{
  "Event": {
    "analysis": "2",
    "date": "2023-09-11",
    "extends_uuid": "",
    "info": "Spyware Telegram mod distributed via Google Play - Evil Telegram doppelganger attacks Chinese users",
    "publish_timestamp": "1694415526",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1694415518",
    "uuid": "e3b6b6a1-fe4a-4475-948b-fe763b7254a4",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deliver Malicious App via Authorized App Store - T1475\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"China\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Manipulation - T1565\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1694414890",
        "to_ids": true,
        "type": "md5",
        "uuid": "83aadc2b-44f4-4738-8f78-098e41255d4a",
        "value": "39df26099caf5d5edf264801a486e4ee"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1694414890",
        "to_ids": true,
        "type": "md5",
        "uuid": "12bcd121-7b31-4adf-9562-c745a9aba991",
        "value": "b9e9a29229a10deecc104654cb7c71ae"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1694414890",
        "to_ids": true,
        "type": "md5",
        "uuid": "a5dac10b-60b8-450d-8242-848b4c3b4eb5",
        "value": "e0dab7efb9cea5b6a010c8c5fee1a285"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1694414890",
        "to_ids": true,
        "type": "md5",
        "uuid": "b3da79d0-621c-42cc-8c6a-058e9937714f",
        "value": "efcbcd6a2166745153c329fd2d486b3a"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1694414890",
        "to_ids": true,
        "type": "md5",
        "uuid": "75bbf299-9426-410a-bdba-d62e0b4b83bb",
        "value": "8e878695aab7ab16e38265c3a5f17970"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1694414890",
        "to_ids": true,
        "type": "md5",
        "uuid": "c4e4d6d6-bea5-4bf2-b778-a3b8378dac28",
        "value": "65377fa1d86351c7bd353b51f68f6b80"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1694414890",
        "to_ids": true,
        "type": "md5",
        "uuid": "e26db0bf-8249-4eea-a5d2-a849cfd4bf9b",
        "value": "19f927386a03ce8d2866879513f37ea0"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1694414890",
        "to_ids": true,
        "type": "md5",
        "uuid": "10adc0e7-32f1-4fad-b078-41aaca610978",
        "value": "a0e197b9c359b89e48c3f0c01af21713"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1694414890",
        "to_ids": true,
        "type": "md5",
        "uuid": "d8a7cf9f-2216-4ea5-851e-496eac78deab",
        "value": "c7a8c3c78ac973785f700c537fbfcb00"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1694414919",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5b3ee997-0541-4199-98ce-e05e64730321",
        "value": "sg.telegrnm.org"
      }
    ],
    "Object": [
      {
        "comment": "sg.telegrnm.org: Enriched via the farsight_passivedns module",
        "deleted": false,
        "description": "Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-07. See https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-dns-cof-07.html",
        "first_seen": "2023-02-12T15:26:41+00:00",
        "last_seen": "2023-09-10T14:33:58+00:00",
        "meta-category": "network",
        "name": "passive-dns",
        "template_uuid": "b77b7b1c-66ab-4a41-8da4-83810f6d2d6c",
        "template_version": "5",
        "timestamp": "1694414969",
        "uuid": "1b6a0b6f-1365-44ef-ba5c-9f8af907febe",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "1b6a0b6f-1365-44ef-ba5c-9f8af907febe",
            "referenced_uuid": "5b3ee997-0541-4199-98ce-e05e64730321",
            "relationship_type": "related-to",
            "timestamp": "1694414969",
            "uuid": "1892f452-f450-4d1b-be73-bf6c71393e1d"
          }
        ],
        "Attribute": [
          {
            "category": "Other",
            "comment": "Result from a rrset lookup on DNSDB about the hostname: sg.telegrnm.org",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "rdata",
            "timestamp": "1694414969",
            "to_ids": false,
            "type": "text",
            "uuid": "bff0d874-84e6-432a-be38-8caa68d8250d",
            "value": "103.148.186.32"
          },
          {
            "category": "Other",
            "comment": "Result from a rrset lookup on DNSDB about the hostname: sg.telegrnm.org",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "count",
            "timestamp": "1694414969",
            "to_ids": false,
            "type": "counter",
            "uuid": "6f25b86b-91d2-4ad7-be11-ecad7993bb50",
            "value": "258"
          },
          {
            "category": "Other",
            "comment": "Result from a rrset lookup on DNSDB about the hostname: sg.telegrnm.org",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "time_first",
            "timestamp": "1694414969",
            "to_ids": false,
            "type": "datetime",
            "uuid": "0c4e545a-1695-4bea-9aed-001f6a7255f1",
            "value": "2023-02-12T15:26:41+00:00"
          },
          {
            "category": "Other",
            "comment": "Result from a rrset lookup on DNSDB about the hostname: sg.telegrnm.org",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "time_last",
            "timestamp": "1694414969",
            "to_ids": false,
            "type": "datetime",
            "uuid": "b79c91e3-4825-4e5b-bdde-060687684499",
            "value": "2023-09-10T14:33:58+00:00"
          },
          {
            "category": "Other",
            "comment": "Result from a rrset lookup on DNSDB about the hostname: sg.telegrnm.org",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "rrname",
            "timestamp": "1694414969",
            "to_ids": false,
            "type": "text",
            "uuid": "a28c90a5-20c1-4b5d-808d-5eead02d25c9",
            "value": "sg.telegrnm.org."
          },
          {
            "category": "Other",
            "comment": "Result from a rrset lookup on DNSDB about the hostname: sg.telegrnm.org",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "rrtype",
            "timestamp": "1694414969",
            "to_ids": false,
            "type": "text",
            "uuid": "e5828613-c8cb-458b-8e6b-49252371b86d",
            "value": "A"
          },
          {
            "category": "Network activity",
            "comment": "Result from a rrset lookup on DNSDB about the hostname: sg.telegrnm.org",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "bailiwick",
            "timestamp": "1694414969",
            "to_ids": true,
            "type": "domain",
            "uuid": "ff8f605a-8398-4743-9c1b-0d130dfb14fc",
            "value": "telegrnm.org"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "Metadata used to generate an executive level report",
        "meta-category": "misc",
        "name": "report",
        "template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
        "template_version": "7",
        "timestamp": "1694415447",
        "uuid": "b390191c-a16c-415c-ba31-78a2c2a698bf",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "link",
            "timestamp": "1694415447",
            "to_ids": false,
            "type": "link",
            "uuid": "3306d70b-3806-4926-ad3d-643238f9fec8",
            "value": "https://securelist.com/trojanized-telegram-mod-attacking-chinese-users/110482/"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "summary",
            "timestamp": "1694415447",
            "to_ids": false,
            "type": "text",
            "uuid": "97ecae7a-4806-490b-b674-e2b561a1793a",
            "value": "Evil Telegram doppelganger attacks Chinese users"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "type",
            "timestamp": "1694415447",
            "to_ids": false,
            "type": "text",
            "uuid": "19fbec9f-5913-486b-bfc5-a00fad5ae39c",
            "value": "Blog"
          }
        ]
      }
    ]
  }
}