adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/54aea268-ffc4-47e8-b09a-9c33950d210b.json

462 lines
No EOL
16 KiB
JSON
Raw Permalink Blame History

{
"Event": {
"analysis": "2",
"date": "2015-01-08",
"extends_uuid": "",
"info": "OSINT - The Connections Between MiniDuke, CosmicDuke and OnionDuke",
"publish_timestamp": "1421338911",
"published": true,
"threat_level_id": "2",
"timestamp": "1457396925",
"uuid": "54aea268-ffc4-47e8-b09a-9c33950d210b",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#004646",
"local": false,
"name": "type:OSINT",
"relationship_type": ""
},
{
"colour": "#33FF00",
"local": false,
"name": "tlp:green",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731088",
"to_ids": true,
"type": "filename|sha1",
"uuid": "54aea2d0-6040-41b3-ba1c-4dc8950d210b",
"value": "\u00e2\u20ac\u0153EU sanctions against Russia over Ukraine crisis\u00e2\u20ac\u0153.docm|82448eb23ea9eb3939b6f24df46789bf7f2d43e3"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731088",
"to_ids": true,
"type": "filename|sha1",
"uuid": "54aea2d0-93f8-4876-a48b-4279950d210b",
"value": "\u00e2\u20ac\u0153A Scottish \u00e2\u20ac\u02dcYes\u00e2\u20ac\u2122 to independence\u00e2\u20ac\u0153 .docm|c86b13378ba2a41684e1f93b4c20e05fc5d3d5a3"
},
{
"category": "Payload installation",
"comment": "32-bit dropper",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731135",
"to_ids": true,
"type": "sha1",
"uuid": "54aea2ff-204c-42e2-97f4-ba76950d210b",
"value": "241075fc1493172c47d881bcbfbf21cfa4daa42d"
},
{
"category": "Payload installation",
"comment": "64-bit dropper",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731169",
"to_ids": true,
"type": "sha1",
"uuid": "54aea321-b058-4dc6-8192-4284950d210b",
"value": "51ac683df63ff71a0003ca17e640bbeaaa14d0aa"
},
{
"category": "Payload installation",
"comment": "CosmicDuke-MiniDuke combo",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731215",
"to_ids": true,
"type": "sha1",
"uuid": "54aea34f-f028-4b6c-8269-4afb950d210b",
"value": "7ad1bef0ba61dbed98d76d4207676d08c893fc13"
},
{
"category": "Payload installation",
"comment": "OnionDuke limited backdoor",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731245",
"to_ids": true,
"type": "sha1",
"uuid": "54aea36d-a54c-4e1a-9564-4450950d210b",
"value": "b491c14d8cfb48636f6095b7b16555e9a575d57f"
},
{
"category": "Payload installation",
"comment": "OnionDuke full backdoor",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731283",
"to_ids": true,
"type": "sha1",
"uuid": "54aea393-e95c-4571-a5a4-9c33950d210b",
"value": "d433f281cf56015941a1c2cb87066ca62ea1db37"
},
{
"category": "Payload delivery",
"comment": "Expansion",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731354",
"to_ids": true,
"type": "email-src",
"uuid": "54aea3da-68dc-42be-93df-d60e950d210b",
"value": "uibo.lembit@mail.ee"
},
{
"category": "Payload delivery",
"comment": "Expansion",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731387",
"to_ids": true,
"type": "email-dst",
"uuid": "54aea3fb-fd1c-40a0-a65e-44c2950d210b",
"value": "uibo.lembit@mail.ee"
},
{
"category": "Payload delivery",
"comment": "Expansion",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731427",
"to_ids": true,
"type": "email-subject",
"uuid": "54aea423-dd08-485e-ba92-4156950d210b",
"value": "EU sanctions against Russia over Ukraine crisis (Estonia's opinion)"
},
{
"category": "Payload delivery",
"comment": "Expansion",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731471",
"to_ids": true,
"type": "email-attachment",
"uuid": "54aea44f-1f04-4abd-9576-9c33950d210b",
"value": "=?UTF-8?Q?[rep]estonia.doc?="
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731503",
"to_ids": false,
"type": "text",
"uuid": "54aea46f-776c-4176-b698-ba76950d210b",
"value": "MiniDuke"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731503",
"to_ids": false,
"type": "text",
"uuid": "54aea46f-fb0c-41f3-8f12-ba76950d210b",
"value": "OnionDuke"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731503",
"to_ids": false,
"type": "text",
"uuid": "54aea46f-3da8-4b16-ba39-ba76950d210b",
"value": "CosmicDuke"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1420731555",
"to_ids": true,
"type": "email-attachment",
"uuid": "54aea4a3-4680-4942-9f1a-4d6c950d210b",
"value": "World News Digest.docx"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1421223452",
"to_ids": false,
"type": "text",
"uuid": "54b6261c-ac2c-402c-87af-d563950d210b",
"value": "Onion Duke"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1421223452",
"to_ids": false,
"type": "text",
"uuid": "54b6261c-bee8-4cbe-8ae2-d563950d210b",
"value": "Cosmic Duke"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1421223452",
"to_ids": false,
"type": "text",
"uuid": "54b6261c-c028-4c69-a879-d563950d210b",
"value": "Mini Duke"
},
{
"category": "Payload installation",
"comment": "32-bit dropper - Xchecked via VT: 241075fc1493172c47d881bcbfbf21cfa4daa42d",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396925",
"to_ids": true,
"type": "sha256",
"uuid": "56de1cbd-0be0-4f54-b7c6-4f2e02de0b81",
"value": "2b15581baf7d69cd3c65a86f20eff813b4cbb9bae7a0362f97e76e21364dabca"
},
{
"category": "Payload installation",
"comment": "32-bit dropper - Xchecked via VT: 241075fc1493172c47d881bcbfbf21cfa4daa42d",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396925",
"to_ids": true,
"type": "md5",
"uuid": "56de1cbd-7bb8-424b-9eec-492902de0b81",
"value": "01400499ecc7fa6a50cc860179273a7f"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396926",
"to_ids": false,
"type": "link",
"uuid": "56de1cbe-6240-4b66-91c6-443502de0b81",
"value": "https://www.virustotal.com/file/2b15581baf7d69cd3c65a86f20eff813b4cbb9bae7a0362f97e76e21364dabca/analysis/1445916566/"
},
{
"category": "Payload installation",
"comment": "64-bit dropper - Xchecked via VT: 51ac683df63ff71a0003ca17e640bbeaaa14d0aa",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396926",
"to_ids": true,
"type": "sha256",
"uuid": "56de1cbe-0240-44bb-9c0c-408202de0b81",
"value": "71cad7cc4e23d1e03c5d03cd9b48e32126b6bf7374841735ad642b62e2745a2c"
},
{
"category": "Payload installation",
"comment": "64-bit dropper - Xchecked via VT: 51ac683df63ff71a0003ca17e640bbeaaa14d0aa",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396926",
"to_ids": true,
"type": "md5",
"uuid": "56de1cbe-0374-4437-ab8d-467302de0b81",
"value": "eb48ff76cc7dd24b519c93a0aa250d27"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396926",
"to_ids": false,
"type": "link",
"uuid": "56de1cbe-33ac-4535-b0d6-475602de0b81",
"value": "https://www.virustotal.com/file/71cad7cc4e23d1e03c5d03cd9b48e32126b6bf7374841735ad642b62e2745a2c/analysis/1445916567/"
},
{
"category": "Payload installation",
"comment": "CosmicDuke-MiniDuke combo - Xchecked via VT: 7ad1bef0ba61dbed98d76d4207676d08c893fc13",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396927",
"to_ids": true,
"type": "sha256",
"uuid": "56de1cbf-f5cc-41bc-80f9-4b0902de0b81",
"value": "29585bb17b28e8b15b2a250be9516f416fa7cac84cc24aa4e004f6987323147e"
},
{
"category": "Payload installation",
"comment": "CosmicDuke-MiniDuke combo - Xchecked via VT: 7ad1bef0ba61dbed98d76d4207676d08c893fc13",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396927",
"to_ids": true,
"type": "md5",
"uuid": "56de1cbf-8058-40b1-9b4c-469c02de0b81",
"value": "925b37a936304a5914941ac4584e346c"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396927",
"to_ids": false,
"type": "link",
"uuid": "56de1cbf-6e7c-43df-b933-4c7902de0b81",
"value": "https://www.virustotal.com/file/29585bb17b28e8b15b2a250be9516f416fa7cac84cc24aa4e004f6987323147e/analysis/1452769402/"
},
{
"category": "Payload installation",
"comment": "OnionDuke limited backdoor - Xchecked via VT: b491c14d8cfb48636f6095b7b16555e9a575d57f",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396928",
"to_ids": true,
"type": "sha256",
"uuid": "56de1cc0-b0a4-4846-84a1-452802de0b81",
"value": "366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b"
},
{
"category": "Payload installation",
"comment": "OnionDuke limited backdoor - Xchecked via VT: b491c14d8cfb48636f6095b7b16555e9a575d57f",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396928",
"to_ids": true,
"type": "md5",
"uuid": "56de1cc0-c030-4e51-adef-475302de0b81",
"value": "c8eb6040fd02d77660d19057a38ff769"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396928",
"to_ids": false,
"type": "link",
"uuid": "56de1cc0-1810-4b1d-ac3e-4d0f02de0b81",
"value": "https://www.virustotal.com/file/366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b/analysis/1456819261/"
},
{
"category": "Payload installation",
"comment": "OnionDuke full backdoor - Xchecked via VT: d433f281cf56015941a1c2cb87066ca62ea1db37",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396928",
"to_ids": true,
"type": "sha256",
"uuid": "56de1cc0-16b8-4f7e-9436-458e02de0b81",
"value": "0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade"
},
{
"category": "Payload installation",
"comment": "OnionDuke full backdoor - Xchecked via VT: d433f281cf56015941a1c2cb87066ca62ea1db37",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396929",
"to_ids": true,
"type": "md5",
"uuid": "56de1cc1-9628-4ff0-9fd0-4fcf02de0b81",
"value": "d1ce79089578da2d41f1ad901f7b1014"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396929",
"to_ids": false,
"type": "link",
"uuid": "56de1cc1-841c-4ad8-9191-482302de0b81",
"value": "https://www.virustotal.com/file/0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade/analysis/1456923691/"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: 82448eb23ea9eb3939b6f24df46789bf7f2d43e3",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396929",
"to_ids": true,
"type": "sha256",
"uuid": "56de1cc1-1540-456c-96d7-448f02de0b81",
"value": "abcaf6044d4d591a50ac3328ed8c8ab3ec91929d2f0d7e3bea1ed0cfc92e811d"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: 82448eb23ea9eb3939b6f24df46789bf7f2d43e3",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396930",
"to_ids": true,
"type": "md5",
"uuid": "56de1cc2-68a8-4157-8101-475b02de0b81",
"value": "f27ffc3d3ff7a2ddc6728d9495427ee5"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396930",
"to_ids": false,
"type": "link",
"uuid": "56de1cc2-f9c0-42d4-8042-48e102de0b81",
"value": "https://www.virustotal.com/file/abcaf6044d4d591a50ac3328ed8c8ab3ec91929d2f0d7e3bea1ed0cfc92e811d/analysis/1444969477/"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: c86b13378ba2a41684e1f93b4c20e05fc5d3d5a3",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396930",
"to_ids": true,
"type": "sha256",
"uuid": "56de1cc2-9bbc-44f3-beb1-4ddc02de0b81",
"value": "1a981bd49b9869a1c81e767ba7418254138272b005dab5c83f3798906ca86570"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: c86b13378ba2a41684e1f93b4c20e05fc5d3d5a3",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396930",
"to_ids": true,
"type": "md5",
"uuid": "56de1cc2-9d48-4e9d-8e59-49bc02de0b81",
"value": "ed463d501c23db34e27bd32902971081"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1457396931",
"to_ids": false,
"type": "link",
"uuid": "56de1cc3-85c0-4fb8-acac-448b02de0b81",
"value": "https://www.virustotal.com/file/1a981bd49b9869a1c81e767ba7418254138272b005dab5c83f3798906ca86570/analysis/1425845303/"
}
]
}
}
Reference in a new issue View git blame Copy permalink