{
  "Event": {
    "analysis": "1",
    "date": "2017-10-06",
    "extends_uuid": "",
    "info": "M2M -  Locky 2017-10-06 : Affid=3, offline, \".ykcol\" : \"Your Remittance Advice\" - \"12345 Remittance.7z\"",
    "publish_timestamp": "1508084210",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1508084202",
    "uuid": "59d771e1-db74-4d94-97d4-d899950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#006c6c",
        "local": false,
        "name": "ecsirt:malicious-code=\"ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"Locky\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "md5",
        "uuid": "59d771e2-86b0-4e39-9223-d7f0950d210f",
        "value": "9979bd6521e1fbd4dcd2ff58da4c84ba"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771e2-9a2c-4da9-90b2-4114950d210f",
        "value": "http://2-wave.com/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771e2-30c4-417c-8e73-d88e950d210f",
        "value": "2-wave.com"
      },
      {
        "category": "Network activity",
        "comment": "2-wave.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771e3-4124-4215-9acc-d4aa950d210f",
        "value": "209.54.62.81"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771e3-a948-416c-b5e5-839d950d210f",
        "value": "http://3e.com.pt/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771e3-f0bc-40b3-865e-d50f950d210f",
        "value": "3e.com.pt"
      },
      {
        "category": "Network activity",
        "comment": "3e.com.pt",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771e3-127c-4cec-858d-d89a950d210f",
        "value": "174.141.224.179"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771e4-f8f8-4c27-a85c-d87d950d210f",
        "value": "http://9ninewright.net/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771e4-49f0-46fe-af3e-80c4950d210f",
        "value": "9ninewright.net"
      },
      {
        "category": "Network activity",
        "comment": "9ninewright.net",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771e4-c740-4e4c-b22e-4114950d210f",
        "value": "98.124.251.65"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771e4-8f0c-4195-8b7f-d50d950d210f",
        "value": "http://agricom.it/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771e5-e454-4bfb-a46b-d899950d210f",
        "value": "agricom.it"
      },
      {
        "category": "Network activity",
        "comment": "agricom.it",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771e5-a6d0-4c16-805b-d898950d210f",
        "value": "195.225.168.230"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771e5-7fb4-4818-8410-d834950d210f",
        "value": "http://agriturismo-1001ulivo.it/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771e5-4e2c-4657-9519-d7f0950d210f",
        "value": "agriturismo-1001ulivo.it"
      },
      {
        "category": "Network activity",
        "comment": "agriturismo-1001ulivo.it",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771e6-0ea0-4dbe-92cd-d88e950d210f",
        "value": "85.235.131.27"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771e6-1ca0-4303-b897-839d950d210f",
        "value": "http://agriturismobellaria.net/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771e6-a184-4efa-aa71-d89a950d210f",
        "value": "agriturismobellaria.net"
      },
      {
        "category": "Network activity",
        "comment": "agriturismobellaria.net",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771e6-dc58-4465-93f4-d87d950d210f",
        "value": "80.88.87.95"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771e6-fdd8-4b22-8c94-80c4950d210f",
        "value": "http://a-host.co.uk/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771e6-2db0-4a2b-94e3-4bfc950d210f",
        "value": "a-host.co.uk"
      },
      {
        "category": "Network activity",
        "comment": "a-host.co.uk",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771e7-713c-4b2c-93d1-d50d950d210f",
        "value": "213.165.85.53"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771e7-684c-4387-bf52-d899950d210f",
        "value": "http://alexandre-azaria.com/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771e7-e100-4ff8-94d2-83f8950d210f",
        "value": "alexandre-azaria.com"
      },
      {
        "category": "Network activity",
        "comment": "alexandre-azaria.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771e7-c594-4e5b-a458-409b950d210f",
        "value": "195.154.231.6"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771e8-66d4-4bf4-be02-d898950d210f",
        "value": "http://allesandradesigns.com/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771e8-a258-4a28-98ea-d88d950d210f",
        "value": "allesandradesigns.com"
      },
      {
        "category": "Network activity",
        "comment": "allesandradesigns.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771e8-34f4-4c84-85b5-d834950d210f",
        "value": "173.203.199.105"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771e8-68d4-4ea3-aa7b-d7f0950d210f",
        "value": "http://andresarlemijn.nl/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771e9-d250-4500-b122-439f950d210f",
        "value": "andresarlemijn.nl"
      },
      {
        "category": "Network activity",
        "comment": "andresarlemijn.nl",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771e9-b36c-4859-a6fa-d88e950d210f",
        "value": "195.60.215.74"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771e9-2228-493b-a364-d4aa950d210f",
        "value": "http://appartement-sailer.at/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771e9-368c-494b-a470-839d950d210f",
        "value": "appartement-sailer.at"
      },
      {
        "category": "Network activity",
        "comment": "appartement-sailer.at",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771e9-b170-44ec-9068-d89a950d210f",
        "value": "83.175.70.7"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771ea-67ac-4c38-897d-d87d950d210f",
        "value": "http://asheardontheradiogreens.com/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771ea-f064-42ad-b5d2-80c4950d210f",
        "value": "asheardontheradiogreens.com"
      },
      {
        "category": "Network activity",
        "comment": "asheardontheradiogreens.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771ea-fe70-4293-8dba-44d4950d210f",
        "value": "199.30.241.139"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771ea-cc20-48bf-bbc0-d50d950d210f",
        "value": "http://felixsolis.mobi/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771eb-5d30-4dbd-a67c-d899950d210f",
        "value": "felixsolis.mobi"
      },
      {
        "category": "Network activity",
        "comment": "felixsolis.mobi",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771eb-cc3c-48b3-90d7-83f8950d210f",
        "value": "5.2.27.27"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771eb-3dd0-47be-8d35-d898950d210f",
        "value": "http://PamelaSparrowChilds.com/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771eb-e51c-4c89-bb0f-d88d950d210f",
        "value": "pamelasparrowchilds.com"
      },
      {
        "category": "Network activity",
        "comment": "PamelaSparrowChilds.com",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "59d771ec-0be4-4da0-acfd-d7f0950d210f",
        "value": "23.229.153.66"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "url",
        "uuid": "59d771ec-b954-4f76-a9a1-4d96950d210f",
        "value": "http://thedarkpvp.net/p66/uywtfgh36"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59d771ec-3934-482f-9d0f-d88e950d210f",
        "value": "thedarkpvp.net"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 9979bd6521e1fbd4dcd2ff58da4c84ba",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59e389a9-a2a4-48d1-bc89-85eb02de0b81",
        "value": "716f616221f5e45a9e45edb013ab59fdf27c000e0e6dcb77267c37f09ad75589"
      },
      {
        "category": "Artifacts dropped",
        "comment": "- Xchecked via VT: 9979bd6521e1fbd4dcd2ff58da4c84ba",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59e389a9-b248-4a68-a78b-85eb02de0b81",
        "value": "dfd1633be76a92e1d8b3e43e91d8c1a959d2c8d5"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 9979bd6521e1fbd4dcd2ff58da4c84ba",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508084137",
        "to_ids": false,
        "type": "link",
        "uuid": "59e389a9-629c-414d-a5a3-85eb02de0b81",
        "value": "https://www.virustotal.com/file/716f616221f5e45a9e45edb013ab59fdf27c000e0e6dcb77267c37f09ad75589/analysis/1507945517/"
      }
    ]
  }
}