{
  "Event": {
    "analysis": "2",
    "date": "2015-01-08",
    "extends_uuid": "",
    "info": "OSINT - The Connections Between MiniDuke, CosmicDuke and OnionDuke",
    "publish_timestamp": "1421338911",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1457396925",
    "uuid": "54aea268-ffc4-47e8-b09a-9c33950d210b",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": "0",
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#33FF00",
        "local": "0",
        "name": "tlp:green",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731088",
        "to_ids": true,
        "type": "filename|sha1",
        "uuid": "54aea2d0-6040-41b3-ba1c-4dc8950d210b",
        "value": "\u00e2\u20ac\u0153EU sanctions against Russia over Ukraine crisis\u00e2\u20ac\u0153.docm|82448eb23ea9eb3939b6f24df46789bf7f2d43e3"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731088",
        "to_ids": true,
        "type": "filename|sha1",
        "uuid": "54aea2d0-93f8-4876-a48b-4279950d210b",
        "value": "\u00e2\u20ac\u0153A Scottish \u00e2\u20ac\u02dcYes\u00e2\u20ac\u2122 to independence\u00e2\u20ac\u0153 .docm|c86b13378ba2a41684e1f93b4c20e05fc5d3d5a3"
      },
      {
        "category": "Payload installation",
        "comment": "32-bit dropper",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731135",
        "to_ids": true,
        "type": "sha1",
        "uuid": "54aea2ff-204c-42e2-97f4-ba76950d210b",
        "value": "241075fc1493172c47d881bcbfbf21cfa4daa42d"
      },
      {
        "category": "Payload installation",
        "comment": "64-bit dropper",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731169",
        "to_ids": true,
        "type": "sha1",
        "uuid": "54aea321-b058-4dc6-8192-4284950d210b",
        "value": "51ac683df63ff71a0003ca17e640bbeaaa14d0aa"
      },
      {
        "category": "Payload installation",
        "comment": "CosmicDuke-MiniDuke combo",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731215",
        "to_ids": true,
        "type": "sha1",
        "uuid": "54aea34f-f028-4b6c-8269-4afb950d210b",
        "value": "7ad1bef0ba61dbed98d76d4207676d08c893fc13"
      },
      {
        "category": "Payload installation",
        "comment": "OnionDuke limited backdoor",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731245",
        "to_ids": true,
        "type": "sha1",
        "uuid": "54aea36d-a54c-4e1a-9564-4450950d210b",
        "value": "b491c14d8cfb48636f6095b7b16555e9a575d57f"
      },
      {
        "category": "Payload installation",
        "comment": "OnionDuke full backdoor",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731283",
        "to_ids": true,
        "type": "sha1",
        "uuid": "54aea393-e95c-4571-a5a4-9c33950d210b",
        "value": "d433f281cf56015941a1c2cb87066ca62ea1db37"
      },
      {
        "category": "Payload delivery",
        "comment": "Expansion",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731354",
        "to_ids": true,
        "type": "email-src",
        "uuid": "54aea3da-68dc-42be-93df-d60e950d210b",
        "value": "uibo.lembit@mail.ee"
      },
      {
        "category": "Payload delivery",
        "comment": "Expansion",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731387",
        "to_ids": true,
        "type": "email-dst",
        "uuid": "54aea3fb-fd1c-40a0-a65e-44c2950d210b",
        "value": "uibo.lembit@mail.ee"
      },
      {
        "category": "Payload delivery",
        "comment": "Expansion",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731427",
        "to_ids": true,
        "type": "email-subject",
        "uuid": "54aea423-dd08-485e-ba92-4156950d210b",
        "value": "EU sanctions against Russia over Ukraine crisis (Estonia's opinion)"
      },
      {
        "category": "Payload delivery",
        "comment": "Expansion",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731471",
        "to_ids": true,
        "type": "email-attachment",
        "uuid": "54aea44f-1f04-4abd-9576-9c33950d210b",
        "value": "=?UTF-8?Q?[rep]estonia.doc?="
      },
      {
        "category": "Other",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731503",
        "to_ids": false,
        "type": "text",
        "uuid": "54aea46f-776c-4176-b698-ba76950d210b",
        "value": "MiniDuke"
      },
      {
        "category": "Other",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731503",
        "to_ids": false,
        "type": "text",
        "uuid": "54aea46f-fb0c-41f3-8f12-ba76950d210b",
        "value": "OnionDuke"
      },
      {
        "category": "Other",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731503",
        "to_ids": false,
        "type": "text",
        "uuid": "54aea46f-3da8-4b16-ba39-ba76950d210b",
        "value": "CosmicDuke"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1420731555",
        "to_ids": true,
        "type": "email-attachment",
        "uuid": "54aea4a3-4680-4942-9f1a-4d6c950d210b",
        "value": "World News Digest.docx"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1421223452",
        "to_ids": false,
        "type": "text",
        "uuid": "54b6261c-ac2c-402c-87af-d563950d210b",
        "value": "Onion Duke"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1421223452",
        "to_ids": false,
        "type": "text",
        "uuid": "54b6261c-bee8-4cbe-8ae2-d563950d210b",
        "value": "Cosmic Duke"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1421223452",
        "to_ids": false,
        "type": "text",
        "uuid": "54b6261c-c028-4c69-a879-d563950d210b",
        "value": "Mini Duke"
      },
      {
        "category": "Payload installation",
        "comment": "32-bit dropper - Xchecked via VT: 241075fc1493172c47d881bcbfbf21cfa4daa42d",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396925",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56de1cbd-0be0-4f54-b7c6-4f2e02de0b81",
        "value": "2b15581baf7d69cd3c65a86f20eff813b4cbb9bae7a0362f97e76e21364dabca"
      },
      {
        "category": "Payload installation",
        "comment": "32-bit dropper - Xchecked via VT: 241075fc1493172c47d881bcbfbf21cfa4daa42d",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396925",
        "to_ids": true,
        "type": "md5",
        "uuid": "56de1cbd-7bb8-424b-9eec-492902de0b81",
        "value": "01400499ecc7fa6a50cc860179273a7f"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396926",
        "to_ids": false,
        "type": "link",
        "uuid": "56de1cbe-6240-4b66-91c6-443502de0b81",
        "value": "https://www.virustotal.com/file/2b15581baf7d69cd3c65a86f20eff813b4cbb9bae7a0362f97e76e21364dabca/analysis/1445916566/"
      },
      {
        "category": "Payload installation",
        "comment": "64-bit dropper - Xchecked via VT: 51ac683df63ff71a0003ca17e640bbeaaa14d0aa",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396926",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56de1cbe-0240-44bb-9c0c-408202de0b81",
        "value": "71cad7cc4e23d1e03c5d03cd9b48e32126b6bf7374841735ad642b62e2745a2c"
      },
      {
        "category": "Payload installation",
        "comment": "64-bit dropper - Xchecked via VT: 51ac683df63ff71a0003ca17e640bbeaaa14d0aa",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396926",
        "to_ids": true,
        "type": "md5",
        "uuid": "56de1cbe-0374-4437-ab8d-467302de0b81",
        "value": "eb48ff76cc7dd24b519c93a0aa250d27"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396926",
        "to_ids": false,
        "type": "link",
        "uuid": "56de1cbe-33ac-4535-b0d6-475602de0b81",
        "value": "https://www.virustotal.com/file/71cad7cc4e23d1e03c5d03cd9b48e32126b6bf7374841735ad642b62e2745a2c/analysis/1445916567/"
      },
      {
        "category": "Payload installation",
        "comment": "CosmicDuke-MiniDuke combo - Xchecked via VT: 7ad1bef0ba61dbed98d76d4207676d08c893fc13",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396927",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56de1cbf-f5cc-41bc-80f9-4b0902de0b81",
        "value": "29585bb17b28e8b15b2a250be9516f416fa7cac84cc24aa4e004f6987323147e"
      },
      {
        "category": "Payload installation",
        "comment": "CosmicDuke-MiniDuke combo - Xchecked via VT: 7ad1bef0ba61dbed98d76d4207676d08c893fc13",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396927",
        "to_ids": true,
        "type": "md5",
        "uuid": "56de1cbf-8058-40b1-9b4c-469c02de0b81",
        "value": "925b37a936304a5914941ac4584e346c"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396927",
        "to_ids": false,
        "type": "link",
        "uuid": "56de1cbf-6e7c-43df-b933-4c7902de0b81",
        "value": "https://www.virustotal.com/file/29585bb17b28e8b15b2a250be9516f416fa7cac84cc24aa4e004f6987323147e/analysis/1452769402/"
      },
      {
        "category": "Payload installation",
        "comment": "OnionDuke limited backdoor - Xchecked via VT: b491c14d8cfb48636f6095b7b16555e9a575d57f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396928",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56de1cc0-b0a4-4846-84a1-452802de0b81",
        "value": "366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b"
      },
      {
        "category": "Payload installation",
        "comment": "OnionDuke limited backdoor - Xchecked via VT: b491c14d8cfb48636f6095b7b16555e9a575d57f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396928",
        "to_ids": true,
        "type": "md5",
        "uuid": "56de1cc0-c030-4e51-adef-475302de0b81",
        "value": "c8eb6040fd02d77660d19057a38ff769"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396928",
        "to_ids": false,
        "type": "link",
        "uuid": "56de1cc0-1810-4b1d-ac3e-4d0f02de0b81",
        "value": "https://www.virustotal.com/file/366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b/analysis/1456819261/"
      },
      {
        "category": "Payload installation",
        "comment": "OnionDuke full backdoor - Xchecked via VT: d433f281cf56015941a1c2cb87066ca62ea1db37",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396928",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56de1cc0-16b8-4f7e-9436-458e02de0b81",
        "value": "0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade"
      },
      {
        "category": "Payload installation",
        "comment": "OnionDuke full backdoor - Xchecked via VT: d433f281cf56015941a1c2cb87066ca62ea1db37",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396929",
        "to_ids": true,
        "type": "md5",
        "uuid": "56de1cc1-9628-4ff0-9fd0-4fcf02de0b81",
        "value": "d1ce79089578da2d41f1ad901f7b1014"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396929",
        "to_ids": false,
        "type": "link",
        "uuid": "56de1cc1-841c-4ad8-9191-482302de0b81",
        "value": "https://www.virustotal.com/file/0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade/analysis/1456923691/"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 82448eb23ea9eb3939b6f24df46789bf7f2d43e3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396929",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56de1cc1-1540-456c-96d7-448f02de0b81",
        "value": "abcaf6044d4d591a50ac3328ed8c8ab3ec91929d2f0d7e3bea1ed0cfc92e811d"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 82448eb23ea9eb3939b6f24df46789bf7f2d43e3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396930",
        "to_ids": true,
        "type": "md5",
        "uuid": "56de1cc2-68a8-4157-8101-475b02de0b81",
        "value": "f27ffc3d3ff7a2ddc6728d9495427ee5"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396930",
        "to_ids": false,
        "type": "link",
        "uuid": "56de1cc2-f9c0-42d4-8042-48e102de0b81",
        "value": "https://www.virustotal.com/file/abcaf6044d4d591a50ac3328ed8c8ab3ec91929d2f0d7e3bea1ed0cfc92e811d/analysis/1444969477/"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: c86b13378ba2a41684e1f93b4c20e05fc5d3d5a3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396930",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56de1cc2-9bbc-44f3-beb1-4ddc02de0b81",
        "value": "1a981bd49b9869a1c81e767ba7418254138272b005dab5c83f3798906ca86570"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: c86b13378ba2a41684e1f93b4c20e05fc5d3d5a3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396930",
        "to_ids": true,
        "type": "md5",
        "uuid": "56de1cc2-9d48-4e9d-8e59-49bc02de0b81",
        "value": "ed463d501c23db34e27bd32902971081"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1457396931",
        "to_ids": false,
        "type": "link",
        "uuid": "56de1cc3-85c0-4fb8-acac-448b02de0b81",
        "value": "https://www.virustotal.com/file/1a981bd49b9869a1c81e767ba7418254138272b005dab5c83f3798906ca86570/analysis/1425845303/"
      }
    ]
  }
}