{"Event": {"info": "M2M -  Trickbot 2017-11-14 : \"mac1\" : \"Invoice\n AXBY1234567\" - \"InvoiceAXBY1234567.doc\"", "Tag": [{"colour": "#ffffff", "exportable": true, "name": "tlp:white"}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:tool=\"Trick Bot\""}], "publish_timestamp": "0", "timestamp": "1510937098", "analysis": "1", "Attribute": [{"comment": "", "category": "Artifacts dropped", "uuid": "5a0f0f65-6728-417b-be96-b831950d210f", "timestamp": "1510937091", "to_ids": true, "value": "37e5976ed01f8bcf6b814e58a847d294", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f65-e4a0-42ca-9876-5911950d210f", "timestamp": "1510937091", "to_ids": true, "value": "http://hubalon.de/FGdhbr5", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f65-96d4-4d8a-8978-4dfd950d210f", "timestamp": "1510937091", "to_ids": true, "value": "hubalon.de", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "hubalon.de", "category": "Network activity", "uuid": "5a0f0f66-9440-48cd-9f29-5dfc950d210f", "timestamp": "1510937091", "to_ids": false, "value": "212.72.171.130", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f66-2ab8-4fc9-9500-b41d950d210f", "timestamp": "1510937091", "to_ids": true, "value": "http://infoweb.cfpsdevweb.ch/FGdhbr5", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f66-69f8-44b9-8975-b59f950d210f", "timestamp": "1510937091", "to_ids": true, "value": "infoweb.cfpsdevweb.ch", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "infoweb.cfpsdevweb.ch", "category": "Network activity", "uuid": "5a0f0f66-54f4-4c11-9a39-4bb6950d210f", "timestamp": "1510937091", "to_ids": false, "value": "213.221.153.22", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f67-e470-4ef3-9ec9-5e08950d210f", "timestamp": "1510937091", "to_ids": true, "value": "http://kb.schuttesystems.net/FGdhbr5", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f67-e778-4c79-9bfc-5d86950d210f", "timestamp": "1510937091", "to_ids": true, "value": "kb.schuttesystems.net", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "kb.schuttesystems.net", "category": "Network activity", "uuid": "5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f", "timestamp": "1510937091", "to_ids": false, "value": "194.151.161.144", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f67-d570-4688-b052-5d51950d210f", "timestamp": "1510937091", "to_ids": true, "value": "http://kipshagen-ol.de/FGdhbr5", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f67-d120-4b45-bc25-b831950d210f", "timestamp": "1510937091", "to_ids": true, "value": "kipshagen-ol.de", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "kipshagen-ol.de", "category": "Network activity", "uuid": "5a0f0f68-9a20-4b25-8e06-5911950d210f", "timestamp": "1510937091", "to_ids": false, "value": "82.165.155.25", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f68-294c-492e-bb55-41c0950d210f", "timestamp": "1510937091", "to_ids": true, "value": "http://nc.skyrunner.net/FGdhbr5", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f68-dba0-41a1-9e33-5d86950d210f", "timestamp": "1510937091", "to_ids": true, "value": "nc.skyrunner.net", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f69-e044-4990-b068-b84a950d210f", "timestamp": "1510937091", "to_ids": true, "value": "http://sport-market.ru/FGdhbr5", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f69-3fcc-4b0a-b0d1-5dfc950d210f", "timestamp": "1510937091", "to_ids": true, "value": "sport-market.ru", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "sport-market.ru", "category": "Network activity", "uuid": "5a0f0f69-35f0-40cc-a98d-5d51950d210f", "timestamp": "1510937091", "to_ids": false, "value": "85.10.224.162", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f69-ec94-4d52-9d5c-49f9950d210f", "timestamp": "1510937091", "to_ids": false, "value": "187.188.162.150", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f69-98e0-451d-971a-4f7c950d210f", "timestamp": "1510937091", "to_ids": false, "value": "185.28.63.109", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6a-c1b4-49f9-8981-4c40950d210f", "timestamp": "1510937091", "to_ids": false, "value": "83.0.245.234", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6a-c9e0-493b-9f3b-b664950d210f", "timestamp": "1510937091", "to_ids": false, "value": "213.241.29.89", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6a-7870-49b8-b63c-5e08950d210f", "timestamp": "1510937091", "to_ids": false, "value": "62.109.31.123", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6b-b2b4-4d2d-910b-478c950d210f", "timestamp": "1510937091", "to_ids": false, "value": "92.63.107.14", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6b-8f14-4ab5-90d7-45e5950d210f", "timestamp": "1510937091", "to_ids": false, "value": "92.63.107.222", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6b-9f34-45a8-b704-b84a950d210f", "timestamp": "1510937091", "to_ids": false, "value": "92.63.104.211", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6b-b088-497e-9567-4af6950d210f", "timestamp": "1510937091", "to_ids": false, "value": "62.109.25.3", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6c-40c8-41f3-b245-b41d950d210f", "timestamp": "1510937091", "to_ids": false, "value": "62.109.26.208", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6c-d900-4741-8743-b59f950d210f", "timestamp": "1510937091", "to_ids": false, "value": "37.230.113.231", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6c-826c-46e5-92ef-47d0950d210f", "timestamp": "1510937091", "to_ids": false, "value": "149.154.69.126", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6d-7044-463b-824b-435c950d210f", "timestamp": "1510937091", "to_ids": false, "value": "95.213.191.144", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6d-42ec-48d3-ba9e-b664950d210f", "timestamp": "1510937091", "to_ids": false, "value": "82.202.226.229", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6d-3ad4-4d30-9a78-5e08950d210f", "timestamp": "1510937091", "to_ids": false, "value": "37.230.113.249", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6d-a978-4233-80c2-4be7950d210f", "timestamp": "1510937091", "to_ids": false, "value": "149.154.69.129", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6e-f8b0-42f6-9fda-5d86950d210f", "timestamp": "1510937091", "to_ids": false, "value": "185.158.114.72", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6e-0e80-49a7-9117-b84a950d210f", "timestamp": "1510937091", "to_ids": false, "value": "179.43.160.50", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6e-875c-4fd4-bf89-4f23950d210f", "timestamp": "1510937091", "to_ids": false, "value": "94.250.254.22", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6f-a384-474f-8c3b-5dfc950d210f", "timestamp": "1510937091", "to_ids": false, "value": "149.154.70.248", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6f-f3b4-4c03-af17-5d51950d210f", "timestamp": "1510937091", "to_ids": false, "value": "95.213.236.81", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6f-a67c-4df4-9c09-4aa2950d210f", "timestamp": "1510937091", "to_ids": false, "value": "82.202.226.66", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f6f-49e0-4710-aa7f-b831950d210f", "timestamp": "1510937091", "to_ids": false, "value": "37.230.113.191", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f70-5460-4687-a5af-5911950d210f", "timestamp": "1510937091", "to_ids": false, "value": "92.53.67.44", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f70-3f68-47ce-b9a7-446a950d210f", "timestamp": "1510937091", "to_ids": false, "value": "94.250.254.104", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f70-e560-4f6e-b847-5d86950d210f", "timestamp": "1510937091", "to_ids": false, "value": "91.211.247.94", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f70-0d10-4e6e-9d1c-b57b950d210f", "timestamp": "1510937091", "to_ids": false, "value": "94.250.254.102", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f71-d47c-4892-bd8f-b41d950d210f", "timestamp": "1510937091", "to_ids": false, "value": "185.34.52.80", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f71-7ac8-4efb-a02b-4143950d210f", "timestamp": "1510937091", "to_ids": false, "value": "195.133.146.156", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "", "category": "Network activity", "uuid": "5a0f0f71-19c0-42be-9da2-b831950d210f", "timestamp": "1510937091", "to_ids": false, "value": "77.244.215.81", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "- Xchecked via VT: 37e5976ed01f8bcf6b814e58a847d294", "category": "Artifacts dropped", "uuid": "5a0f1203-6b28-4acb-85ab-442602de0b81", "timestamp": "1510937091", "to_ids": true, "value": "e1217585c1c357a9cd4f44e54fd18e198f70e337d1e7073963adc270c5c7f526", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "- Xchecked via VT: 37e5976ed01f8bcf6b814e58a847d294", "category": "Artifacts dropped", "uuid": "5a0f1203-defc-4085-8173-498a02de0b81", "timestamp": "1510937091", "to_ids": true, "value": "d4e18c53779b3900e325eda985f611eb50043703", "disable_correlation": false, "object_relation": null, "type": "sha1"}, {"comment": "- Xchecked via VT: 37e5976ed01f8bcf6b814e58a847d294", "category": "External analysis", "uuid": "5a0f1203-5484-401a-955f-458102de0b81", "timestamp": "1510937091", "to_ids": false, "value": "https://www.virustotal.com/file/e1217585c1c357a9cd4f44e54fd18e198f70e337d1e7073963adc270c5c7f526/analysis/1510816029/", "disable_correlation": false, "object_relation": null, "type": "link"}], "extends_uuid": "", "published": false, "date": "2017-11-17", "Orgc": {"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", "name": "CIRCL"}, "threat_level_id": "3", "uuid": "5a0f0f64-4be0-4b9f-b6e3-5e08950d210f"}}