{ "Event": { "analysis": "2", "date": "2018-05-04", "extends_uuid": "", "info": "OSINT - Who's who in the zoo. Cyberespionage operation targets android users in the Middle East.", "publish_timestamp": "1525441531", "published": true, "threat_level_id": "3", "timestamp": "1525441529", "uuid": "5aec0f0f-7fe0-4e42-8f64-44e5950d210f", "Orgc": { "name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"ZooPark\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525433952", "to_ids": false, "type": "link", "uuid": "5aec0f20-88a8-49fa-80f5-4733950d210f", "value": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/05/03095519/ZooPark_for_public_final.pdf" }, { "category": "Network activity", "comment": "C2 server", "deleted": false, "disable_correlation": false, "timestamp": "1525433953", "to_ids": true, "type": "hostname", "uuid": "5aec200b-7a44-4031-8c84-43e4950d210f", "value": "entekhab10.xp3.biz" }, { "category": "Network activity", "comment": "C2 server", "deleted": false, "disable_correlation": false, "timestamp": "1525424140", "to_ids": true, "type": "domain", "uuid": "5aec200c-c464-4a1f-877d-446f950d210f", "value": "androidupdaters.com" }, { "category": "Network activity", "comment": "C2 server", "deleted": false, "disable_correlation": false, "timestamp": "1525424140", "to_ids": true, "type": "domain", "uuid": "5aec200c-31d0-46b1-8b30-485d950d210f", "value": "dlgmail.com" }, { "category": "Network activity", "comment": "C2 server", "deleted": false, "disable_correlation": false, "timestamp": "1525424141", "to_ids": true, "type": "domain", "uuid": "5aec200d-4b3c-44f6-ac45-46ea950d210f", "value": "rhubarb2.com" }, { "category": "Network activity", "comment": "C2 server", "deleted": false, "disable_correlation": false, "timestamp": "1525424141", "to_ids": true, "type": "domain", "uuid": "5aec200d-786c-4cf7-b419-46f3950d210f", "value": "rhubarb3.com" }, { "category": "Network activity", "comment": "C2 server", "deleted": false, "disable_correlation": false, "timestamp": "1525433953", "to_ids": true, "type": "ip-dst", "uuid": "5aec200d-4b50-4080-9453-4428950d210f", "value": "5.61.27.154" }, { "category": "Network activity", "comment": "C2 server", "deleted": false, "disable_correlation": false, "timestamp": "1525433954", "to_ids": true, "type": "ip-dst", "uuid": "5aec200e-c888-486a-84ac-4da1950d210f", "value": "5.61.27.157" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525433954", "to_ids": false, "type": "comment", "uuid": "5aec2023-ac18-4e5e-a38e-4a21950d210f", "value": "ZooPark is a cyberespionage operation that has been focusing on Middle Eastern targets since at least June 2015. The threat actors behind ZooPark infect Android devices using several generations of malware we label from v1-v4, with v4 being the most recent version deployed in 2017.\r\n\r\nThe preferred infection vector for ZooPark is waterhole attacks. We found several news websites that have been hacked by the attackers to redirect visitors to a downloading site that serves malicious APKs. Some of the themes observed in campaign include \u00e2\u20ac\u0153Kurdistan referendum\u00e2\u20ac\u009d, \u00e2\u20ac\u0153TelegramGroups\u00e2\u20ac\u009d and \u00e2\u20ac\u0153Alnaharegypt news\u00e2\u20ac\u009d, among others. \r\n\r\nTarget profile has evolved during the last years of campaign, focusing on victims in Egypt, Jordan, Morocco and Lebanon." }, { "category": "Network activity", "comment": "Watering holes", "deleted": false, "disable_correlation": false, "timestamp": "1525433954", "to_ids": true, "type": "url", "uuid": "5aec21f5-231c-4ea4-9683-481d950d210f", "value": "http://www.alnaharegypt.com/t~467369" }, { "category": "Network activity", "comment": "Watering holes", "deleted": false, "disable_correlation": false, "timestamp": "1525433955", "to_ids": true, "type": "url", "uuid": "5aec21f5-e3c4-4426-bf33-4d28950d210f", "value": "http://showroommontorgueil.com/modules/homepageadvertise2/slides/alnaharegypt.news_v2.0.apk" }, { "category": "Network activity", "comment": "Watering holes", "deleted": false, "disable_correlation": false, "timestamp": "1525433955", "to_ids": true, "type": "url", "uuid": "5aec21f6-3204-42b7-8583-482c950d210f", "value": "http://www.alhayatnews.com/ArabicRSS.apk" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525433956", "to_ids": true, "type": "url", "uuid": "5aec312f-2280-408b-8fb4-48bf950d210f", "value": "http://www.rhubarb2.com/telg/sv/sv.php" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525433956", "to_ids": true, "type": "url", "uuid": "5aec3170-cf04-4f1a-8b7c-47c8950d210f", "value": "http://www.rhubarb2.com/get/index.php?id=" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525433957", "to_ids": true, "type": "url", "uuid": "5aec3171-a648-4a7b-9da9-4bb8950d210f", "value": "http://www.rhubarb2.com/telg/index.php?set=show" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525433958", "to_ids": true, "type": "url", "uuid": "5aec4260-e03c-4a10-94e8-74f2950d210f", "value": "http://www.rhubarb3.com/get/index.php?id=" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525433958", "to_ids": true, "type": "url", "uuid": "5aec4261-7c88-40a3-a811-74f2950d210f", "value": "androidupdaters.com/img.jpg" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525433959", "to_ids": true, "type": "url", "uuid": "5aec4261-23c8-495d-a098-74f2950d210f", "value": "rhubarb3.com/telg/sv/sv.php" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525433959", "to_ids": true, "type": "url", "uuid": "5aec4262-262c-4d1b-afdb-74f2950d210f", "value": "rhubarb3.com/telg/index.php" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525433959", "to_ids": true, "type": "url", "uuid": "5aec4262-0fb4-4591-83fa-74f2950d210f", "value": "rhubarb3.com/get/index.php" } ], "Object": [ { "comment": "Version 1.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525425014", "uuid": "5aec2376-7238-4823-a66f-4098950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525425014", "to_ids": true, "type": "md5", "uuid": "5aec2376-a8b0-4f2c-b766-4958950d210f", "value": "232bd3dde6914db0a3dbfc21ed178887" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525425014", "to_ids": true, "type": "filename", "uuid": "5aec2376-1a48-42d0-96ca-4c1d950d210f", "value": "Entekhab10 V1.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525425014", "to_ids": false, "type": "text", "uuid": "5aec2376-3170-4baf-aa26-47cf950d210f", "value": "Malicious" } ] }, { "comment": "Version 1.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525425467", "uuid": "5aec253b-b91c-4875-9bbe-46a4950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525425467", "to_ids": true, "type": "md5", "uuid": "5aec253b-d16c-4619-98e0-4d65950d210f", "value": "5efddd7f0fc2125e78a2ca18b68464ec" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525425468", "to_ids": true, "type": "filename", "uuid": "5aec253c-1190-43bd-81f4-4e37950d210f", "value": "Entekhab10-v3.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525425468", "to_ids": false, "type": "text", "uuid": "5aec253c-e6b8-49db-9c7d-4ceb950d210f", "value": "Malicious" } ] }, { "comment": "Version 1.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525426141", "uuid": "5aec27dd-65e4-4294-9cf5-4b35950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525426142", "to_ids": true, "type": "md5", "uuid": "5aec27de-5b34-40dc-b3e9-4829950d210f", "value": "ec5a6f0e743f4b858aba9de96a33fb0c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525426142", "to_ids": true, "type": "filename", "uuid": "5aec27de-632c-4a89-8c69-433f950d210f", "value": "TelegramGroups.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525426142", "to_ids": false, "type": "text", "uuid": "5aec27de-b6fc-42e6-bc1a-4ea7950d210f", "value": "Malicious" } ] }, { "comment": "Version 2.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525426173", "uuid": "5aec27fd-501c-40b3-9c57-434b950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525426174", "to_ids": true, "type": "md5", "uuid": "5aec27fe-806c-4152-b5d6-47f8950d210f", "value": "6a388edbce88bb0331ae875ceeb2f319" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525426174", "to_ids": true, "type": "filename", "uuid": "5aec27fe-3838-4700-aade-4fa6950d210f", "value": "AllInOne.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525426174", "to_ids": false, "type": "text", "uuid": "5aec27fe-9314-4a9a-b7f9-4a68950d210f", "value": "Malicious" } ] }, { "comment": "Version 2.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525426189", "uuid": "5aec280d-da64-4155-96aa-4e71950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525426190", "to_ids": true, "type": "md5", "uuid": "5aec280e-f2ec-4c38-b41a-4abf950d210f", "value": "e2f62b5acf3795a62e9d54e1301c4e7b" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525426190", "to_ids": false, "type": "text", "uuid": "5aec280e-5470-4c5f-b4c9-4999950d210f", "value": "Malicious" } ] }, { "comment": "Version 2.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525426216", "uuid": "5aec2828-6448-49d4-93b7-4ee6950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525426216", "to_ids": true, "type": "md5", "uuid": "5aec2828-a734-4c07-98c2-44a8950d210f", "value": "cb67abd070ae188390fc040cbe60e677" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525426217", "to_ids": true, "type": "filename", "uuid": "5aec2829-1e34-4979-92b5-486c950d210f", "value": "Referendum Kurdistan.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525426217", "to_ids": false, "type": "text", "uuid": "5aec2829-abe4-40f2-8844-493a950d210f", "value": "Malicious" } ] }, { "comment": "Version 2.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525426255", "uuid": "5aec284f-bab0-4ccc-a5a4-45d8950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525426255", "to_ids": true, "type": "md5", "uuid": "5aec284f-b784-4a7e-926b-4697950d210f", "value": "cb67abd070ae188390fc040cbe60e677" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525426256", "to_ids": true, "type": "filename", "uuid": "5aec2850-d7dc-4c05-bd21-48eb950d210f", "value": "Referendum Kurdistan.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525426256", "to_ids": false, "type": "text", "uuid": "5aec2850-374c-4a48-949d-4ca6950d210f", "value": "Malicious" } ] }, { "comment": "Version 2.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525426273", "uuid": "5aec2861-cf0c-4a9d-a128-4a65950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525426273", "to_ids": true, "type": "md5", "uuid": "5aec2861-f178-4781-af8e-4e6a950d210f", "value": "699a7eedd244f402303bcffdee1f0ed1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525426273", "to_ids": false, "type": "text", "uuid": "5aec2861-503c-4551-a2f5-4c0f950d210f", "value": "Malicious" } ] }, { "comment": "Version 3.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525426768", "uuid": "5aec2a50-d48c-431d-b9ce-4a73950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525426768", "to_ids": true, "type": "md5", "uuid": "5aec2a50-f27c-43da-b58c-457f950d210f", "value": "7d7ad116e6a42d4e518378e2313e9392" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525426769", "to_ids": true, "type": "filename", "uuid": "5aec2a51-3658-4c11-a08f-41d2950d210f", "value": "Sexy_wallpaper.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525426769", "to_ids": false, "type": "text", "uuid": "5aec2a51-effc-4914-8e89-4fdf950d210f", "value": "Malicious" } ] }, { "comment": "Version 3.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525426787", "uuid": "5aec2a63-d16c-4fa9-869a-4b93950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525426787", "to_ids": true, "type": "md5", "uuid": "5aec2a63-ce3c-4888-a653-4db4950d210f", "value": "a7d00c8629079f944b61c4dd5c77c8fb" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525426788", "to_ids": true, "type": "filename", "uuid": "5aec2a64-8cf4-4d88-a303-4851950d210f", "value": "ArabicRSS.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525426788", "to_ids": false, "type": "text", "uuid": "5aec2a64-dd94-405f-8b34-4836950d210f", "value": "Malicious" } ] }, { "comment": "Version 3.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525426887", "uuid": "5aec2ac7-4a48-4856-af56-42a5950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525426887", "to_ids": true, "type": "md5", "uuid": "5aec2ac7-7f20-43b7-aee9-47ff950d210f", "value": "b714b092d2f28fcf78ef8d02b46dbf9c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525426887", "to_ids": true, "type": "filename", "uuid": "5aec2ac7-d218-447c-84f7-4588950d210f", "value": "Alnaharegypt.news_v2.0.apk" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525426887", "to_ids": true, "type": "filename", "uuid": "5aec2ac7-4090-487c-b6f0-461a950d210f", "value": "familyinnovation_app.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525426887", "to_ids": false, "type": "text", "uuid": "5aec2ac7-cb9c-42c1-a0cf-4f6c950d210f", "value": "Malicious" } ] }, { "comment": "Version 3.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525426901", "uuid": "5aec2ad5-f324-4b6f-bec6-41f7950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525426901", "to_ids": true, "type": "md5", "uuid": "5aec2ad5-9934-4ed8-bd3c-4c34950d210f", "value": "ac4402e04de0949d7beed975db84e594" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525426901", "to_ids": true, "type": "filename", "uuid": "5aec2ad5-4004-489b-98c5-4474950d210f", "value": "com.ann.newspaper.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525426901", "to_ids": false, "type": "text", "uuid": "5aec2ad5-6e7c-4a89-9a84-4a07950d210f", "value": "Malicious" } ] }, { "comment": "Version 4.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525427652", "uuid": "5aec2dc4-5bec-4615-954d-4b19950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525427652", "to_ids": true, "type": "md5", "uuid": "5aec2dc4-aeb0-412d-98cc-413e950d210f", "value": "519018ecfc50c0cf6cd0c88cc41b2a69" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525427653", "to_ids": true, "type": "filename", "uuid": "5aec2dc5-13b4-45de-bbab-4196950d210f", "value": "FirewallFA.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525427653", "to_ids": false, "type": "text", "uuid": "5aec2dc5-f20c-4d9f-8d0a-437d950d210f", "value": "Malicious" } ] }, { "comment": "Version 4.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525427669", "uuid": "5aec2dd5-d610-4d7f-9902-438b950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525427670", "to_ids": true, "type": "md5", "uuid": "5aec2dd6-e158-4525-894a-42ac950d210f", "value": "5ad36f6dd060e52771a8e4a1dd90c50c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525427670", "to_ids": true, "type": "filename", "uuid": "5aec2dd6-b51c-4cb7-b2a0-4d1c950d210f", "value": "DVPNEasy.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525427670", "to_ids": false, "type": "text", "uuid": "5aec2dd6-df2c-421e-a069-4055950d210f", "value": "Malicious" } ] }, { "comment": "Version 4.0", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525427690", "uuid": "5aec2dea-61c4-47b6-acde-45a6950d210f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525427691", "to_ids": true, "type": "md5", "uuid": "5aec2deb-ffb0-42c8-97f1-415a950d210f", "value": "b44b91b14f176fbf93d998141931a4aa" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1525427691", "to_ids": true, "type": "filename", "uuid": "5aec2deb-924c-495e-97a4-4baa950d210f", "value": "DeleteTelegram.apk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1525427691", "to_ids": false, "type": "text", "uuid": "5aec2deb-9a34-49c9-b6c7-4a6f950d210f", "value": "Malicious" } ] }, { "comment": "", "deleted": false, "description": "Whois records information for a domain name or an IP address.", "meta-category": "network", "name": "whois", "template_uuid": "429faea1-34ff-47af-8a00-7c62d3be5a6a", "template_version": "9", "timestamp": "1525432636", "uuid": "5aec413c-f01c-4c19-9761-4a1a950d210f", "Attribute": [ { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "registrant-email", "timestamp": "1525432636", "to_ids": false, "type": "whois-registrant-email", "uuid": "5aec413c-96e0-42d7-9cef-4504950d210f", "value": "asgharkhof@gmail.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1525432636", "to_ids": true, "type": "domain", "uuid": "5aec413c-73e4-48a7-9eb5-4d1c950d210f", "value": "androidupdaters.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ip-address", "timestamp": "1525432637", "to_ids": true, "type": "ip-src", "uuid": "5aec413d-12e0-454d-9188-4856950d210f", "value": "178.162.214.146" }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "registrant-name", "timestamp": "1525432637", "to_ids": false, "type": "whois-registrant-name", "uuid": "5aec413d-767c-40ef-9001-46d7950d210f", "value": "parspack 62555" }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "registrant-phone", "timestamp": "1525432638", "to_ids": false, "type": "whois-registrant-phone", "uuid": "5aec413e-c298-44cd-8ffc-4a8c950d210f", "value": "+982188561212" } ] }, { "comment": "", "deleted": false, "description": "Whois records information for a domain name or an IP address.", "meta-category": "network", "name": "whois", "template_uuid": "429faea1-34ff-47af-8a00-7c62d3be5a6a", "template_version": "9", "timestamp": "1525432732", "uuid": "5aec419c-5240-4635-ab6f-14ac950d210f", "Attribute": [ { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "registrant-email", "timestamp": "1525432733", "to_ids": false, "type": "whois-registrant-email", "uuid": "5aec419d-4218-46d5-82bc-14ac950d210f", "value": "silent.city2020@mail.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1525432733", "to_ids": true, "type": "domain", "uuid": "5aec419d-80cc-4668-9cc2-14ac950d210f", "value": "dlgmail.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ip-address", "timestamp": "1525432734", "to_ids": true, "type": "ip-src", "uuid": "5aec419e-04e8-4822-b841-14ac950d210f", "value": "46.4.41.195" }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "registrant-name", "timestamp": "1525432734", "to_ids": false, "type": "whois-registrant-name", "uuid": "5aec419e-8508-45dc-a7b1-14ac950d210f", "value": "mohammad hosein asna ashar" }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "registrant-phone", "timestamp": "1525432735", "to_ids": false, "type": "whois-registrant-phone", "uuid": "5aec419f-0dc0-41a8-ab47-14ac950d210f", "value": "+982188888299" } ] }, { "comment": "", "deleted": false, "description": "Whois records information for a domain name or an IP address.", "meta-category": "network", "name": "whois", "template_uuid": "429faea1-34ff-47af-8a00-7c62d3be5a6a", "template_version": "9", "timestamp": "1525432816", "uuid": "5aec41f0-bfb0-40d4-bd05-1703950d210f", "Attribute": [ { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "registrant-email", "timestamp": "1525432816", "to_ids": false, "type": "whois-registrant-email", "uuid": "5aec41f0-0070-4f0e-a930-1703950d210f", "value": "pilton86@yahoo.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1525432817", "to_ids": true, "type": "domain", "uuid": "5aec41f1-424c-472e-a5a9-1703950d210f", "value": "rhubarb2.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ip-address", "timestamp": "1525432817", "to_ids": true, "type": "ip-src", "uuid": "5aec41f1-3e28-4e7c-b5fe-1703950d210f", "value": "109.200.28.162" }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "registrant-name", "timestamp": "1525432818", "to_ids": false, "type": "whois-registrant-name", "uuid": "5aec41f2-5424-4f0e-bf2b-1703950d210f", "value": "Mohsen Malekian" }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "registrant-phone", "timestamp": "1525432818", "to_ids": false, "type": "whois-registrant-phone", "uuid": "5aec41f2-1678-4088-9251-1703950d210f", "value": "+989303938251" } ] }, { "comment": "", "deleted": false, "description": "A domain and IP address seen as a tuple in a specific time frame.", "meta-category": "network", "name": "domain-ip", "template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734", "template_version": "5", "timestamp": "1525432873", "uuid": "5aec4229-9244-4408-b095-4408950d210f", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1525432873", "to_ids": true, "type": "ip-dst", "uuid": "5aec4229-4e54-440e-ba94-4376950d210f", "value": "5.144.130.33" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ip", "timestamp": "1525432874", "to_ids": true, "type": "ip-dst", "uuid": "5aec422a-17e8-4c19-9ee2-467a950d210f", "value": "46.4.74.56" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1525432874", "to_ids": true, "type": "domain", "uuid": "5aec422a-76d8-45ba-95b0-4906950d210f", "value": "rhubarb3.com" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "7", "timestamp": "1525433963", "uuid": "27686eee-e891-46e5-b144-cb0e10e53c8f", "ObjectReference": [ { "comment": "", "object_uuid": "27686eee-e891-46e5-b144-cb0e10e53c8f", "referenced_uuid": "35191532-c69c-43b6-837e-36ca962d6e48", "relationship_type": "analysed-with", "timestamp": "1525433982", "uuid": "5aec467e-77e0-4a7b-883a-753902de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525433960", "to_ids": true, "type": "md5", "uuid": "5aec4668-0a28-48b6-bb18-753902de0b81", "value": "7d7ad116e6a42d4e518378e2313e9392" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525433961", "to_ids": true, "type": "sha1", "uuid": "5aec4669-40d4-453e-a114-753902de0b81", "value": "237ccbbe5641bc2cb7283757d91d65bc641d6a26" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525433961", "to_ids": true, "type": "sha256", "uuid": "5aec4669-ee80-40e5-8794-753902de0b81", "value": "f7fe4e299599a60a4797f9a13468e366394dc2d86ab768f681a0876d8ff052e0" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "1", "timestamp": "1525433961", "uuid": "35191532-c69c-43b6-837e-36ca962d6e48", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525433961", "to_ids": false, "type": "datetime", "uuid": "5aec4669-e710-4033-b4f7-753902de0b81", "value": "2018-05-03T13:06:24" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525433962", "to_ids": false, "type": "text", "uuid": "5aec466a-b1dc-40ab-b171-753902de0b81", "value": "32/62" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525433962", "to_ids": false, "type": "link", "uuid": "5aec466a-3240-4c5d-8fff-753902de0b81", "value": "https://www.virustotal.com/file/f7fe4e299599a60a4797f9a13468e366394dc2d86ab768f681a0876d8ff052e0/analysis/1525352784/" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "7", "timestamp": "1525433965", "uuid": "30b25aaa-3cb2-4cd1-abf5-08129005f43d", "ObjectReference": [ { "comment": "", "object_uuid": "30b25aaa-3cb2-4cd1-abf5-08129005f43d", "referenced_uuid": "f3617dcc-af62-4280-9c9a-ab9d3d299f03", "relationship_type": "analysed-with", "timestamp": "1525433983", "uuid": "5aec467f-39c8-4361-bc1f-753902de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525433962", "to_ids": true, "type": "md5", "uuid": "5aec466a-0240-4975-9bff-753902de0b81", "value": "ac4402e04de0949d7beed975db84e594" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525433963", "to_ids": true, "type": "sha1", "uuid": "5aec466b-4234-414e-a728-753902de0b81", "value": "d4e379313afdd60da889ba6516c754d7018802a1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525433963", "to_ids": true, "type": "sha256", "uuid": "5aec466b-116c-4d1a-90fe-753902de0b81", "value": "91659d5f35a8fea1c98f3ea32bcdd71a222f11095de680eb635ec8210fb5dc04" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "1", "timestamp": "1525433964", "uuid": "f3617dcc-af62-4280-9c9a-ab9d3d299f03", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525433964", "to_ids": false, "type": "datetime", "uuid": "5aec466c-5b68-4eb8-917a-753902de0b81", "value": "2018-05-03T13:05:58" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525433964", "to_ids": false, "type": "text", "uuid": "5aec466c-8730-48e8-aa3d-753902de0b81", "value": "29/61" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525433964", "to_ids": false, "type": "link", "uuid": "5aec466c-7560-4eef-8a29-753902de0b81", "value": "https://www.virustotal.com/file/91659d5f35a8fea1c98f3ea32bcdd71a222f11095de680eb635ec8210fb5dc04/analysis/1525352758/" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "7", "timestamp": "1525433968", "uuid": "603ec016-9820-4262-b877-f42d0c72a95c", "ObjectReference": [ { "comment": "", "object_uuid": "603ec016-9820-4262-b877-f42d0c72a95c", "referenced_uuid": "d6a1412f-41bc-4263-8422-139cc4ec59a8", "relationship_type": "analysed-with", "timestamp": "1525433983", "uuid": "5aec467f-db4c-4733-866d-753902de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525433965", "to_ids": true, "type": "md5", "uuid": "5aec466d-3764-4a46-aeda-753902de0b81", "value": "6a388edbce88bb0331ae875ceeb2f319" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525433965", "to_ids": true, "type": "sha1", "uuid": "5aec466d-92a4-4ffc-8424-753902de0b81", "value": "a3e88929cc9347708caf88b371e8555a0b40bbae" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525433966", "to_ids": true, "type": "sha256", "uuid": "5aec466e-1cd8-4742-9f17-753902de0b81", "value": "041b4d2280cae9720a62350de4541172933909380bb02701a7d20f87e670bac4" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "1", "timestamp": "1525433966", "uuid": "d6a1412f-41bc-4263-8422-139cc4ec59a8", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525433967", "to_ids": false, "type": "datetime", "uuid": "5aec466f-5368-47e6-a785-753902de0b81", "value": "2018-05-03T13:06:17" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525433967", "to_ids": false, "type": "text", "uuid": "5aec466f-c880-422c-ae4b-753902de0b81", "value": "5/62" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525433967", "to_ids": false, "type": "link", "uuid": "5aec466f-a100-4c3c-847e-753902de0b81", "value": "https://www.virustotal.com/file/041b4d2280cae9720a62350de4541172933909380bb02701a7d20f87e670bac4/analysis/1525352777/" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "7", "timestamp": "1525433970", "uuid": "1f4deeda-c969-4626-8eae-d5f557f2937a", "ObjectReference": [ { "comment": "", "object_uuid": "1f4deeda-c969-4626-8eae-d5f557f2937a", "referenced_uuid": "dd172fdf-c047-47b9-bc67-8cae925cf527", "relationship_type": "analysed-with", "timestamp": "1525433983", "uuid": "5aec467f-0090-490f-810a-753902de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525433968", "to_ids": true, "type": "md5", "uuid": "5aec4670-9a10-41f3-a50c-753902de0b81", "value": "cb67abd070ae188390fc040cbe60e677" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525433968", "to_ids": true, "type": "sha1", "uuid": "5aec4670-9628-4fa9-bd77-753902de0b81", "value": "c9fb4cd14d88fc7ea6212f213e1f07f5a781edba" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525433969", "to_ids": true, "type": "sha256", "uuid": "5aec4671-f90c-4294-9a10-753902de0b81", "value": "d7da061b55d24a54988a3fca60009da907d14c2bcd32f2e53ef13bd8085b96cc" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "1", "timestamp": "1525433969", "uuid": "dd172fdf-c047-47b9-bc67-8cae925cf527", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525433969", "to_ids": false, "type": "datetime", "uuid": "5aec4671-c914-422f-8d45-753902de0b81", "value": "2018-05-03T13:06:30" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525433970", "to_ids": false, "type": "text", "uuid": "5aec4672-3614-4500-af7b-753902de0b81", "value": "11/62" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525433970", "to_ids": false, "type": "link", "uuid": "5aec4672-056c-42a9-94e1-753902de0b81", "value": "https://www.virustotal.com/file/d7da061b55d24a54988a3fca60009da907d14c2bcd32f2e53ef13bd8085b96cc/analysis/1525352790/" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "7", "timestamp": "1525433973", "uuid": "042c8757-07c8-4c84-8b0c-300b1d946d41", "ObjectReference": [ { "comment": "", "object_uuid": "042c8757-07c8-4c84-8b0c-300b1d946d41", "referenced_uuid": "66ec9834-1856-4819-81d0-a7a19e5f8eea", "relationship_type": "analysed-with", "timestamp": "1525433983", "uuid": "5aec467f-64a8-4ea6-b575-753902de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525433970", "to_ids": true, "type": "md5", "uuid": "5aec4672-674c-43d2-9a73-753902de0b81", "value": "699a7eedd244f402303bcffdee1f0ed1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525433971", "to_ids": true, "type": "sha1", "uuid": "5aec4673-f44c-454b-8ae3-753902de0b81", "value": "09b2108e72f0b9e0b382a43ead5c0a0e16cb50fa" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525433971", "to_ids": true, "type": "sha256", "uuid": "5aec4673-4048-47e8-bec0-753902de0b81", "value": "7a7eee78dfffa5974a2da9bdd3337fb16e5e1d658cbe5284ef352114ef446f6a" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "1", "timestamp": "1525433972", "uuid": "66ec9834-1856-4819-81d0-a7a19e5f8eea", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525433972", "to_ids": false, "type": "datetime", "uuid": "5aec4674-045c-48ca-aec0-753902de0b81", "value": "2018-05-03T13:06:03" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525433972", "to_ids": false, "type": "text", "uuid": "5aec4674-2c68-429c-a76d-753902de0b81", "value": "17/63" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525433972", "to_ids": false, "type": "link", "uuid": "5aec4674-6cc0-4564-963b-753902de0b81", "value": "https://www.virustotal.com/file/7a7eee78dfffa5974a2da9bdd3337fb16e5e1d658cbe5284ef352114ef446f6a/analysis/1525352763/" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "7", "timestamp": "1525433976", "uuid": "c6337b0c-b9a1-4c12-92e5-3223c4abd133", "ObjectReference": [ { "comment": "", "object_uuid": "c6337b0c-b9a1-4c12-92e5-3223c4abd133", "referenced_uuid": "a4c9366f-a617-4a9e-bd17-da10b804814b", "relationship_type": "analysed-with", "timestamp": "1525433983", "uuid": "5aec467f-4524-47d3-92e1-753902de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525433973", "to_ids": true, "type": "md5", "uuid": "5aec4675-7304-410b-97bf-753902de0b81", "value": "b714b092d2f28fcf78ef8d02b46dbf9c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525433973", "to_ids": true, "type": "sha1", "uuid": "5aec4675-a868-4a30-9cb4-753902de0b81", "value": "5a0d2064f7de0c98e91cabaeca2b7f5aa6da70f5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525433974", "to_ids": true, "type": "sha256", "uuid": "5aec4676-401c-44fd-b161-753902de0b81", "value": "24ee4589a7ed9c7fc630ecbb79d4114ab7ae8ae36b31da42e3fcfbb9edaafdc6" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "1", "timestamp": "1525433974", "uuid": "a4c9366f-a617-4a9e-bd17-da10b804814b", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525433975", "to_ids": false, "type": "datetime", "uuid": "5aec4677-e27c-4427-a864-753902de0b81", "value": "2018-05-03T13:06:47" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525433975", "to_ids": false, "type": "text", "uuid": "5aec4677-4d90-4f08-9843-753902de0b81", "value": "29/60" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525433975", "to_ids": false, "type": "link", "uuid": "5aec4677-0f6c-47b1-b347-753902de0b81", "value": "https://www.virustotal.com/file/24ee4589a7ed9c7fc630ecbb79d4114ab7ae8ae36b31da42e3fcfbb9edaafdc6/analysis/1525352807/" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "7", "timestamp": "1525433978", "uuid": "a57227d9-7325-46f3-ace1-e19ca49e51ec", "ObjectReference": [ { "comment": "", "object_uuid": "a57227d9-7325-46f3-ace1-e19ca49e51ec", "referenced_uuid": "07699f23-1898-4fd7-86d3-29fa7c088378", "relationship_type": "analysed-with", "timestamp": "1525433983", "uuid": "5aec467f-ed34-4d62-beff-753902de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525433976", "to_ids": true, "type": "md5", "uuid": "5aec4678-4698-4ee0-b3b4-753902de0b81", "value": "e2f62b5acf3795a62e9d54e1301c4e7b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525433976", "to_ids": true, "type": "sha1", "uuid": "5aec4678-c698-41f7-863e-753902de0b81", "value": "163cb08bd60eb61b71a7c4f1891d1269b1954e6c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525433976", "to_ids": true, "type": "sha256", "uuid": "5aec4678-e818-406e-ab25-753902de0b81", "value": "59ece87dfa254ba8d47503e069e5e2cb99e22140e9a2e6e56d382a6427171889" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "1", "timestamp": "1525433977", "uuid": "07699f23-1898-4fd7-86d3-29fa7c088378", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525433977", "to_ids": false, "type": "datetime", "uuid": "5aec4679-3a48-4bbc-b5b3-753902de0b81", "value": "2018-05-03T13:06:10" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525433977", "to_ids": false, "type": "text", "uuid": "5aec4679-97e0-4927-9f54-753902de0b81", "value": "17/60" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525433977", "to_ids": false, "type": "link", "uuid": "5aec4679-f774-4d70-87bc-753902de0b81", "value": "https://www.virustotal.com/file/59ece87dfa254ba8d47503e069e5e2cb99e22140e9a2e6e56d382a6427171889/analysis/1525352770/" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "7", "timestamp": "1525433981", "uuid": "d0ecc2c5-6e10-4077-ac69-28ed3a6a374f", "ObjectReference": [ { "comment": "", "object_uuid": "d0ecc2c5-6e10-4077-ac69-28ed3a6a374f", "referenced_uuid": "70ca0203-d569-42dd-8538-112a5385c7bd", "relationship_type": "analysed-with", "timestamp": "1525433983", "uuid": "5aec467f-7310-4b31-879a-753902de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525433978", "to_ids": true, "type": "md5", "uuid": "5aec467a-f634-4480-a247-753902de0b81", "value": "ec5a6f0e743f4b858aba9de96a33fb0c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525433978", "to_ids": true, "type": "sha1", "uuid": "5aec467a-a514-4e2d-9537-753902de0b81", "value": "06fb916999081a9496715eaf72a77452a11ab09c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525433979", "to_ids": true, "type": "sha256", "uuid": "5aec467b-f424-4de3-b489-753902de0b81", "value": "76fa36d35e0e16b0ea416726b0da2a66dfe7d7b35504cf6c475eac4cfa95fe3a" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "1", "timestamp": "1525433979", "uuid": "70ca0203-d569-42dd-8538-112a5385c7bd", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525433979", "to_ids": false, "type": "datetime", "uuid": "5aec467b-cc64-4270-ab55-753902de0b81", "value": "2018-05-04T08:50:01" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525433979", "to_ids": false, "type": "text", "uuid": "5aec467b-e32c-4658-8ada-753902de0b81", "value": "9/61" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525433979", "to_ids": false, "type": "link", "uuid": "5aec467b-e7fc-4d73-a04c-753902de0b81", "value": "https://www.virustotal.com/file/76fa36d35e0e16b0ea416726b0da2a66dfe7d7b35504cf6c475eac4cfa95fe3a/analysis/1525423801/" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "7", "timestamp": "1525433983", "uuid": "29f9cb3b-24a0-48f9-b03b-55160ffa3040", "ObjectReference": [ { "comment": "", "object_uuid": "29f9cb3b-24a0-48f9-b03b-55160ffa3040", "referenced_uuid": "36852ace-b32b-49ce-b563-4c1d366459d8", "relationship_type": "analysed-with", "timestamp": "1525433983", "uuid": "5aec467f-3e18-44e6-93e5-753902de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525433980", "to_ids": true, "type": "md5", "uuid": "5aec467c-98d4-4091-9951-753902de0b81", "value": "5efddd7f0fc2125e78a2ca18b68464ec" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525433980", "to_ids": true, "type": "sha1", "uuid": "5aec467c-b934-4f4d-b995-753902de0b81", "value": "82a5907e3be0cac185913f143e2e77c6e8578e7d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525433981", "to_ids": true, "type": "sha256", "uuid": "5aec467d-c8c0-4e4f-9931-753902de0b81", "value": "0601fc10951b780efb7da41b25f1e41fdb347374e81858cc894e8d8fd2106b7b" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "1", "timestamp": "1525433981", "uuid": "36852ace-b32b-49ce-b563-4c1d366459d8", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525433981", "to_ids": false, "type": "datetime", "uuid": "5aec467d-ed5c-441c-8497-753902de0b81", "value": "2018-05-03T21:28:50" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525433982", "to_ids": false, "type": "text", "uuid": "5aec467e-0adc-4e9c-ad61-753902de0b81", "value": "10/62" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525433982", "to_ids": false, "type": "link", "uuid": "5aec467e-d5a8-4a15-ad0b-753902de0b81", "value": "https://www.virustotal.com/file/0601fc10951b780efb7da41b25f1e41fdb347374e81858cc894e8d8fd2106b7b/analysis/1525382930/" } ] } ] } }