{
  "Event": {
    "analysis": "2",
    "date": "2016-08-08",
    "extends_uuid": "",
    "info": "OSINT Group5: Syria and the Iranian Connection by Citizen Lab",
    "publish_timestamp": "1470728110",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1470670614",
    "uuid": "57a89edc-e184-41da-8e51-4f98950d210f",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "name": "type:OSINT"
      },
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668529",
        "to_ids": false,
        "type": "link",
        "uuid": "57a89ef1-3684-48b6-9cd9-4cec950d210f",
        "value": "https://citizenlab.org/2016/08/group5-syria/"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668614",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a89f46-5164-4d62-8950-4010950d210f",
        "value": "76f8142b4e52c671871b3df87f10c30c"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668635",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a89f5b-3f98-466d-b470-45ae950d210f",
        "value": "7d898530d2e77f15f5badce8d7df215e"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668636",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57a89f5c-d490-4b3d-a562-4ea1950d210f",
        "value": "c19bc1ff5f8472fb7ba64f33c2168b42ea881a6ae6e134a1cc142e984fb6647f"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668655",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a89f6f-88e4-4f31-bf88-415d950d210f",
        "value": "a4f1f4921bb11ff9d22fad89b19b155d"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668655",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57a89f6f-7f94-4071-8a23-4708950d210f",
        "value": "d81ec563387e2ea47bc8ed50fd36e1de955cb2331d6eaae9f966b5d7ab094806"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668715",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57a89fab-e96c-48d6-9442-4b20950d210f",
        "value": "88.198.222.163"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668830",
        "to_ids": true,
        "type": "pdb",
        "uuid": "57a8a01e-2584-4989-b50e-459f950d210f",
        "value": "%USERPROFILE%\\documents\\visual studio 2013\\projects\\paccryptnano core dehgani -vds\\windowsapplication2\\obj\\debug\\launch manager.pdb"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668830",
        "to_ids": true,
        "type": "pdb",
        "uuid": "57a8a01e-e384-4834-900a-4bf6950d210f",
        "value": "%USERPROFILE%\\Documents\\Visual Studio 2013\\Projects\\paccrypt11njratmalii\\paccryptalipnahzade\\obj\\Debug\\LManager.pdb"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668830",
        "to_ids": true,
        "type": "pdb",
        "uuid": "57a8a01e-8d70-4809-a4c1-4158950d210f",
        "value": "%USERPROFILE%\\Documents\\Visual Studio 2013\\Projects\\njrat7stubsoures \u00e2\u20ac\u201c Copy\\njrat7stubsoures\\obj\\Debug\\dvvm.pdb"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668883",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a053-5038-4cb1-ac18-4dcc950d210f",
        "value": "2fc276e1c06c3c78c6d7b66a141213be"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668883",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a053-b898-48f8-9c30-4008950d210f",
        "value": "30bb678db3ad0140fc33acd9803385c3"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668883",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a053-1490-4c4e-88b5-4c61950d210f",
        "value": "366908f6c5c4f4329478d60586eca5bc"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668883",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a053-b750-48d2-9d45-4063950d210f",
        "value": "494bab7fd0b42b0b14051ed9abbd651f"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668883",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a053-2210-463f-b62e-4265950d210f",
        "value": "5c4ec3d93a664e4bfa1ce6286ccf0249"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668884",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a054-3510-4d4b-bd37-40e7950d210f",
        "value": "6161083021b695814434450c1882f9f3"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668884",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a054-5cc4-4553-b98f-413a950d210f",
        "value": "7d898530d2e77f15f5badce8d7df215e"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668884",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a054-b8ec-46a3-b7fe-4c77950d210f",
        "value": "8ebeb3f91cda8e985a9c61beb8cdde9d"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668884",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a054-20dc-40ab-8aed-4d5e950d210f",
        "value": "a4f1f4921bb11ff9d22fad89b19b155d"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668884",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a054-cf94-4942-8e56-466f950d210f",
        "value": "b4121c3a1892332402000ef0d587c0ee"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668885",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a055-6638-4b69-9e04-43a9950d210f",
        "value": "dd5bedd915967c5efe00733cf7478cb4"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470668885",
        "to_ids": true,
        "type": "md5",
        "uuid": "57a8a055-731c-479e-a426-466c950d210f",
        "value": "f1f84ea3229dca0ccacb7381a2f49f99"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: f1f84ea3229dca0ccacb7381a2f49f99",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670614",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57a8a716-1d6c-41e8-be1b-4d2902de0b81",
        "value": "29cedb039e43988730c13f702deb3cb90e2fd9927538d172ad7e1ed50f8ca67b"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: f1f84ea3229dca0ccacb7381a2f49f99",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670615",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57a8a717-d62c-4284-a088-47df02de0b81",
        "value": "9801609d68d925b9dc9ef653be10467b1bcc3b92"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: f1f84ea3229dca0ccacb7381a2f49f99",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670615",
        "to_ids": false,
        "type": "link",
        "uuid": "57a8a717-834c-4153-b603-4d9902de0b81",
        "value": "https://www.virustotal.com/file/29cedb039e43988730c13f702deb3cb90e2fd9927538d172ad7e1ed50f8ca67b/analysis/1470114448/"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 8ebeb3f91cda8e985a9c61beb8cdde9d",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670615",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57a8a717-7ec4-42fc-b873-440e02de0b81",
        "value": "19febea0be411a36ea9cdc46241242fe103d043a8aaf932cba53cf8f04a54973"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 8ebeb3f91cda8e985a9c61beb8cdde9d",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670615",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57a8a717-84cc-4665-8892-4e7e02de0b81",
        "value": "bbf4836a86604d1f54a8d3335653625c5f813e71"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 8ebeb3f91cda8e985a9c61beb8cdde9d",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670615",
        "to_ids": false,
        "type": "link",
        "uuid": "57a8a717-2594-4bb1-b473-49cc02de0b81",
        "value": "https://www.virustotal.com/file/19febea0be411a36ea9cdc46241242fe103d043a8aaf932cba53cf8f04a54973/analysis/1470114667/"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 494bab7fd0b42b0b14051ed9abbd651f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670615",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57a8a717-c404-4e9f-9104-41b902de0b81",
        "value": "511801eda3d01c580f1e999f5c9d50d0f0d539d560e6d2476a9ee822029bafd8"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 494bab7fd0b42b0b14051ed9abbd651f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670616",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57a8a718-aef0-42d1-a4d8-419202de0b81",
        "value": "e555e5d99d1f52b484aa1c26ec45cb2dce054203"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 494bab7fd0b42b0b14051ed9abbd651f",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670616",
        "to_ids": false,
        "type": "link",
        "uuid": "57a8a718-f384-49b9-89d6-4bbe02de0b81",
        "value": "https://www.virustotal.com/file/511801eda3d01c580f1e999f5c9d50d0f0d539d560e6d2476a9ee822029bafd8/analysis/1470114544/"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 30bb678db3ad0140fc33acd9803385c3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670616",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57a8a718-32a8-4164-9838-450302de0b81",
        "value": "dd35724d3d1167d917234d0321aa5b874d15cb62d2e95a246a96d6c0b77580c9"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 30bb678db3ad0140fc33acd9803385c3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670616",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57a8a718-25ac-479c-96fa-403602de0b81",
        "value": "110fe73259097d12f52e1843470d41b2bb7f6132"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 30bb678db3ad0140fc33acd9803385c3",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670616",
        "to_ids": false,
        "type": "link",
        "uuid": "57a8a718-4c30-445b-81d3-4d5902de0b81",
        "value": "https://www.virustotal.com/file/dd35724d3d1167d917234d0321aa5b874d15cb62d2e95a246a96d6c0b77580c9/analysis/1470114482/"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 76f8142b4e52c671871b3df87f10c30c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670617",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57a8a719-d824-49f3-bd2f-4dae02de0b81",
        "value": "16b8b3b9969660f773e611438e0455082cfafb277ea9256bacc028cdf85f25ec"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 76f8142b4e52c671871b3df87f10c30c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670617",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57a8a719-0518-4529-875f-425c02de0b81",
        "value": "1dd44a61faee089f7d31d870fd1a5cc635701952"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 76f8142b4e52c671871b3df87f10c30c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1470670617",
        "to_ids": false,
        "type": "link",
        "uuid": "57a8a719-c3a4-4e5b-ac9d-4d5f02de0b81",
        "value": "https://www.virustotal.com/file/16b8b3b9969660f773e611438e0455082cfafb277ea9256bacc028cdf85f25ec/analysis/1470114420/"
      }
    ]
  }
}