{
  "Event": {
    "analysis": "2",
    "date": "2017-02-05",
    "extends_uuid": "",
    "info": "OSINT - From RTF to Cobalt Strike passing via Flash",
    "publish_timestamp": "1486315504",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1486315427",
    "uuid": "58975d16-ec0c-4d21-88bd-41eb02de0b81",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315015",
        "to_ids": false,
        "type": "link",
        "uuid": "58975d3c-caf0-4a77-9002-4b8002de0b81",
        "value": "https://zairon.wordpress.com/2017/02/05/from-rtf-to-cobalt-strike-passing-via-flash/",
        "Tag": [
          {
            "colour": "#00223b",
            "name": "osint:source-type=\"blog-post\""
          },
          {
            "colour": "#0c9100",
            "name": "admiralty-scale:source-reliability=\"f\""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486314833",
        "to_ids": false,
        "type": "text",
        "uuid": "58975d51-c544-4264-afff-04a402de0b81",
        "value": "Quick Sunday morning blog post, analysis of an unknown rtf file. This article is a result of an initial investigation, no attribution is done but you\u00e2\u20ac\u2122ll have all the necessary info for a deeper investigation.\r\nThe malicious document has SHA256: 5D9E1F4DAB6929BC699BA7E5C4FD09F2BBFD6B59D04CEFD8F4BF06710E684A5E.\r\n\r\nAfter a first glance I thought to know what\u00e2\u20ac\u2122s behind the rft, but running a specific script I got disappointed by the result. For a quick response, a submission to a sandbox could be the best option you have, but you\u00e2\u20ac\u2122ll miss all the fun! I decided to manually check using an hex editor because it\u00e2\u20ac\u2122s incredible how you can extract objects in a fast way."
      },
      {
        "category": "Payload delivery",
        "comment": "malicious document - RTF file",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315351",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58975d66-bef0-44f2-9073-444502de0b81",
        "value": "5d9e1f4dab6929bc699ba7e5c4fd09f2bbfd6b59d04cefd8f4bf06710e684a5e",
        "Tag": [
          {
            "colour": "#00add3",
            "name": "veris:action:social:vector=\"Documents\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Extracted payload from RTF",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315352",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58975da5-2764-4039-8d46-408302de0b81",
        "value": "4c72df74a1e8039c94b188f1c5c59f30ddcc7107647689e4d908e55d04ff8b52",
        "Tag": [
          {
            "colour": "#00add3",
            "name": "veris:action:social:vector=\"Documents\""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Cobalt Strike artifact url",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315403",
        "to_ids": true,
        "type": "url",
        "uuid": "58975dc4-52e4-489b-bf43-409202de0b81",
        "value": "https://193.238.152.198/OeeC",
        "Tag": [
          {
            "colour": "#7000b4",
            "name": "adversary:infrastructure-type=\"unknown\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Cobalt Strike",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486314949",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58975dc5-8268-450b-850d-461c02de0b81",
        "value": "2fa6ec644b0a05c0cbe7ebaf4cc4905281e65764e91ed299d5cb3f54ab4943bf"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486314995",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "58975ddc-d404-4a6f-8e95-4b6c02de0b81",
        "value": "193.238.152.198",
        "Tag": [
          {
            "colour": "#62009e",
            "name": "adversary:infrastructure-state=\"active\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315352",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58975e36-6cb0-4f7d-ad7a-4a0b02de0b81",
        "value": "7a63fc5253deb672036e018750fd40dc3e8502f3b07ef225e7e6bc1144d1d7ee",
        "Tag": [
          {
            "colour": "#00add3",
            "name": "veris:action:social:vector=\"Documents\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315353",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58975e36-b704-437c-9c38-4ca302de0b81",
        "value": "08c9bd7b7b8361c5d217570019ff012773407337c9083910f2ae3a09b5401345",
        "Tag": [
          {
            "colour": "#00add3",
            "name": "veris:action:social:vector=\"Documents\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315354",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58975e37-51e8-49c6-a2b1-403302de0b81",
        "value": "8e27a641684da744a0882d3664cf84d5a88b8e82ac0070d3602af0b7c103eeeb",
        "Tag": [
          {
            "colour": "#00add3",
            "name": "veris:action:social:vector=\"Documents\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315355",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58975e38-9bd0-4bf4-9a87-415b02de0b81",
        "value": "9c7208c5c0d431738c8682cf6a2bd81df66977cbabffa0570f9d70518bece912",
        "Tag": [
          {
            "colour": "#00add3",
            "name": "veris:action:social:vector=\"Documents\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315355",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58975e39-5fa4-4cfd-abff-4c0702de0b81",
        "value": "21dda5c82e5aa5c8545b96dc2d6d63e6786fea73453f5acaa571fd5c0466363d",
        "Tag": [
          {
            "colour": "#00add3",
            "name": "veris:action:social:vector=\"Documents\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315356",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58975e3a-5940-400e-9815-43e202de0b81",
        "value": "af178ff11088ff59640f74191785adf134aee296652080f397cf282db36fad46",
        "Tag": [
          {
            "colour": "#00add3",
            "name": "veris:action:social:vector=\"Documents\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315357",
        "to_ids": true,
        "type": "sha256",
        "uuid": "58975e3a-06c4-451d-b8db-475e02de0b81",
        "value": "cb743f5057c77069a10ecd9e6b4fd48be096b1502e9fb3548e8a742e284eeae2",
        "Tag": [
          {
            "colour": "#00add3",
            "name": "veris:action:social:vector=\"Documents\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: cb743f5057c77069a10ecd9e6b4fd48be096b1502e9fb3548e8a742e284eeae2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315427",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58975fa3-9c0c-437f-997b-402902de0b81",
        "value": "862b1f9115c757e27d8c68f4a50341dbab1b15b1"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: cb743f5057c77069a10ecd9e6b4fd48be096b1502e9fb3548e8a742e284eeae2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315428",
        "to_ids": true,
        "type": "md5",
        "uuid": "58975fa4-1374-4b9b-baee-459f02de0b81",
        "value": "6fdcb2847df6939f1e73c68d5cbd573f"
      },
      {
        "category": "External analysis",
        "comment": "Possible related rtf file - Xchecked via VT: cb743f5057c77069a10ecd9e6b4fd48be096b1502e9fb3548e8a742e284eeae2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315429",
        "to_ids": false,
        "type": "link",
        "uuid": "58975fa5-87dc-4cce-a592-48bf02de0b81",
        "value": "https://www.virustotal.com/file/cb743f5057c77069a10ecd9e6b4fd48be096b1502e9fb3548e8a742e284eeae2/analysis/1486307052/"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: af178ff11088ff59640f74191785adf134aee296652080f397cf282db36fad46",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315430",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58975fa6-5168-4935-9c13-4ea002de0b81",
        "value": "e46e43116e35581eaeb26eee22d36bbb6bde032d"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: af178ff11088ff59640f74191785adf134aee296652080f397cf282db36fad46",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315430",
        "to_ids": true,
        "type": "md5",
        "uuid": "58975fa6-b790-4925-b617-423002de0b81",
        "value": "bc68d2a2b56789cf399e7530f1352fdc"
      },
      {
        "category": "External analysis",
        "comment": "Possible related rtf file - Xchecked via VT: af178ff11088ff59640f74191785adf134aee296652080f397cf282db36fad46",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315431",
        "to_ids": false,
        "type": "link",
        "uuid": "58975fa7-004c-4268-a8d3-41de02de0b81",
        "value": "https://www.virustotal.com/file/af178ff11088ff59640f74191785adf134aee296652080f397cf282db36fad46/analysis/1485937101/"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: 21dda5c82e5aa5c8545b96dc2d6d63e6786fea73453f5acaa571fd5c0466363d",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315432",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58975fa8-f164-4057-a063-413f02de0b81",
        "value": "f8bf4c87ec8eabad4dbf916328f50b02a5898c00"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: 21dda5c82e5aa5c8545b96dc2d6d63e6786fea73453f5acaa571fd5c0466363d",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315432",
        "to_ids": true,
        "type": "md5",
        "uuid": "58975fa8-2e30-4a60-b6b8-411102de0b81",
        "value": "3d4f5b714a19b7545e57743ee0003337"
      },
      {
        "category": "External analysis",
        "comment": "Possible related rtf file - Xchecked via VT: 21dda5c82e5aa5c8545b96dc2d6d63e6786fea73453f5acaa571fd5c0466363d",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315433",
        "to_ids": false,
        "type": "link",
        "uuid": "58975fa9-aea4-4c97-9fa7-481702de0b81",
        "value": "https://www.virustotal.com/file/21dda5c82e5aa5c8545b96dc2d6d63e6786fea73453f5acaa571fd5c0466363d/analysis/1485331419/"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: 9c7208c5c0d431738c8682cf6a2bd81df66977cbabffa0570f9d70518bece912",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315434",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58975faa-65d0-4034-bbee-440c02de0b81",
        "value": "c51a1ef7e599150437fc8947d94e6d9edea18be6"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: 9c7208c5c0d431738c8682cf6a2bd81df66977cbabffa0570f9d70518bece912",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315435",
        "to_ids": true,
        "type": "md5",
        "uuid": "58975fab-0564-4123-879b-491902de0b81",
        "value": "fd3f5a495a8d573f9b6add69a6af9b7d"
      },
      {
        "category": "External analysis",
        "comment": "Possible related rtf file - Xchecked via VT: 9c7208c5c0d431738c8682cf6a2bd81df66977cbabffa0570f9d70518bece912",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315435",
        "to_ids": false,
        "type": "link",
        "uuid": "58975fab-1eb0-49aa-88b8-46f802de0b81",
        "value": "https://www.virustotal.com/file/9c7208c5c0d431738c8682cf6a2bd81df66977cbabffa0570f9d70518bece912/analysis/1485841113/"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: 8e27a641684da744a0882d3664cf84d5a88b8e82ac0070d3602af0b7c103eeeb",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315436",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58975fac-a404-4333-be15-410102de0b81",
        "value": "a963103fb9802a59c99f0ced333586a33f1f5d5d"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: 8e27a641684da744a0882d3664cf84d5a88b8e82ac0070d3602af0b7c103eeeb",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315437",
        "to_ids": true,
        "type": "md5",
        "uuid": "58975fad-d3d4-4eac-aaab-4c0602de0b81",
        "value": "a5a507f41a217097d6394256ee401977"
      },
      {
        "category": "External analysis",
        "comment": "Possible related rtf file - Xchecked via VT: 8e27a641684da744a0882d3664cf84d5a88b8e82ac0070d3602af0b7c103eeeb",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315437",
        "to_ids": false,
        "type": "link",
        "uuid": "58975fad-3aa8-4fd0-af23-4cb502de0b81",
        "value": "https://www.virustotal.com/file/8e27a641684da744a0882d3664cf84d5a88b8e82ac0070d3602af0b7c103eeeb/analysis/1485962308/"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: 08c9bd7b7b8361c5d217570019ff012773407337c9083910f2ae3a09b5401345",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315438",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58975fae-d838-4f3e-871c-4e8602de0b81",
        "value": "463344f0ad46323fa191237db21e8e46a019fbfc"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: 08c9bd7b7b8361c5d217570019ff012773407337c9083910f2ae3a09b5401345",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315439",
        "to_ids": true,
        "type": "md5",
        "uuid": "58975faf-f7cc-470f-82fd-42dc02de0b81",
        "value": "60cab9d4211216b82e6430a7c51157fa"
      },
      {
        "category": "External analysis",
        "comment": "Possible related rtf file - Xchecked via VT: 08c9bd7b7b8361c5d217570019ff012773407337c9083910f2ae3a09b5401345",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315440",
        "to_ids": false,
        "type": "link",
        "uuid": "58975fb0-40e8-4db7-88e6-45d302de0b81",
        "value": "https://www.virustotal.com/file/08c9bd7b7b8361c5d217570019ff012773407337c9083910f2ae3a09b5401345/analysis/1485865450/"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: 7a63fc5253deb672036e018750fd40dc3e8502f3b07ef225e7e6bc1144d1d7ee",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315441",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58975fb1-fb64-4fb9-a961-4ef202de0b81",
        "value": "c90fdf1e20aa39cd84479543101d2b4f299b3485"
      },
      {
        "category": "Payload delivery",
        "comment": "Possible related rtf file - Xchecked via VT: 7a63fc5253deb672036e018750fd40dc3e8502f3b07ef225e7e6bc1144d1d7ee",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315441",
        "to_ids": true,
        "type": "md5",
        "uuid": "58975fb1-7c74-45ff-a4b8-4f6d02de0b81",
        "value": "b254fe605efdcc2aa235d431b1a30fa9"
      },
      {
        "category": "External analysis",
        "comment": "Possible related rtf file - Xchecked via VT: 7a63fc5253deb672036e018750fd40dc3e8502f3b07ef225e7e6bc1144d1d7ee",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315442",
        "to_ids": false,
        "type": "link",
        "uuid": "58975fb2-e3f4-4538-93cf-41e402de0b81",
        "value": "https://www.virustotal.com/file/7a63fc5253deb672036e018750fd40dc3e8502f3b07ef225e7e6bc1144d1d7ee/analysis/1485428950/"
      },
      {
        "category": "Payload delivery",
        "comment": "Cobalt Strike - Xchecked via VT: 2fa6ec644b0a05c0cbe7ebaf4cc4905281e65764e91ed299d5cb3f54ab4943bf",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315443",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58975fb3-05dc-4249-a5d7-44b802de0b81",
        "value": "2ee7db02a2a0a7b0666fe544d803384cbbdfba9c"
      },
      {
        "category": "Payload delivery",
        "comment": "Cobalt Strike - Xchecked via VT: 2fa6ec644b0a05c0cbe7ebaf4cc4905281e65764e91ed299d5cb3f54ab4943bf",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315444",
        "to_ids": true,
        "type": "md5",
        "uuid": "58975fb4-8fac-4a73-b782-495502de0b81",
        "value": "992722358935ce18c759333fee0588e0"
      },
      {
        "category": "External analysis",
        "comment": "Cobalt Strike - Xchecked via VT: 2fa6ec644b0a05c0cbe7ebaf4cc4905281e65764e91ed299d5cb3f54ab4943bf",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315445",
        "to_ids": false,
        "type": "link",
        "uuid": "58975fb5-2fb4-47cc-bc58-45c802de0b81",
        "value": "https://www.virustotal.com/file/2fa6ec644b0a05c0cbe7ebaf4cc4905281e65764e91ed299d5cb3f54ab4943bf/analysis/1486218685/"
      },
      {
        "category": "Payload delivery",
        "comment": "Extracted payload from RTF - Xchecked via VT: 4c72df74a1e8039c94b188f1c5c59f30ddcc7107647689e4d908e55d04ff8b52",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315445",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58975fb5-da7c-413a-bf5b-4c9c02de0b81",
        "value": "b7b53be3e38408ca9c0269cace71ae23994f168b"
      },
      {
        "category": "Payload delivery",
        "comment": "Extracted payload from RTF - Xchecked via VT: 4c72df74a1e8039c94b188f1c5c59f30ddcc7107647689e4d908e55d04ff8b52",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315446",
        "to_ids": true,
        "type": "md5",
        "uuid": "58975fb6-508c-4404-b75b-463d02de0b81",
        "value": "6faf7bf340105e5a119520761149c13f"
      },
      {
        "category": "External analysis",
        "comment": "Extracted payload from RTF - Xchecked via VT: 4c72df74a1e8039c94b188f1c5c59f30ddcc7107647689e4d908e55d04ff8b52",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315447",
        "to_ids": false,
        "type": "link",
        "uuid": "58975fb7-7838-40f2-a5e6-457002de0b81",
        "value": "https://www.virustotal.com/file/4c72df74a1e8039c94b188f1c5c59f30ddcc7107647689e4d908e55d04ff8b52/analysis/1486194786/"
      },
      {
        "category": "Payload delivery",
        "comment": "malicious document - RTF file - Xchecked via VT: 5d9e1f4dab6929bc699ba7e5c4fd09f2bbfd6b59d04cefd8f4bf06710e684a5e",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315448",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58975fb8-adc4-4972-a42a-4de302de0b81",
        "value": "7fe6cc2412b97fd27ca1bfb42ac811933c948f61"
      },
      {
        "category": "Payload delivery",
        "comment": "malicious document - RTF file - Xchecked via VT: 5d9e1f4dab6929bc699ba7e5c4fd09f2bbfd6b59d04cefd8f4bf06710e684a5e",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315448",
        "to_ids": true,
        "type": "md5",
        "uuid": "58975fb8-2444-468b-916a-4e7702de0b81",
        "value": "81f829be44598ccf33382920f2597104"
      },
      {
        "category": "External analysis",
        "comment": "malicious document - RTF file - Xchecked via VT: 5d9e1f4dab6929bc699ba7e5c4fd09f2bbfd6b59d04cefd8f4bf06710e684a5e",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486315449",
        "to_ids": false,
        "type": "link",
        "uuid": "58975fb9-63ac-4da5-a0b2-4fc702de0b81",
        "value": "https://www.virustotal.com/file/5d9e1f4dab6929bc699ba7e5c4fd09f2bbfd6b59d04cefd8f4bf06710e684a5e/analysis/1485944570/"
      }
    ]
  }
}