{ "Event": { "analysis": "1", "date": "2018-05-10", "extends_uuid": "", "info": "OSINT - Botnet exploiting GPON Vulnerability", "publish_timestamp": "1525949450", "published": true, "threat_level_id": "3", "timestamp": "1525948956", "uuid": "5af412ea-4254-4668-b1ea-44bc950d210f", "Orgc": { "name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" }, "Tag": [ { "colour": "#22681c", "local": "0", "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": "" }, { "colour": "#ffffff", "local": "0", "name": "tlp:white", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": false, "type": "link", "uuid": "5af412f6-37f8-4996-8b4c-4055950d210f", "value": "https://otx.alienvault.com/pulse/5af4123acb33890af1f6e769" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "sha256", "uuid": "5af41315-9390-4d7f-9def-402b950d210f", "value": "1ff787d52bc9e4a6c27d75b1a427c3e5dd16d6d5f082a79227c14edf8e908ab2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "sha256", "uuid": "5af41316-1d0c-4ae9-8e42-4a83950d210f", "value": "7caac9c9fa954730665d63b692119ba5f14ee6c07cf11ffc60bca7b3d25ea109" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "sha256", "uuid": "5af41316-6910-4920-bb47-4788950d210f", "value": "a79964ce5cf4b92f996bbc24230e102b94ef05fb072c0afdeabc88d28695cace" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "sha256", "uuid": "5af41317-4ca4-419f-b092-4144950d210f", "value": "bab7e9f42df88902acb00fbdf3b4b5d8ffec2a1a7ad32eb5f2fb1dbf38f3167d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "sha256", "uuid": "5af41317-5d4c-40bb-9e4d-4c37950d210f", "value": "efa4fe06e4949c0f7aedea61a79da92e379ea66b169cd1d99c47b9e93e814093" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "ip-dst", "uuid": "5af41322-2c5c-487f-a025-46ec950d210f", "value": "185.62.190.191" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "url", "uuid": "5af41348-d5a0-4482-846d-4c7f950d210f", "value": "http://185.62.190.191/arm" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "url", "uuid": "5af41349-06b0-47c3-8da5-4703950d210f", "value": "http://185.62.190.191/arm.shell" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "url", "uuid": "5af41349-c1f0-436e-87c0-4205950d210f", "value": "http://185.62.190.191/arm7" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "url", "uuid": "5af4134a-1078-43b5-a581-41bf950d210f", "value": "http://185.62.190.191/arm7.shell" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "url", "uuid": "5af4134a-2874-441f-82e0-4014950d210f", "value": "http://185.62.190.191/mips" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "url", "uuid": "5af4134a-fe74-4b74-b27f-4a30950d210f", "value": "http://185.62.190.191/mips.shell" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "url", "uuid": "5af4134b-a0dc-48d8-ab6a-45b3950d210f", "value": "http://185.62.190.191/mipsel" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "url", "uuid": "5af4134b-b314-4513-a092-4162950d210f", "value": "http://185.62.190.191/mipsel.shell" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": true, "type": "url", "uuid": "5af4134c-c124-4199-aa8a-47da950d210f", "value": "http://185.62.190.191/r" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": false, "type": "vulnerability", "uuid": "5af42049-af54-4183-b0f9-4141950d210f", "value": "CVE-2018-10561" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": false, "type": "vulnerability", "uuid": "5af4206b-3850-44de-8419-46ce950d210f", "value": "CVE-2018-10562" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1525948953", "to_ids": false, "type": "cpe", "uuid": "5af42165-4184-439e-ba46-4ac0950d210f", "value": "cpe:2.3:h:dasannetworks" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525945174", "uuid": "dc6a8900-6a96-4f53-bdfd-0254abb3488c", "ObjectReference": [ { "comment": "", "object_uuid": "dc6a8900-6a96-4f53-bdfd-0254abb3488c", "referenced_uuid": "8d13fd99-2a7c-4017-9387-2567f59daf69", "relationship_type": "analysed-with", "timestamp": "1525945183", "uuid": "5af4135f-0e00-4fcc-be97-423a02de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525948953", "to_ids": true, "type": "md5", "uuid": "1d7b28a4-33e8-4386-baa2-7943c8b362ac", "value": "d546bc209d315ae81869315e8d536f36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525948953", "to_ids": true, "type": "sha1", "uuid": "af835e29-89d4-4c0b-a734-9fda7c1ca9f8", "value": "06f08af784b24a55018b4489afab19f0436b90a9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525948953", "to_ids": true, "type": "sha256", "uuid": "2d74de7b-abf5-4adc-a9af-f905b35559a2", "value": "efa4fe06e4949c0f7aedea61a79da92e379ea66b169cd1d99c47b9e93e814093" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "2", "timestamp": "1525945173", "uuid": "8d13fd99-2a7c-4017-9387-2567f59daf69", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525948953", "to_ids": false, "type": "datetime", "uuid": "45b43d13-842d-4667-8659-91fb716c6d9b", "value": "2018-05-10T06:56:45" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525948953", "to_ids": false, "type": "link", "uuid": "8996de04-2834-4353-8557-def8438f0b8c", "value": "https://www.virustotal.com/file/efa4fe06e4949c0f7aedea61a79da92e379ea66b169cd1d99c47b9e93e814093/analysis/1525935405/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525948953", "to_ids": false, "type": "text", "uuid": "2d469a44-218a-47d4-bd14-28ceac501c0a", "value": "0/58" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525945177", "uuid": "b6b62156-63cf-4749-a53e-0fbf146c58cc", "ObjectReference": [ { "comment": "", "object_uuid": "b6b62156-63cf-4749-a53e-0fbf146c58cc", "referenced_uuid": "18ba50c8-c137-4b81-a1e7-139dd14edb85", "relationship_type": "analysed-with", "timestamp": "1525945183", "uuid": "5af4135f-52e0-4bd2-88e6-413002de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525948953", "to_ids": true, "type": "md5", "uuid": "0d836b4a-bb9c-48b8-a837-0eece416ab37", "value": "21fa1dcc069309245a8aa1c142f112a3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525948953", "to_ids": true, "type": "sha1", "uuid": "aae2dec0-5abf-45a7-8dbb-548bdb9335e5", "value": "c724be3b4cc8b7e0fbac7d0391be0f2aea0b5b19" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525948953", "to_ids": true, "type": "sha256", "uuid": "db1dcc33-82b6-42d8-9bf3-24b03216c417", "value": "a79964ce5cf4b92f996bbc24230e102b94ef05fb072c0afdeabc88d28695cace" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "2", "timestamp": "1525945175", "uuid": "18ba50c8-c137-4b81-a1e7-139dd14edb85", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525948953", "to_ids": false, "type": "datetime", "uuid": "c4e03498-2663-4831-bcfb-f890f3dd4046", "value": "2018-05-10T08:31:41" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525948953", "to_ids": false, "type": "link", "uuid": "85e41194-4be4-4c8b-9f59-688047946889", "value": "https://www.virustotal.com/file/a79964ce5cf4b92f996bbc24230e102b94ef05fb072c0afdeabc88d28695cace/analysis/1525941101/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525948953", "to_ids": false, "type": "text", "uuid": "a6c92bca-84f0-49c4-b8db-91bd00ccaa53", "value": "0/60" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525945179", "uuid": "45af68f9-c923-46f1-8109-faecfda308db", "ObjectReference": [ { "comment": "", "object_uuid": "45af68f9-c923-46f1-8109-faecfda308db", "referenced_uuid": "59cf2b7f-07e3-4edc-a259-f0a20bb7385c", "relationship_type": "analysed-with", "timestamp": "1525945183", "uuid": "5af4135f-10d4-4df2-8f0c-447702de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525948953", "to_ids": true, "type": "md5", "uuid": "8989c005-e462-4824-b7e2-c99f5213f0f6", "value": "2adb540db754366a1aa04ccca7105c80" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525948953", "to_ids": true, "type": "sha1", "uuid": "5839ca11-82e5-4636-8f34-c1f6511c49f3", "value": "041dcbad0ca62255129048636afec9b89b65a748" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525948953", "to_ids": true, "type": "sha256", "uuid": "9d47c5d1-3138-41b0-9689-db1b9f196edf", "value": "1ff787d52bc9e4a6c27d75b1a427c3e5dd16d6d5f082a79227c14edf8e908ab2" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "2", "timestamp": "1525945177", "uuid": "59cf2b7f-07e3-4edc-a259-f0a20bb7385c", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525948953", "to_ids": false, "type": "datetime", "uuid": "4f02463a-2c20-4c36-848f-4feeb763163b", "value": "2018-05-10T08:31:14" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525948953", "to_ids": false, "type": "link", "uuid": "744f3382-cfa3-4a58-9f5d-7be052b795fd", "value": "https://www.virustotal.com/file/1ff787d52bc9e4a6c27d75b1a427c3e5dd16d6d5f082a79227c14edf8e908ab2/analysis/1525941074/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525948953", "to_ids": false, "type": "text", "uuid": "dffbc1c1-8b01-4108-b226-51be41118f85", "value": "0/52" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525945181", "uuid": "7a02e5c6-e5da-45ec-a657-668dac4eb660", "ObjectReference": [ { "comment": "", "object_uuid": "7a02e5c6-e5da-45ec-a657-668dac4eb660", "referenced_uuid": "de42e5e8-eaf8-46d1-8cd9-43918d19e250", "relationship_type": "analysed-with", "timestamp": "1525945183", "uuid": "5af4135f-1c10-453c-9d9a-487502de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525948953", "to_ids": true, "type": "md5", "uuid": "f346a55b-7617-4da7-98d3-fc5545294bdb", "value": "20deff5786a4769b219c304965559043" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525948953", "to_ids": true, "type": "sha1", "uuid": "14a1da9b-e881-49eb-8aaf-6c44be77c2c4", "value": "dc6102418faedf4379bfc786acb216d5defe64f0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525948953", "to_ids": true, "type": "sha256", "uuid": "225c7786-df88-4fd3-94d9-51d2ff27d5fe", "value": "bab7e9f42df88902acb00fbdf3b4b5d8ffec2a1a7ad32eb5f2fb1dbf38f3167d" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "2", "timestamp": "1525945180", "uuid": "de42e5e8-eaf8-46d1-8cd9-43918d19e250", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525948953", "to_ids": false, "type": "datetime", "uuid": "c79e6e09-dd54-4cbc-875c-7abdb53c2f4a", "value": "2018-05-10T08:31:27" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525948953", "to_ids": false, "type": "link", "uuid": "68c1f245-9031-479f-a729-f8a227046e5b", "value": "https://www.virustotal.com/file/bab7e9f42df88902acb00fbdf3b4b5d8ffec2a1a7ad32eb5f2fb1dbf38f3167d/analysis/1525941087/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525948953", "to_ids": false, "type": "text", "uuid": "63eae805-0aea-4d07-9ff4-8cef4a623a81", "value": "0/59" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "11", "timestamp": "1525945184", "uuid": "4a3b47dc-bdfb-4938-a0d2-eb685c5f0159", "ObjectReference": [ { "comment": "", "object_uuid": "4a3b47dc-bdfb-4938-a0d2-eb685c5f0159", "referenced_uuid": "2ab174e4-96c0-478b-9f8a-a43c7f49341c", "relationship_type": "analysed-with", "timestamp": "1525945183", "uuid": "5af4135f-6e78-4bb3-9de8-469902de0b81" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1525948953", "to_ids": true, "type": "md5", "uuid": "adac7a8e-d296-4c7c-9b1a-1c216d528886", "value": "a536f99aa4030efb5d44c0b4792f4e9b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1525948953", "to_ids": true, "type": "sha1", "uuid": "7b81ec47-f4ff-48ac-bca5-38a8c3d59831", "value": "44e341d28d744e0b3d2fa1a8cc3481f184d155ff" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1525948953", "to_ids": true, "type": "sha256", "uuid": "29574595-7bec-4d74-a332-529b909801bc", "value": "7caac9c9fa954730665d63b692119ba5f14ee6c07cf11ffc60bca7b3d25ea109" } ] }, { "comment": "", "deleted": false, "description": "VirusTotal report", "meta-category": "misc", "name": "virustotal-report", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "template_version": "2", "timestamp": "1525945182", "uuid": "2ab174e4-96c0-478b-9f8a-a43c7f49341c", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "last-submission", "timestamp": "1525948953", "to_ids": false, "type": "datetime", "uuid": "37b71505-ff33-4199-a543-901564c40401", "value": "2018-05-09T21:12:19" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "permalink", "timestamp": "1525948953", "to_ids": false, "type": "link", "uuid": "55484663-5402-4902-b741-1165e89e8e86", "value": "https://www.virustotal.com/file/7caac9c9fa954730665d63b692119ba5f14ee6c07cf11ffc60bca7b3d25ea109/analysis/1525900339/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "detection-ratio", "timestamp": "1525948953", "to_ids": false, "type": "text", "uuid": "cdb5cf8b-006d-4ea6-8921-136278f3eb35", "value": "0/60" } ] } ] } }