": "57c83ca6-d4e0-46d3-9a59-4e8702de0b81",
        "value": "77857588c41f778b7660d4e52634a4e3"
      },
      {
        "category": "External analysis",
        "comment": "Payloads - Xchecked via VT: 13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472740518",
        "to_ids": false,
        "type": "link",
        "uuid": "57c83ca6-ca38-4a27-805b-4e8702de0b81",
        "value": "https://www.virustotal.com/file/13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9/analysis/1470330553/"
      }
    ]
  }
}