{
  "Event": {
    "analysis": "1",
    "date": "2017-09-22",
    "extends_uuid": "",
    "info": "M2M -  Locky: \"Invoice RE-2017-09-21-00xxx\"\tfrom \"Amazon Marketplace\"",
    "publish_timestamp": "1506344602",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1506344596",
    "uuid": "59c561be-c660-49d3-8193-e0c7950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      },
      {
        "colour": "#006c6c",
        "name": "ecsirt:malicious-code=\"ransomware\""
      },
      {
        "colour": "#0088cc",
        "name": "misp-galaxy:ransomware=\"Locky\""
      }
    ],
    "Attribute": [
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "md5",
        "uuid": "59c561be-fa38-421b-83fc-48f8950d210f",
        "value": "149d63efd95781f3d3a07b838d14f04e"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59c561bf-9720-416e-9b86-46f0950d210f",
        "value": "35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59c561bf-ecd0-4323-96e1-43b0950d210f",
        "value": "ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59c561bf-b0f8-4391-8ae4-4309950d210f",
        "value": "7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561c0-b2a0-4e35-bd50-4bd6950d210f",
        "value": "http://81552.com/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561c0-b5e0-4142-8649-4ec8950d210f",
        "value": "81552.com"
      },
      {
        "category": "Network activity",
        "comment": "81552.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c561c1-9178-4058-9cb3-d2d7950d210f",
        "value": "203.83.241.105"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561c2-3f34-494b-b73a-4875950d210f",
        "value": "http://accuflowfloors.com/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561c2-4e58-4fa3-bca7-4b66950d210f",
        "value": "accuflowfloors.com"
      },
      {
        "category": "Network activity",
        "comment": "accuflowfloors.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c561c2-aed4-4bb2-8c22-4aae950d210f",
        "value": "65.182.174.12"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561c3-9fa0-43bf-93b3-df79950d210f",
        "value": "http://adr-werbetechnik.de/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561c3-fc10-43e6-855d-47cd950d210f",
        "value": "adr-werbetechnik.de"
      },
      {
        "category": "Network activity",
        "comment": "adr-werbetechnik.de",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c561c3-97c8-4a82-a68c-e0d9950d210f",
        "value": "85.236.207.83"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561c4-7880-4a4b-b932-47ba950d210f",
        "value": "http://aetozi.gr/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561c4-af4c-4f57-a1f0-d2d7950d210f",
        "value": "aetozi.gr"
      },
      {
        "category": "Network activity",
        "comment": "aetozi.gr",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c561c4-9288-4676-bd19-7461950d210f",
        "value": "185.4.135.15"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561c5-e5a0-4e89-8240-48e2950d210f",
        "value": "http://afmance.it/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561c5-5350-430b-ab83-49ba950d210f",
        "value": "afmance.it"
      },
      {
        "category": "Network activity",
        "comment": "afmance.it",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c561c5-bdd4-4047-bb19-4656950d210f",
        "value": "151.1.140.206"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561c6-32bc-40b5-8b26-e0d9950d210f",
        "value": "http://afradem.com/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561c6-2a60-4934-afb3-4b36950d210f",
        "value": "afradem.com"
      },
      {
        "category": "Network activity",
        "comment": "afradem.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c561c6-a6c4-4293-b7ac-4260950d210f",
        "value": "178.255.99.134"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561c7-2b18-4256-b68a-41cf950d210f",
        "value": "http://agricom.it/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561c7-3358-4ad1-8ada-1330950d210f",
        "value": "agricom.it"
      },
      {
        "category": "Network activity",
        "comment": "agricom.it",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c561c7-7fb8-4db0-9207-e0c7950d210f",
        "value": "195.225.168.230"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561c8-df5c-4a42-9887-42d2950d210f",
        "value": "http://agriturismobellaria.net/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561c8-cda8-4c40-a088-4fde950d210f",
        "value": "agriturismobellaria.net"
      },
      {
        "category": "Network activity",
        "comment": "agriturismobellaria.net",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c561c8-15ec-4b9d-bed3-4e91950d210f",
        "value": "80.88.87.95"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561c9-1a30-4595-972b-475f950d210f",
        "value": "http://agro-kerler.de/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561c9-e21c-48e3-9b19-d2d7950d210f",
        "value": "agro-kerler.de"
      },
      {
        "category": "Network activity",
        "comment": "agro-kerler.de",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c561ca-5134-4bee-a8f5-7461950d210f",
        "value": "213.165.96.3"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561ca-d87c-4f1a-b49c-e0c7950d210f",
        "value": "http://ahlbrandt.eu/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561ca-fe2c-4e66-8408-44e2950d210f",
        "value": "ahlbrandt.eu"
      },
      {
        "category": "Network activity",
        "comment": "ahlbrandt.eu",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c561ca-4290-4553-baa4-449d950d210f",
        "value": "87.230.26.149"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561cb-7710-463b-843c-411b950d210f",
        "value": "http://fulcar.info/p66/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561cb-22c0-4e86-9c65-4e82950d210f",
        "value": "fulcar.info"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "url",
        "uuid": "59c561cc-4128-45ea-ac19-df79950d210f",
        "value": "http://moonmusic.com.au/IUGiwe8"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59c561cc-44e0-43a8-a6c9-40aa950d210f",
        "value": "moonmusic.com.au"
      },
      {
        "category": "Network activity",
        "comment": "moonmusic.com.au",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59c561cd-3be8-4825-a2e0-d2d7950d210f",
        "value": "117.55.235.14"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506344173",
        "to_ids": true,
        "type": "link",
        "uuid": "59c561cd-b0e8-4e76-9e05-4670950d210f",
        "value": "http://blog.dynamoo.com/2017/09/malware-spam-invoice-re-2017-09-21.html"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "link",
        "uuid": "59c561d0-4d28-48f3-997d-1330950d210f",
        "value": "https://www.virustotal.com/#/file/35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca/detection"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "link",
        "uuid": "59c561d6-b3d4-4c42-a4a9-48c0950d210f",
        "value": "https://www.virustotal.com/#/file/ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53/detection"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "link",
        "uuid": "59c561d6-0cac-48c8-9a4d-42f9950d210f",
        "value": "https://www.hybrid-analysis.com/sample/35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca?environmentId=100"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108050",
        "to_ids": false,
        "type": "link",
        "uuid": "59c561d6-1f8c-42d4-8dca-4d6a950d210f",
        "value": "https://www.hybrid-analysis.com/sample/7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c?environmentId=100"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59c56293-68e4-4593-a751-484802de0b81",
        "value": "7eb945458b1f489b351b86e3ff4403edc3503653"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "md5",
        "uuid": "59c56293-cd4c-41e1-b0fa-463b02de0b81",
        "value": "f3fcbc16b37e56f7a89ddf7d0f718291"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "link",
        "uuid": "59c56293-67c0-4948-a658-4c1402de0b81",
        "value": "https://www.virustotal.com/file/35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca/analysis/1506079172/"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59c56293-80c4-4db9-a9eb-44f702de0b81",
        "value": "cb540085bef26e1b627476636701006abdff5de9"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "md5",
        "uuid": "59c56293-6ca8-4988-b890-490c02de0b81",
        "value": "c47bc13595d44521b3f5567ded0a0a13"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "link",
        "uuid": "59c56293-5f64-49d4-8ff6-44e902de0b81",
        "value": "https://www.virustotal.com/file/7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c/analysis/1505989331/"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59c56293-4794-477d-8834-441a02de0b81",
        "value": "0f4ca32e004dbbf7c3e485b3ccd6ed1adac7fb65"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1506108051",
        "to_ids": false,
        "type": "link",
        "uuid": "59c56293-9ffc-40dc-b442-4f9902de0b81",
        "value": "https://www.virustotal.com/file/ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53/analysis/1506053433/"
      }
    ]
  }
}