{
  "Event": {
    "analysis": "2",
    "date": "2017-04-20",
    "extends_uuid": "",
    "info": "OSINT - Cardinal RAT Active for Over Two Years",
    "publish_timestamp": "1493029090",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1493029059",
    "uuid": "58fdc3f2-69b4-4aba-a5ec-4a2f950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#4bec00",
        "local": false,
        "name": "enisa:nefarious-activity-abuse=\"remote-access-tool\"",
        "relationship_type": ""
      },
      {
        "colour": "#00223b",
        "local": false,
        "name": "osint:source-type=\"blog-post\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc7ea-ad84-4e32-9d3b-4a96950d210f",
        "value": "a52ba498d304906d6c060e8c56ad7db50e1af0a781616c0aa35447c50c28bae9"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc7eb-c650-458e-bea9-455a950d210f",
        "value": "5025aa0fc6d4ac6daa2d9a6452263dcc20d6906149fc0995d458ed38e7e57b61"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc7ed-5588-4e51-aa4b-43ed950d210f",
        "value": "1181f97071d8f96f9cdfb0f39b697204413cc0a715aa4935fe8964209289b331"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc7ee-b690-4ba3-84bf-4cc4950d210f",
        "value": "84e705341a48c8c6552a7d3dd97b7cd968d2a9bc281a70c287df70813f5dca52"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc7ef-5114-4f90-9e84-43f1950d210f",
        "value": "ae1a6c4f917772100e3a5dc1fab7de4a277876a6e626da114baf8179b13b0031"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc7f0-5dc0-4dc4-bec6-4c80950d210f",
        "value": "e49e61da52430011f1a22084a601cc08005865fe9a76abf503a4a9d2e11a5450"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc7f1-11e0-4889-997e-41d1950d210f",
        "value": "192b204dbc702d3762c953544975b61db8347a7739c6d8884bb4594bd816bf91"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc7f2-f53c-4e3e-a999-4d88950d210f",
        "value": "571b58ba655463705f45d2541f0fde049c83389a69552f98e41ece734a59f8d4"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc7f2-884c-4dee-8b39-4335950d210f",
        "value": "10f53502922bf837900935892fb1da28fc712848471bf4afcdd08440d3bd037f"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc7f3-cb90-4060-9407-4d0d950d210f",
        "value": "8bea55d2e35a2281ed71a59f1feb4c1cf6af1c053a94781c033a94d8e4c853e5"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc7f4-0b84-4962-b0cb-4409950d210f",
        "value": "057965e8b6638f0264d89872e80366b23255f1a0a30fd4efb7884c71b4104235"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8a7-f4d8-432c-b88f-4be1950d210f",
        "value": "e017651dd9e9419a7f1714f8f2cdc3d8e75aebbe6d3cfbb2de3f042f39aec3bd"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8a8-3f54-4062-9150-4b5c950d210f",
        "value": "778090182a10fde1b4c1571d1e853e123f6ab1682e17dabe2e83468b518c01df"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8a9-7c2c-407a-b756-4bdd950d210f",
        "value": "8fababb509ad8230e4d6fa1e6403602a97e60dc8ef517016f86195143cf50f4e"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8aa-8c40-48d8-be13-4943950d210f",
        "value": "1977cedcfb8726dea5e915b47e1479256674551bc0fe0b55ddd3fa3b15eb82b2"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8ab-c1e0-4948-89fc-408e950d210f",
        "value": "16aab89d74c1eaaf1e94028c8ccceef442eb2cd5b052cba3562d2b1b1a3a4ba6"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8ad-ac08-496c-9973-493c950d210f",
        "value": "9c47b2af8b8c5f3c25f237dcc375b41835904f7cd99221c7489fb3563c34c9ab"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8ae-b7e4-4128-9344-44e3950d210f",
        "value": "211b7b7a4c4a07b9c65fae361570dbb94666e26f0cc0fa0b32df4b09fcee6de2"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8af-1a98-4e1d-8027-419e950d210f",
        "value": "fd61a5cd1a83f68b75d47c8b6041f8640e47510925caee8176d5d81afac29134"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8b0-4fc0-47af-be94-47c8950d210f",
        "value": "84f822d9cf575aeea867e9b73f88ad4d9244293e52208644e12ff2cf13b6b537"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8b1-a530-46ca-af5a-4a35950d210f",
        "value": "855cf3a6422b0bf680d505720fd07c396508f67518670b493dba902c3c2e5dfa"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8b2-72a8-4110-9c99-4d8b950d210f",
        "value": "4b4c6b36938c3de0623feb92c0e1cb399d2dc338d2095b8ba84e862ef6d11772"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8b2-a40c-47d5-8048-44b0950d210f",
        "value": "5dd162ab66f0c819ee73868c26ecd82408422e2b6366805631eab95ae32516f3"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8b3-ce20-4858-83c7-4108950d210f",
        "value": "6e2991e02d3cf17d77173d50cdaa766661a89721c3cc4050fba98bea0dbdb1a9"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8b4-28c4-4c1d-a764-473b950d210f",
        "value": "1e8ed6e8d0b6fc47d8176c874ed40fb09644c058042f34d987878fa644f493cc"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8b5-91bc-4dd9-9f7a-403d950d210f",
        "value": "647e379517fed71682423b0192da453ec1d61a633c154fdd55bab762bcc404f3"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8b6-257c-4bf8-934c-419a950d210f",
        "value": "ebd4f45cbb272bcc4954cf1bd0a5b8802a6e501688f2a1abdb6143ba616aea82"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8b7-f064-4a44-99da-4764950d210f",
        "value": "edc49bf7ec508becb088d5082c78d360f1a7cad520f6de6d8b93759b67aac305"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8b8-a4dc-43ca-a46c-4fc1950d210f",
        "value": "7482f8c86b63ce53edcb62fc2ff2dd8e584e2164451ae0c6f2b1f4d6d0cb6d9c"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8b9-2180-4d60-a795-4059950d210f",
        "value": "2fbd3d2362acd1c8f0963b48d01f94c7a07aeac52d23415d0498c8c9e23554db"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8ba-35ac-4fb4-8399-41d5950d210f",
        "value": "154e3a12404202fd25e29e754ff78703d4edd7da73cb4c283c9910fd526d47db"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8bb-82a0-4ec9-901c-453d950d210f",
        "value": "fc5f7a21d953c394968647df6a37e1f61db04968ad1aca65ad8f261b363fa842"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8bc-c7c4-468e-bc8d-4cd4950d210f",
        "value": "a1d5b7d69d85b1be31d9e1cb0686094cc7b1213079b2a66ace01be4bfe3fb7c3"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8bc-f430-4f6e-96c6-448d950d210f",
        "value": "4b0203492a95257707a86992e84b5085ce9e11810a26920dbb085005081e32d3"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8bd-c448-4638-8e85-4ec9950d210f",
        "value": "a05805bcec72fb76b997c456e0fd6c4b219fdc51cad70d4a58c16b0b0e2d9ba1"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8be-eef8-43c8-999f-4712950d210f",
        "value": "4e953ea82b0406a5b95e31554628ad6821b1d91e9ada0d26179977f227cf01ad"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8bf-fa3c-4f52-b373-4f5d950d210f",
        "value": "6272ed2a9b69509ac16162158729762d30f9ca06146a1828ae17afedd5c243ef"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58fdc8c1-6f10-46e5-b165-455b950d210f",
        "value": "440504899b7af6f352cfaad6cdef1642c66927ecce0cf2f7e65d563a78be1b29"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc913-2874-42a7-aeba-49e2950d210f",
        "value": "ns1.squidmilk.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc914-ef64-45ee-9b26-464d950d210f",
        "value": "ns2.squidmilk.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc915-ceb0-4634-821e-4644950d210f",
        "value": "z.realnigger.xyz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc916-3d20-47f8-98d4-49e5950d210f",
        "value": "ns1.tconvulsit.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc917-6dac-4b46-a99f-4075950d210f",
        "value": "ns1.fresweepy.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc919-f94c-48b9-9137-486b950d210f",
        "value": "ns2.iexogyrarax.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc91a-3f54-4f55-a2c6-46be950d210f",
        "value": "ns1.xraisermz.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc91b-7574-4c11-ac24-4199950d210f",
        "value": "secure.affiliatetoday.xyz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc91c-54c8-472d-a926-4399950d210f",
        "value": "secure.gayporndownload.xyz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc91d-8170-4043-b49c-438e950d210f",
        "value": "secure.gameofthrone.club"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc91e-5994-45a6-8e26-47bc950d210f",
        "value": "secure.dropinbox.pw"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc91f-1858-4551-9778-4952950d210f",
        "value": "secure.mailserver02.xyz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc920-a388-41e2-8098-4add950d210f",
        "value": "we.niggerporn.xyz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc921-d444-4d1f-892c-4bc7950d210f",
        "value": "z.noplacelikehome.xyz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc922-fc18-49c7-a2d5-4bdf950d210f",
        "value": "ns1.stackreports.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc923-beb0-4fb6-9239-4ba5950d210f",
        "value": "ns2.stackreports.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc923-76fc-4d9d-aea4-4f8b950d210f",
        "value": "ns.liveupdate1.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc924-d610-4be7-98c1-43ac950d210f",
        "value": "ns.nortonsecurity.in"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc925-d9f4-4dde-a8f5-41bc950d210f",
        "value": "we.letsdosomefun.xyz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc926-043c-4849-9f53-4ac9950d210f",
        "value": "we.be-smart.xyz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc927-2a98-47a5-8cf9-44b7950d210f",
        "value": "z.newblood.xyz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc928-4ba8-4d27-bb59-4d44950d210f",
        "value": "ns2.ibandagerk.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc929-4698-49ac-aa28-45f5950d210f",
        "value": "ns1.rmacutecompw.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc92a-ba04-42e1-a1e5-4d5d950d210f",
        "value": "ns1.pholothud.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc92b-7644-472d-81df-4ca4950d210f",
        "value": "ns1.athermoforw.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc92c-bac8-44e5-b27b-4bf7950d210f",
        "value": "ns1.lclownerymor.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc92d-0498-4174-93b6-4f30950d210f",
        "value": "ns2.xunderfeatuv.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc92e-cf9c-4c7a-a03a-4e89950d210f",
        "value": "ns3.ssaddlegirv.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc92f-1458-43aa-a57e-4a7f950d210f",
        "value": "ns1.qcytasicspc.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": true,
        "type": "hostname",
        "uuid": "58fdc930-05d0-4b36-ae92-4070950d210f",
        "value": "ns.7ni7.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdcb91-bce0-4c0b-9a88-4175950d210f",
        "value": "http://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028885",
        "to_ids": false,
        "type": "comment",
        "uuid": "58fdcba5-89bc-45f9-bf57-4ad4950d210f",
        "value": "Palo Alto Networks has discovered a previously unknown remote access Trojan (RAT) that has been active for over two years. It has a very low volume in this two-year period, totaling roughly 27 total samples. The malware is delivered via an innovative and unique technique: a downloader we are calling Carp uses malicious macros in Microsoft Excel documents to compile embedded C# (C Sharp) Programming Language source code into an executable that in turn is run to deploy the Cardinal RAT malware family. These malicious Excel files use a number of different lures, providing evidence of what attackers are using to entice victims into executing them."
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: a52ba498d304906d6c060e8c56ad7db50e1af0a781616c0aa35447c50c28bae9",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028952",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd058-2310-4557-a69a-4e3e02de0b81",
        "value": "d245e02922513612d9babad8f50115b94588781b"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: a52ba498d304906d6c060e8c56ad7db50e1af0a781616c0aa35447c50c28bae9",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028952",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd058-510c-4b14-a683-4d4202de0b81",
        "value": "180fe86db301b9ad3f2ad6b6a12b3411"
      },
      {
        "category": "External analysis",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: a52ba498d304906d6c060e8c56ad7db50e1af0a781616c0aa35447c50c28bae9",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028953",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd059-2358-4657-a1cc-457c02de0b81",
        "value": "https://www.virustotal.com/file/a52ba498d304906d6c060e8c56ad7db50e1af0a781616c0aa35447c50c28bae9/analysis/1492716225/"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 5025aa0fc6d4ac6daa2d9a6452263dcc20d6906149fc0995d458ed38e7e57b61",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028954",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd05a-ec2c-4208-9cc6-4e2a02de0b81",
        "value": "31ad570cb2003b6cf4fe4ecd464e6385585c9b94"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 5025aa0fc6d4ac6daa2d9a6452263dcc20d6906149fc0995d458ed38e7e57b61",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028955",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd05b-3e08-4547-a530-49a702de0b81",
        "value": "b3e93233bfc939f853257f4f24981dc7"
      },
      {
        "category": "External analysis",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 5025aa0fc6d4ac6daa2d9a6452263dcc20d6906149fc0995d458ed38e7e57b61",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028956",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd05c-db44-4b60-a899-411402de0b81",
        "value": "https://www.virustotal.com/file/5025aa0fc6d4ac6daa2d9a6452263dcc20d6906149fc0995d458ed38e7e57b61/analysis/1489336266/"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 84e705341a48c8c6552a7d3dd97b7cd968d2a9bc281a70c287df70813f5dca52",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028957",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd05d-e68c-46a8-8c41-45a102de0b81",
        "value": "8a1bf0838d9f088ffaf188b681ef33419b68c6e1"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 84e705341a48c8c6552a7d3dd97b7cd968d2a9bc281a70c287df70813f5dca52",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028958",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd05e-182c-4bec-88ae-4e4702de0b81",
        "value": "2793a3eee38fc7f058072c9e08fd9082"
      },
      {
        "category": "External analysis",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 84e705341a48c8c6552a7d3dd97b7cd968d2a9bc281a70c287df70813f5dca52",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028959",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd05f-1bac-4fc7-b3d8-4b0302de0b81",
        "value": "https://www.virustotal.com/file/84e705341a48c8c6552a7d3dd97b7cd968d2a9bc281a70c287df70813f5dca52/analysis/1475054366/"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: ae1a6c4f917772100e3a5dc1fab7de4a277876a6e626da114baf8179b13b0031",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028960",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd060-59d0-484e-92ff-470302de0b81",
        "value": "7a44fab38a5cb408f4a5ed59f6a49d54d03345d0"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: ae1a6c4f917772100e3a5dc1fab7de4a277876a6e626da114baf8179b13b0031",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028961",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd061-0ffc-4317-b922-4a6602de0b81",
        "value": "23245b49aa528d7538afb30402e6c1b0"
      },
      {
        "category": "External analysis",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: ae1a6c4f917772100e3a5dc1fab7de4a277876a6e626da114baf8179b13b0031",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028962",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd062-dff4-4b08-bf3b-4a1102de0b81",
        "value": "https://www.virustotal.com/file/ae1a6c4f917772100e3a5dc1fab7de4a277876a6e626da114baf8179b13b0031/analysis/1467106688/"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: e49e61da52430011f1a22084a601cc08005865fe9a76abf503a4a9d2e11a5450",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028963",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd063-d5dc-4428-850f-4d5702de0b81",
        "value": "daec9e0a13b9dc714c3d1da83da0888cdf2b3052"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: e49e61da52430011f1a22084a601cc08005865fe9a76abf503a4a9d2e11a5450",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028964",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd064-e688-439d-83f6-435302de0b81",
        "value": "a08d4825688bd31ca99150e500d06cfe"
      },
      {
        "category": "External analysis",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: e49e61da52430011f1a22084a601cc08005865fe9a76abf503a4a9d2e11a5450",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028965",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd065-a9a8-4e3c-9d6e-472e02de0b81",
        "value": "https://www.virustotal.com/file/e49e61da52430011f1a22084a601cc08005865fe9a76abf503a4a9d2e11a5450/analysis/1465808568/"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 192b204dbc702d3762c953544975b61db8347a7739c6d8884bb4594bd816bf91",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028966",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd066-f094-4569-a560-4e2102de0b81",
        "value": "51d74d894f1e58d5f58e9ec339dd9e9f41e01042"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 192b204dbc702d3762c953544975b61db8347a7739c6d8884bb4594bd816bf91",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028967",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd067-3c1c-4fc4-a41f-471d02de0b81",
        "value": "68c64333264171274d154cb328bcdef4"
      },
      {
        "category": "External analysis",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 192b204dbc702d3762c953544975b61db8347a7739c6d8884bb4594bd816bf91",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028968",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd068-52f8-444a-bb9f-4a5802de0b81",
        "value": "https://www.virustotal.com/file/192b204dbc702d3762c953544975b61db8347a7739c6d8884bb4594bd816bf91/analysis/1462362941/"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 571b58ba655463705f45d2541f0fde049c83389a69552f98e41ece734a59f8d4",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028969",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd069-a714-4f96-8744-484602de0b81",
        "value": "957d33cdbe82715259d1329d5d048c9cbf4d8b43"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 571b58ba655463705f45d2541f0fde049c83389a69552f98e41ece734a59f8d4",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028970",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd06a-e194-4729-baf1-4c3802de0b81",
        "value": "9d14aac9c78d3be9182d000a4915f0a6"
      },
      {
        "category": "External analysis",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 571b58ba655463705f45d2541f0fde049c83389a69552f98e41ece734a59f8d4",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028971",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd06b-b1b8-49fe-a08e-48b802de0b81",
        "value": "https://www.virustotal.com/file/571b58ba655463705f45d2541f0fde049c83389a69552f98e41ece734a59f8d4/analysis/1463562345/"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 10f53502922bf837900935892fb1da28fc712848471bf4afcdd08440d3bd037f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028973",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd06d-9694-4e26-80fc-454802de0b81",
        "value": "06234a8c38c15cd88bf2bc89bf6b350bb926c207"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 10f53502922bf837900935892fb1da28fc712848471bf4afcdd08440d3bd037f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028974",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd06e-5b6c-4dff-b8a5-425a02de0b81",
        "value": "76844d8d1c1ec4b1373d071df1f291ad"
      },
      {
        "category": "External analysis",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 10f53502922bf837900935892fb1da28fc712848471bf4afcdd08440d3bd037f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028975",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd06f-59fc-4269-9229-4eb502de0b81",
        "value": "https://www.virustotal.com/file/10f53502922bf837900935892fb1da28fc712848471bf4afcdd08440d3bd037f/analysis/1458983487/"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 8bea55d2e35a2281ed71a59f1feb4c1cf6af1c053a94781c033a94d8e4c853e5",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028976",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd070-b75c-44a3-b21e-4c9702de0b81",
        "value": "8b2aac813674c5354e08e52b2ead38d92ad13983"
      },
      {
        "category": "Payload delivery",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 8bea55d2e35a2281ed71a59f1feb4c1cf6af1c053a94781c033a94d8e4c853e5",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028977",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd071-045c-4af9-9915-44eb02de0b81",
        "value": "872af30afc6665a73c4eb4229565d7df"
      },
      {
        "category": "External analysis",
        "comment": "Carp Downloader SHA256 Hashes - Xchecked via VT: 8bea55d2e35a2281ed71a59f1feb4c1cf6af1c053a94781c033a94d8e4c853e5",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028978",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd072-d718-40e1-8d27-4f3802de0b81",
        "value": "https://www.virustotal.com/file/8bea55d2e35a2281ed71a59f1feb4c1cf6af1c053a94781c033a94d8e4c853e5/analysis/1456071252/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: e017651dd9e9419a7f1714f8f2cdc3d8e75aebbe6d3cfbb2de3f042f39aec3bd",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028979",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd073-e664-4fa2-a1d6-445902de0b81",
        "value": "fef6fe25416637f507b8787ed8fca9ec718a1adf"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: e017651dd9e9419a7f1714f8f2cdc3d8e75aebbe6d3cfbb2de3f042f39aec3bd",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028980",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd074-536c-4d6b-80ad-454402de0b81",
        "value": "c2a1a284ccef4486976d6d7b24c462c8"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: e017651dd9e9419a7f1714f8f2cdc3d8e75aebbe6d3cfbb2de3f042f39aec3bd",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028981",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd075-8e9c-4209-99b6-406f02de0b81",
        "value": "https://www.virustotal.com/file/e017651dd9e9419a7f1714f8f2cdc3d8e75aebbe6d3cfbb2de3f042f39aec3bd/analysis/1492716220/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 778090182a10fde1b4c1571d1e853e123f6ab1682e17dabe2e83468b518c01df",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028982",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd076-a808-42a4-8fe3-44a902de0b81",
        "value": "3f18ce547cab90069e37bb7a8aa05e9a1fd8b1ad"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 778090182a10fde1b4c1571d1e853e123f6ab1682e17dabe2e83468b518c01df",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028983",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd077-128c-4f57-8075-44e702de0b81",
        "value": "cafd44c104f5c263bf44389c7f4e4d76"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 778090182a10fde1b4c1571d1e853e123f6ab1682e17dabe2e83468b518c01df",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028984",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd078-9f78-4ff1-b2cb-446f02de0b81",
        "value": "https://www.virustotal.com/file/778090182a10fde1b4c1571d1e853e123f6ab1682e17dabe2e83468b518c01df/analysis/1492716221/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 8fababb509ad8230e4d6fa1e6403602a97e60dc8ef517016f86195143cf50f4e",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028985",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd079-8a40-4333-bcdb-46e002de0b81",
        "value": "d777d7f401c58ce1a44a219f834affca6d251eea"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 8fababb509ad8230e4d6fa1e6403602a97e60dc8ef517016f86195143cf50f4e",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028986",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd07a-d130-4085-8d8a-423202de0b81",
        "value": "d7bf5000a2f8ef85532a983edc827ad5"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 8fababb509ad8230e4d6fa1e6403602a97e60dc8ef517016f86195143cf50f4e",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028987",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd07b-5a08-4738-97b4-48ac02de0b81",
        "value": "https://www.virustotal.com/file/8fababb509ad8230e4d6fa1e6403602a97e60dc8ef517016f86195143cf50f4e/analysis/1492716221/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 1977cedcfb8726dea5e915b47e1479256674551bc0fe0b55ddd3fa3b15eb82b2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028988",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd07c-46e0-4002-9dc9-458802de0b81",
        "value": "bcf4bf278bc98e87ac21a8cd09a63b07d9dc8871"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 1977cedcfb8726dea5e915b47e1479256674551bc0fe0b55ddd3fa3b15eb82b2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028989",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd07d-a538-458f-8508-4e2102de0b81",
        "value": "cf40adde3b2fe5c792c19b55aa7db6aa"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 1977cedcfb8726dea5e915b47e1479256674551bc0fe0b55ddd3fa3b15eb82b2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028990",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd07e-cbc0-4a61-bc00-423602de0b81",
        "value": "https://www.virustotal.com/file/1977cedcfb8726dea5e915b47e1479256674551bc0fe0b55ddd3fa3b15eb82b2/analysis/1492716220/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 16aab89d74c1eaaf1e94028c8ccceef442eb2cd5b052cba3562d2b1b1a3a4ba6",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028991",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd07f-4b48-45e7-98f1-498302de0b81",
        "value": "680a74c46221dc2c1c06968471339b01cff366c6"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 16aab89d74c1eaaf1e94028c8ccceef442eb2cd5b052cba3562d2b1b1a3a4ba6",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028992",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd080-4094-45fb-9dc6-4c2802de0b81",
        "value": "b156c25d54b4b42c412f3ef6830f2d02"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 16aab89d74c1eaaf1e94028c8ccceef442eb2cd5b052cba3562d2b1b1a3a4ba6",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028993",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd081-2aac-4773-bc9c-49a902de0b81",
        "value": "https://www.virustotal.com/file/16aab89d74c1eaaf1e94028c8ccceef442eb2cd5b052cba3562d2b1b1a3a4ba6/analysis/1492716220/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 211b7b7a4c4a07b9c65fae361570dbb94666e26f0cc0fa0b32df4b09fcee6de2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028994",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd082-bbe0-4750-b3e5-4edb02de0b81",
        "value": "482ac6e037458babad69c30175e9c0a1d1d7c9c5"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 211b7b7a4c4a07b9c65fae361570dbb94666e26f0cc0fa0b32df4b09fcee6de2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028995",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd083-d6e0-4914-b2d8-456902de0b81",
        "value": "867ceb45d536ee997efb302798140863"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 211b7b7a4c4a07b9c65fae361570dbb94666e26f0cc0fa0b32df4b09fcee6de2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028996",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd084-f528-4660-87f5-4d1802de0b81",
        "value": "https://www.virustotal.com/file/211b7b7a4c4a07b9c65fae361570dbb94666e26f0cc0fa0b32df4b09fcee6de2/analysis/1471808183/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 84f822d9cf575aeea867e9b73f88ad4d9244293e52208644e12ff2cf13b6b537",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028997",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd085-d69c-4f4a-aafd-446902de0b81",
        "value": "d28c37375dc8d2f057145f43abb00f2f5aff8323"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 84f822d9cf575aeea867e9b73f88ad4d9244293e52208644e12ff2cf13b6b537",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028998",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd086-ba6c-4fee-b65e-43bc02de0b81",
        "value": "f92c7ce71131d98d2a08618737b9b600"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 84f822d9cf575aeea867e9b73f88ad4d9244293e52208644e12ff2cf13b6b537",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493028999",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd087-f680-4163-85e6-4e7e02de0b81",
        "value": "https://www.virustotal.com/file/84f822d9cf575aeea867e9b73f88ad4d9244293e52208644e12ff2cf13b6b537/analysis/1471199923/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 855cf3a6422b0bf680d505720fd07c396508f67518670b493dba902c3c2e5dfa",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029000",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd088-2ad8-46d7-a6af-4af702de0b81",
        "value": "d225660943ebc34beddfceb7c4141a5a5fa90a1e"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 855cf3a6422b0bf680d505720fd07c396508f67518670b493dba902c3c2e5dfa",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029001",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd089-a9e8-4730-b4f0-46eb02de0b81",
        "value": "c18d73507bf272e079af6c27dfd4682a"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 855cf3a6422b0bf680d505720fd07c396508f67518670b493dba902c3c2e5dfa",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029002",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd08a-427c-478c-a26d-4fa202de0b81",
        "value": "https://www.virustotal.com/file/855cf3a6422b0bf680d505720fd07c396508f67518670b493dba902c3c2e5dfa/analysis/1492716222/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 4b4c6b36938c3de0623feb92c0e1cb399d2dc338d2095b8ba84e862ef6d11772",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029003",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd08b-9b20-4d8e-861e-489302de0b81",
        "value": "7af6968ea03f23ef3d02120922c0aa8b267b8585"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 4b4c6b36938c3de0623feb92c0e1cb399d2dc338d2095b8ba84e862ef6d11772",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029004",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd08c-54ac-49b7-b732-403702de0b81",
        "value": "29e3de04017af76502a730b134b1f2d3"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 4b4c6b36938c3de0623feb92c0e1cb399d2dc338d2095b8ba84e862ef6d11772",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029005",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd08d-07d8-442e-abee-438102de0b81",
        "value": "https://www.virustotal.com/file/4b4c6b36938c3de0623feb92c0e1cb399d2dc338d2095b8ba84e862ef6d11772/analysis/1492716222/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 5dd162ab66f0c819ee73868c26ecd82408422e2b6366805631eab95ae32516f3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029006",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd08e-6aac-403d-8774-42e902de0b81",
        "value": "0e954284a439ed6dc62b9795e21ed86a9a1b1f64"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 5dd162ab66f0c819ee73868c26ecd82408422e2b6366805631eab95ae32516f3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029007",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd08f-a9bc-4e25-8d8a-460a02de0b81",
        "value": "20f883527a5e80d231779a76cbf7b269"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 5dd162ab66f0c819ee73868c26ecd82408422e2b6366805631eab95ae32516f3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029008",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd090-00c0-42da-8c76-41ba02de0b81",
        "value": "https://www.virustotal.com/file/5dd162ab66f0c819ee73868c26ecd82408422e2b6366805631eab95ae32516f3/analysis/1492716222/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 6e2991e02d3cf17d77173d50cdaa766661a89721c3cc4050fba98bea0dbdb1a9",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029009",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd091-da98-4e17-a3d9-4bc202de0b81",
        "value": "70225738e42300d94b2eb48c4d9a85de5431b439"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 6e2991e02d3cf17d77173d50cdaa766661a89721c3cc4050fba98bea0dbdb1a9",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029010",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd092-6e64-4149-a649-45a802de0b81",
        "value": "3ff7da97b57d069f60ff29218a42e08f"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 6e2991e02d3cf17d77173d50cdaa766661a89721c3cc4050fba98bea0dbdb1a9",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029011",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd093-1b80-474d-b1ce-439b02de0b81",
        "value": "https://www.virustotal.com/file/6e2991e02d3cf17d77173d50cdaa766661a89721c3cc4050fba98bea0dbdb1a9/analysis/1470049606/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 1e8ed6e8d0b6fc47d8176c874ed40fb09644c058042f34d987878fa644f493cc",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029013",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd095-7988-4255-a2db-439802de0b81",
        "value": "a34251985aa263df27b11bacf2199f2fd640cf8d"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 1e8ed6e8d0b6fc47d8176c874ed40fb09644c058042f34d987878fa644f493cc",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029014",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd096-a380-4b3c-a73a-4ff002de0b81",
        "value": "7cc5c68c26f9aca921d3422b570a43fe"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 1e8ed6e8d0b6fc47d8176c874ed40fb09644c058042f34d987878fa644f493cc",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029014",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd096-049c-4884-9984-4c8f02de0b81",
        "value": "https://www.virustotal.com/file/1e8ed6e8d0b6fc47d8176c874ed40fb09644c058042f34d987878fa644f493cc/analysis/1469141841/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 647e379517fed71682423b0192da453ec1d61a633c154fdd55bab762bcc404f3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029015",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd097-a91c-4647-8a4f-4e2902de0b81",
        "value": "88586a7605c8801c67a0ce61ed41a59ba09f3fc7"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 647e379517fed71682423b0192da453ec1d61a633c154fdd55bab762bcc404f3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029016",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd098-ef98-4e5e-83db-47d802de0b81",
        "value": "df9254ca11f01657713a1a46b01caa30"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 647e379517fed71682423b0192da453ec1d61a633c154fdd55bab762bcc404f3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029017",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd099-61d0-42ef-b014-4bf202de0b81",
        "value": "https://www.virustotal.com/file/647e379517fed71682423b0192da453ec1d61a633c154fdd55bab762bcc404f3/analysis/1469155780/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: edc49bf7ec508becb088d5082c78d360f1a7cad520f6de6d8b93759b67aac305",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029018",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd09a-f758-47db-9ce1-478902de0b81",
        "value": "a0ecc918c35750e5f02958d3c3e1be99520cafec"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: edc49bf7ec508becb088d5082c78d360f1a7cad520f6de6d8b93759b67aac305",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029019",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd09b-6edc-4d29-a076-45ae02de0b81",
        "value": "aa3834d70a29c688857aefbd8e9585ba"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: edc49bf7ec508becb088d5082c78d360f1a7cad520f6de6d8b93759b67aac305",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029020",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd09c-d924-48e0-ba0e-44c102de0b81",
        "value": "https://www.virustotal.com/file/edc49bf7ec508becb088d5082c78d360f1a7cad520f6de6d8b93759b67aac305/analysis/1492716223/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 7482f8c86b63ce53edcb62fc2ff2dd8e584e2164451ae0c6f2b1f4d6d0cb6d9c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029021",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd09d-d004-47a8-8152-463a02de0b81",
        "value": "49f152db1eca5094d981dd0ec3405148f71f2dc2"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 7482f8c86b63ce53edcb62fc2ff2dd8e584e2164451ae0c6f2b1f4d6d0cb6d9c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029022",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd09e-6218-4e64-862d-4d3002de0b81",
        "value": "86ca06048688b2a2f756a84a753628f3"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 7482f8c86b63ce53edcb62fc2ff2dd8e584e2164451ae0c6f2b1f4d6d0cb6d9c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029023",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd09f-5f44-4fd5-8833-483702de0b81",
        "value": "https://www.virustotal.com/file/7482f8c86b63ce53edcb62fc2ff2dd8e584e2164451ae0c6f2b1f4d6d0cb6d9c/analysis/1492716223/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 2fbd3d2362acd1c8f0963b48d01f94c7a07aeac52d23415d0498c8c9e23554db",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029024",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd0a0-e414-4d44-896b-40bd02de0b81",
        "value": "4123755d673fe49522575471149634b6cbf29e5e"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 2fbd3d2362acd1c8f0963b48d01f94c7a07aeac52d23415d0498c8c9e23554db",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029025",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd0a1-dfa8-4e0c-a203-462502de0b81",
        "value": "0a2544097f7c55643be8892c3a383dc3"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 2fbd3d2362acd1c8f0963b48d01f94c7a07aeac52d23415d0498c8c9e23554db",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029026",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd0a2-859c-4429-b9ec-4ddb02de0b81",
        "value": "https://www.virustotal.com/file/2fbd3d2362acd1c8f0963b48d01f94c7a07aeac52d23415d0498c8c9e23554db/analysis/1492716223/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 154e3a12404202fd25e29e754ff78703d4edd7da73cb4c283c9910fd526d47db",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029027",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd0a3-2b24-4159-b613-4f9a02de0b81",
        "value": "42315fcd706dbad6eb90d54dadf66de91fd4f9af"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 154e3a12404202fd25e29e754ff78703d4edd7da73cb4c283c9910fd526d47db",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029028",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd0a4-2be0-446a-9c23-414202de0b81",
        "value": "a6d2bb2d68329d20ea6f40a064d9f684"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 154e3a12404202fd25e29e754ff78703d4edd7da73cb4c283c9910fd526d47db",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029029",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd0a5-3b8c-47d1-856f-4fb102de0b81",
        "value": "https://www.virustotal.com/file/154e3a12404202fd25e29e754ff78703d4edd7da73cb4c283c9910fd526d47db/analysis/1492716224/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: a1d5b7d69d85b1be31d9e1cb0686094cc7b1213079b2a66ace01be4bfe3fb7c3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029030",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd0a6-c5c8-490c-a4a8-4f6502de0b81",
        "value": "2beb72d9b2c735ffa70f777be07dbe78e3389ca4"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: a1d5b7d69d85b1be31d9e1cb0686094cc7b1213079b2a66ace01be4bfe3fb7c3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029031",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd0a7-b8b8-403d-8daa-404002de0b81",
        "value": "8ac4d1d278d638483da48604a8a4ec77"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: a1d5b7d69d85b1be31d9e1cb0686094cc7b1213079b2a66ace01be4bfe3fb7c3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029032",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd0a8-1528-4faa-9fca-497702de0b81",
        "value": "https://www.virustotal.com/file/a1d5b7d69d85b1be31d9e1cb0686094cc7b1213079b2a66ace01be4bfe3fb7c3/analysis/1492716225/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 4b0203492a95257707a86992e84b5085ce9e11810a26920dbb085005081e32d3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029033",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd0a9-acc8-4816-a817-417802de0b81",
        "value": "86fc6492ef03ec0967bd2af941abaedf285b3e35"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 4b0203492a95257707a86992e84b5085ce9e11810a26920dbb085005081e32d3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029034",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd0aa-33b0-470b-a492-4e0702de0b81",
        "value": "e634d08bc2cb881f2c9b179436417fae"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 4b0203492a95257707a86992e84b5085ce9e11810a26920dbb085005081e32d3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029035",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd0ab-8b48-46c2-a143-43ee02de0b81",
        "value": "https://www.virustotal.com/file/4b0203492a95257707a86992e84b5085ce9e11810a26920dbb085005081e32d3/analysis/1492716225/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 4e953ea82b0406a5b95e31554628ad6821b1d91e9ada0d26179977f227cf01ad",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029036",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd0ac-939c-48b6-8a32-4af502de0b81",
        "value": "cd6daf7745dfa300638775ec8478ffe31f931e16"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 4e953ea82b0406a5b95e31554628ad6821b1d91e9ada0d26179977f227cf01ad",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029037",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd0ad-65d4-4bbe-af99-4ccb02de0b81",
        "value": "2be1ec0c5c1abde12a6d089a10ee5724"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 4e953ea82b0406a5b95e31554628ad6821b1d91e9ada0d26179977f227cf01ad",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029038",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd0ae-a8b0-49f1-8df9-4c3002de0b81",
        "value": "https://www.virustotal.com/file/4e953ea82b0406a5b95e31554628ad6821b1d91e9ada0d26179977f227cf01ad/analysis/1492716224/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 6272ed2a9b69509ac16162158729762d30f9ca06146a1828ae17afedd5c243ef",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029039",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd0af-ad98-41d7-ad66-412a02de0b81",
        "value": "079481fabbcad026b1e1934c16ac5224a21c8d76"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 6272ed2a9b69509ac16162158729762d30f9ca06146a1828ae17afedd5c243ef",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029040",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd0b0-b564-41f8-85bf-40d102de0b81",
        "value": "c88ebec4346c2812f9629bf35f69d442"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 6272ed2a9b69509ac16162158729762d30f9ca06146a1828ae17afedd5c243ef",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029041",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd0b1-9780-4046-9732-4cb402de0b81",
        "value": "https://www.virustotal.com/file/6272ed2a9b69509ac16162158729762d30f9ca06146a1828ae17afedd5c243ef/analysis/1492632427/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 440504899b7af6f352cfaad6cdef1642c66927ecce0cf2f7e65d563a78be1b29",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029042",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58fdd0b2-fafc-42f3-892a-426d02de0b81",
        "value": "e2c622f95a0d120c7189e7063bdedf9ee420f204"
      },
      {
        "category": "Payload delivery",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 440504899b7af6f352cfaad6cdef1642c66927ecce0cf2f7e65d563a78be1b29",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029043",
        "to_ids": true,
        "type": "md5",
        "uuid": "58fdd0b3-720c-441e-af79-4cc802de0b81",
        "value": "92e648e9aed72620c6caf580d23a4678"
      },
      {
        "category": "External analysis",
        "comment": "Cardinal RAT SHA256 Hashes - Xchecked via VT: 440504899b7af6f352cfaad6cdef1642c66927ecce0cf2f7e65d563a78be1b29",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1493029044",
        "to_ids": false,
        "type": "link",
        "uuid": "58fdd0b4-7044-45b0-b182-46c502de0b81",
        "value": "https://www.virustotal.com/file/440504899b7af6f352cfaad6cdef1642c66927ecce0cf2f7e65d563a78be1b29/analysis/1492855117/"
      }
    ]
  }
}