{
  "Event": {
    "analysis": "2",
    "date": "2016-08-15",
    "extends_uuid": "",
    "info": "OSINT Shakti Trojan: Document Thief  by Malwarebytes",
    "publish_timestamp": "1471523877",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1471523562",
    "uuid": "57b5a864-be78-4eba-af85-4608950d210f",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      },
      {
        "colour": "#ffffff",
        "name": "OSINT"
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471522935",
        "to_ids": false,
        "type": "link",
        "uuid": "57b5a877-9d20-49f7-aa38-4c16950d210f",
        "value": "https://blog.malwarebytes.com/threat-analysis/2016/08/shakti-trojan-stealing-documents/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471522935",
        "to_ids": false,
        "type": "link",
        "uuid": "57b5a877-9be4-4767-b8e5-436a950d210f",
        "value": "https://malwr.com/analysis/NjA0OGVmMDdlMzg5NDJjOGI1OTA3YTJkMDllZTk5Y2U/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471522935",
        "to_ids": false,
        "type": "link",
        "uuid": "57b5a877-a95c-48cf-be90-4981950d210f",
        "value": "http://www.bleepingcomputer.com/news/security/new-information-stealing-trojan-steals-and-uploads-corporate-files/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471522985",
        "to_ids": false,
        "type": "link",
        "uuid": "57b5a8aa-4290-4175-9509-478d950d210f",
        "value": "https://blog.malwarebytes.com/threat-analysis/2016/08/shakti-trojan-technical-analysis/"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523016",
        "to_ids": true,
        "type": "filename",
        "uuid": "57b5a8c8-1a70-4ec3-9746-44dc950d210f",
        "value": "Carrier.dll"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523016",
        "to_ids": true,
        "type": "filename",
        "uuid": "57b5a8c8-a87c-44bf-9aec-46e8950d210f",
        "value": "Payload.dll"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523017",
        "to_ids": true,
        "type": "domain",
        "uuid": "57b5a8c9-3110-4536-8e93-4baa950d210f",
        "value": "web4solution.net"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523017",
        "to_ids": true,
        "type": "domain",
        "uuid": "57b5a8c9-31ec-442a-9e77-4819950d210f",
        "value": "securedesignus.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523017",
        "to_ids": true,
        "type": "domain",
        "uuid": "57b5a8c9-6830-4de5-a4b0-4b00950d210f",
        "value": "securedesignuk.com"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523071",
        "to_ids": true,
        "type": "filename",
        "uuid": "57b5a8ff-4aa4-4baf-a764-49ad950d210f",
        "value": "Carrier.dll"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523071",
        "to_ids": true,
        "type": "filename",
        "uuid": "57b5a8ff-c074-4601-92b7-4dbc950d210f",
        "value": "Payload.dll"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523071",
        "to_ids": true,
        "type": "md5",
        "uuid": "57b5a8ff-8974-40f4-b6bd-44b6950d210f",
        "value": "8ea35293cbb0712a520c7b89059d5a2a"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523071",
        "to_ids": true,
        "type": "md5",
        "uuid": "57b5a8ff-1dd0-413f-8ede-46ab950d210f",
        "value": "6992370821f8fbeea4a96f7be8015967"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523072",
        "to_ids": true,
        "type": "md5",
        "uuid": "57b5a900-db74-4f77-8cff-4754950d210f",
        "value": "d9181d69c40fc95d7d27448f5ece1878"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523097",
        "to_ids": true,
        "type": "uri",
        "uuid": "57b5a919-cad0-42ff-9825-4d5a950d210f",
        "value": "/external/update"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523134",
        "to_ids": true,
        "type": "pdb",
        "uuid": "57b5a93e-f604-442f-8443-49d2950d210f",
        "value": "E:\\Projects\\ComplexStatement\\Shakti\\Code\\Carrier\\Release\\Carrier.pdb"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523135",
        "to_ids": true,
        "type": "pdb",
        "uuid": "57b5a93f-9fb4-4436-a220-4a41950d210f",
        "value": "E:\\Projects\\ComplexStatement\\Shakti\\Code\\Payload\\Release\\Payload.pdb"
      },
      {
        "category": "External analysis",
        "comment": "observed in 2014 by DrWeb and given a generic name, Trojan.DownLoader11.5634.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523281",
        "to_ids": false,
        "type": "link",
        "uuid": "57b5a9d1-46d0-4515-8152-429a950d210f",
        "value": "http://vms.drweb.ru/virus/?i=3793941&virus_name=Trojan.DownLoader11.5634"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523354",
        "to_ids": true,
        "type": "filename",
        "uuid": "57b5aa1a-cd14-4bd9-b994-4e4f950d210f",
        "value": "%UserProfile%\\uninst.dll"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1471523562",
        "to_ids": false,
        "type": "whois-registrant-email",
        "uuid": "57b5aaea-41e8-41ee-9a00-499c950d210f",
        "value": "ashrafahmed2882@yahoo.com"
      }
    ]
  }
}