{
  "Event": {
    "analysis": "2",
    "date": "2017-12-11",
    "extends_uuid": "",
    "info": "OSINT - Banking malware on Google Play targets Polish banks",
    "publish_timestamp": "1514468075",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1513825257",
    "uuid": "5a39216d-e93c-4046-8ff5-bfd8950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "name": "type:OSINT"
      },
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      },
      {
        "colour": "#00223b",
        "name": "osint:source-type=\"blog-post\""
      },
      {
        "colour": "#f24722",
        "name": "Banker"
      },
      {
        "colour": "#002f76",
        "name": "ms-caro-malware-full:malware-family=\"Banker\""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": false,
        "type": "link",
        "uuid": "5a392180-b698-400a-9024-1536950d210f",
        "value": "https://www.welivesecurity.com/2017/12/11/banking-malware-targets-polish-banks/",
        "Tag": [
          {
            "colour": "#00223b",
            "name": "osint:source-type=\"blog-post\""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": false,
        "type": "comment",
        "uuid": "5a3a24a1-2a94-44fa-88d7-46c0950d210f",
        "value": "Another set of banking Trojans has found its way past Google Play\u00e2\u20ac\u2122s security mechanisms, this time targeting a number of Polish banks. The malware managed to sneak into Google Play disguised as seemingly legitimate apps \u00e2\u20ac\u0153Crypto Monitor\u00e2\u20ac\u009d, a cryptocurrency price tracking app, and \u00e2\u20ac\u0153StorySaver\u00e2\u20ac\u009d, a third-party tool for downloading stories from Instagram.",
        "Tag": [
          {
            "colour": "#00223b",
            "name": "osint:source-type=\"blog-post\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cc-30dc-4013-8210-4b21950d210f",
        "value": "com.comarch.mobile"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-2184-4b96-9018-4666950d210f",
        "value": "pl.bzwbk.bzwbk24"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-adc0-4e15-ac10-4428950d210f",
        "value": "com.getingroup.mobilebanking"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-7284-44be-9b2a-4461950d210f",
        "value": "pl.pkobp.iko"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-0fbc-446c-8323-464f950d210f",
        "value": "pl.ing.mojeing"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-ebe0-42da-880e-423a950d210f",
        "value": "wit.android.bcpBankingApp.millenniumPL"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-40dc-45f5-9e92-4e8e950d210f",
        "value": "pl.mbank"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-83a8-470d-b24a-4a56950d210f",
        "value": "pl.bph"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-7ad0-48d3-8d55-4435950d210f",
        "value": "pl.fmbank.smart"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-4c38-47ad-9bfa-4715950d210f",
        "value": "eu.eleader.mobilebanking.pekao"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-a3dc-432a-b5cb-4171950d210f",
        "value": "eu.eleader.mobilebanking.pekao.firm"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-cc3c-480c-8cb4-4612950d210f",
        "value": "eu.eleader.mobilebanking.invest"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-634c-4d09-826d-4a28950d210f",
        "value": "eu.eleader.mobilebanking.raiffeisen"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a26cd-6cd0-44dd-9c14-4ffa950d210f",
        "value": "com.konylabs.cbplpat"
      },
      {
        "category": "Network activity",
        "comment": "Phishing server",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "domain",
        "uuid": "5a3a2774-9c5c-48e5-b05e-49bb950d210f",
        "value": "nelis.at"
      },
      {
        "category": "Network activity",
        "comment": "Phishing server",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513761473",
        "to_ids": true,
        "type": "domain",
        "uuid": "5a3a2774-8a18-4838-a42e-47e6950d210f",
        "value": "sdljfkh1313.win"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "8",
        "timestamp": "1513760668",
        "uuid": "5a3a279c-ebc4-44ab-b54e-4c19950d210f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "filename",
            "timestamp": "1513760668",
            "to_ids": true,
            "type": "filename",
            "uuid": "5a3a279c-0950-48fb-93c4-4f82950d210f",
            "value": "in.crypto.monitor.coins"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1513760668",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5a3a279c-3910-47d5-9e80-4583950d210f",
            "value": "57a96d024e61f683020be46173d74fad4cf05806"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "state",
            "timestamp": "1513760668",
            "to_ids": false,
            "type": "text",
            "uuid": "5a3a279c-fc24-47df-b0b6-4ca0950d210f",
            "value": "Malicious"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "8",
        "timestamp": "1513760693",
        "uuid": "5a3a27b5-7db0-4cbc-984b-47b9950d210f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "filename",
            "timestamp": "1513760693",
            "to_ids": true,
            "type": "filename",
            "uuid": "5a3a27b5-0e14-4f1c-bba3-4b42950d210f",
            "value": "com.app.storysavernew"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1513760693",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5a3a27b5-e288-4fe6-906c-4428950d210f",
            "value": "757ea52db39e9cdbf5e2e95485801e3e4b19020d"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "state",
            "timestamp": "1513760693",
            "to_ids": false,
            "type": "text",
            "uuid": "5a3a27b5-b884-48bd-96c0-45e3950d210f",
            "value": "Malicious"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "7",
        "timestamp": "1513761476",
        "uuid": "277a53e1-58de-48f5-a24b-1020de7738aa",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "277a53e1-58de-48f5-a24b-1020de7738aa",
            "referenced_uuid": "026a1242-16cf-491b-9bab-2de522dfba23",
            "relationship_type": "analysed-with",
            "timestamp": "1514468074",
            "uuid": "5a3a2ac2-7d44-4a04-becd-40d902de0b81"
          }
        ],
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1513761474",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5a3a2ac2-5260-4191-bab6-4f7502de0b81",
            "value": "757ea52db39e9cdbf5e2e95485801e3e4b19020d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1513761474",
            "to_ids": true,
            "type": "md5",
            "uuid": "5a3a2ac2-59e4-4aff-8289-420402de0b81",
            "value": "5e9b289928004deade3fbfc20049abf5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1513761474",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5a3a2ac2-3180-4ac0-92eb-4b4402de0b81",
            "value": "204f2e5e18691156036cbcfc69fa759272a2180fba77a74415ccb2c7469a670b"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "1",
        "timestamp": "1513761474",
        "uuid": "026a1242-16cf-491b-9bab-2de522dfba23",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "permalink",
            "timestamp": "1513761474",
            "to_ids": false,
            "type": "link",
            "uuid": "5a3a2ac2-17e4-4668-bec1-4fb102de0b81",
            "value": "https://www.virustotal.com/file/204f2e5e18691156036cbcfc69fa759272a2180fba77a74415ccb2c7469a670b/analysis/1513618446/"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1513761474",
            "to_ids": false,
            "type": "text",
            "uuid": "5a3a2ac2-8e18-430c-9768-488302de0b81",
            "value": "26/62"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "last-submission",
            "timestamp": "1513761474",
            "to_ids": false,
            "type": "datetime",
            "uuid": "5a3a2ac2-1be0-4199-bcfc-423302de0b81",
            "value": "2017-12-18T17:34:06"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "7",
        "timestamp": "1513761477",
        "uuid": "f011249c-b0da-4bd6-9043-07bcc2414922",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "f011249c-b0da-4bd6-9043-07bcc2414922",
            "referenced_uuid": "faf365d9-29da-477a-b73d-a22e07c53249",
            "relationship_type": "analysed-with",
            "timestamp": "1514468075",
            "uuid": "5a3a2ac2-80a4-428d-957b-481c02de0b81"
          }
        ],
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1513761474",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5a3a2ac2-d95c-44b3-a586-491e02de0b81",
            "value": "57a96d024e61f683020be46173d74fad4cf05806"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1513761474",
            "to_ids": true,
            "type": "md5",
            "uuid": "5a3a2ac2-f4a8-4f23-b228-481402de0b81",
            "value": "883c2183fecc06f1faab8fbab03186e6"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1513761474",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5a3a2ac2-aaec-482b-99d4-466c02de0b81",
            "value": "86aaed9017e3af5d1d9c8460f2d8164f14e14db01b1a278b4b93859d3cf982f5"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "1",
        "timestamp": "1513761474",
        "uuid": "faf365d9-29da-477a-b73d-a22e07c53249",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "permalink",
            "timestamp": "1513761474",
            "to_ids": false,
            "type": "link",
            "uuid": "5a3a2ac2-bd34-4ab5-a5fe-439302de0b81",
            "value": "https://www.virustotal.com/file/86aaed9017e3af5d1d9c8460f2d8164f14e14db01b1a278b4b93859d3cf982f5/analysis/1513240956/"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1513761474",
            "to_ids": false,
            "type": "text",
            "uuid": "5a3a2ac2-2b70-47a0-98c7-4be502de0b81",
            "value": "17/63"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "last-submission",
            "timestamp": "1513761474",
            "to_ids": false,
            "type": "datetime",
            "uuid": "5a3a2ac2-e174-44ff-97a8-456f02de0b81",
            "value": "2017-12-14T08:42:36"
          }
        ]
      }
    ]
  }
}