954 lines
No EOL
29 KiB
JSON
954 lines
No EOL
29 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2017-10-25",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Return of Not Petya as Bad Rabbit Diskcoder, yes those two are the same!",
|
|
"publish_timestamp": "1514467209",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1511385575",
|
|
"uuid": "59f04995-3b8c-4cf0-b555-4b26950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#2c4f00",
|
|
"local": false,
|
|
"name": "malware_classification:malware-category=\"Ransomware\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:ransomware=\"Bad Rabbit\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:preventive-measure=\"Backup and Restore Process\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:preventive-measure=\"Restrict Workstation Communication\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59f0499f-b1d4-4da8-898e-4056950d210f",
|
|
"value": "https://mjolnirsecurity.com/return-of-not-petya-as-bad-rabbit-diskcoder-yes-those-two-are-the-same/",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "59f05077-adb0-40d3-a7f1-406b950d210f",
|
|
"value": "After Wannacry and Petya/Not Petya/GoldenEye, its clear that Ukraine is a testing ground for everyone to try out their malware, program different variants and perfect before launching to target their final destination.\r\n\r\nToday, we have BadRabbit and DiskCoder. When we first read about them this morning, we thought they are two separate malwares. On deeper analysis, they are both the same.",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "59f0509f-97d4-477e-9349-4cd1950d210f",
|
|
"value": "185.149.120.3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508922539",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "59f054ab-fda4-41b0-98bb-457a950d210f",
|
|
"value": "dispci.exe"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "59f056b0-0130-4778-a935-4593950d210f",
|
|
"value": "1dnscontrol.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "59f056b0-ad74-4138-b75d-4100950d210f",
|
|
"value": "an-crimea.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "59f056b0-9f1c-4216-ad97-4547950d210f",
|
|
"value": "ankerch-crimea.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "59f056b0-dc48-4b00-964c-425e950d210f",
|
|
"value": "argumenti.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "59f056b0-c98c-4630-8693-4131950d210f",
|
|
"value": "argumentiru.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "59f056b0-ba70-439d-832f-49f9950d210f",
|
|
"value": "caforssztxqzf2nm.onion"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "59f056b0-0534-45e3-8533-4f37950d210f",
|
|
"value": "da.id"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b0-86a8-4522-b0b7-4f39950d210f",
|
|
"value": "i24.com.ua"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "59f056b0-1820-4e76-bf84-4b93950d210f",
|
|
"value": "most-dnepr.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b0-dc18-40b2-b1d1-4f5a950d210f",
|
|
"value": "osvitaportal.com.ua"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "59f056b0-bb20-4ef8-ac04-4d30950d210f",
|
|
"value": "spbvoditel.ru"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "59f056b0-e7a4-4620-8d32-4243950d210f",
|
|
"value": "xhr.open"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-b8c8-4c02-8cf2-4f33950d210f",
|
|
"value": "http://185.149.120.3/scholargoogle/"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-4198-4cc7-ba10-4044950d210f",
|
|
"value": "http://1dnscontrol.com/flash_install.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-0de0-4ffa-b43c-42dd950d210f",
|
|
"value": "http://an-crimea.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-50e0-4b30-bb61-444b950d210f",
|
|
"value": "http://ankerch-crimea.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-5458-4721-a46f-4f16950d210f",
|
|
"value": "http://argumenti.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-f094-46b2-b59c-4237950d210f",
|
|
"value": "http://argumentiru.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-1ba4-48c5-8c9e-4fe2950d210f",
|
|
"value": "http://bg.pensionhotel.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-4440-41f6-a67b-432d950d210f",
|
|
"value": "http://blog.fontanka.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-1600-4266-b5d4-4c48950d210f",
|
|
"value": "http://caforssztxqzf2nm.onion"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-c92c-49ef-b325-40d5950d210f",
|
|
"value": "http://calendar.fontanka.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-facc-4b47-af46-4472950d210f",
|
|
"value": "http://grupovo.bg"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-8c60-4747-94a1-4c6e950d210f",
|
|
"value": "http://i24.com.ua"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-cea8-4272-81e4-4a85950d210f",
|
|
"value": "http://most-dnepr.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-c418-4b72-9235-4e3e950d210f",
|
|
"value": "http://novayagazeta.spb.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-e228-43b5-8a7a-4492950d210f",
|
|
"value": "http://osvitaportal.com.ua"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-66d8-46f9-8775-48f4950d210f",
|
|
"value": "http://spbvoditel.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-7a40-4389-a3bc-4767950d210f",
|
|
"value": "http://www.aica.co.jp"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-b188-43f1-8a3f-42b3950d210f",
|
|
"value": "http://www.fontanka.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-0b30-4f0d-919a-41ad950d210f",
|
|
"value": "http://www.grupovo.bg"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-ce74-4b3c-83bf-4dc5950d210f",
|
|
"value": "http://www.imer.ro"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-3978-4bc4-9fe3-42eb950d210f",
|
|
"value": "http://www.mediaport.ua"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-cea4-4fd4-b3df-4759950d210f",
|
|
"value": "http://www.online812.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b0-a4cc-4f30-9fe0-4b3b950d210f",
|
|
"value": "http://www.otbrana.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b1-8760-49d0-b8be-41ad950d210f",
|
|
"value": "http://www.pensionhotel.cz"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925665",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b1-749c-4cd8-a045-426b950d210f",
|
|
"value": "http://www.sinematurk.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f056b1-1ea8-475c-8c5c-479c950d210f",
|
|
"value": "http://www.t.ks.ua"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-e470-463c-ac02-4e06950d210f",
|
|
"value": "bg.pensionhotel.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-07b0-479c-9468-4d27950d210f",
|
|
"value": "blog.fontanka.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-df04-4182-bb91-45be950d210f",
|
|
"value": "calendar.fontanka.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-4f9c-4f1e-8673-4e58950d210f",
|
|
"value": "novayagazeta.spb.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-70c0-4fd3-abd4-4154950d210f",
|
|
"value": "www.aica.co.jp"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-5370-4e58-9476-415f950d210f",
|
|
"value": "www.fontanka.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-a280-4719-97c4-4d98950d210f",
|
|
"value": "www.grupovo.bg"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-8304-4c87-8bf6-4823950d210f",
|
|
"value": "www.imer.ro"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-1030-43b1-9ce4-42a5950d210f",
|
|
"value": "www.mediaport.ua"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-97e4-461a-a4da-4e97950d210f",
|
|
"value": "www.online812.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-3640-4eea-add8-4308950d210f",
|
|
"value": "www.otbrana.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-3c20-4cfd-8def-4845950d210f",
|
|
"value": "www.pensionhotel.cz"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-865c-440e-a567-4377950d210f",
|
|
"value": "www.sinematurk.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "59f056b1-c288-4de0-9948-44f2950d210f",
|
|
"value": "www.t.ks.ua"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f056b1-a968-4587-9891-44fc950d210f",
|
|
"value": "16605a4a29a101208457c47ebfde788487be788d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f056b1-9920-4d2d-aaa2-4481950d210f",
|
|
"value": "413eba3973a15c1a6429d9f170f3e8287f98c21c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f056b1-1a4c-429b-ac8b-4787950d210f",
|
|
"value": "4f61e154230a64902ae035434690bf2b96b4e018"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f056b1-3f08-4989-9daa-43cb950d210f",
|
|
"value": "79116fe99f2b421c52ef64097f0f39b815b20907"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f056b1-ef38-427f-aa41-4f05950d210f",
|
|
"value": "afeee8b4acff87bc469a6f0364a81ae5d60a2add"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f056b1-2c08-428c-94c5-4c41950d210f",
|
|
"value": "de5c8d858e6e41da715dca1c019df0bfb92d32c0"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: de5c8d858e6e41da715dca1c019df0bfb92d32c0",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "59f060e2-cfec-4adb-8022-45e602de0b81",
|
|
"value": "630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: de5c8d858e6e41da715dca1c019df0bfb92d32c0",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "59f060e2-0ac0-4413-8fff-4c1202de0b81",
|
|
"value": "fbbdc39af1139aebba4da004475e8839"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: de5c8d858e6e41da715dca1c019df0bfb92d32c0",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59f060e2-0138-472b-a46a-49a102de0b81",
|
|
"value": "https://www.virustotal.com/file/630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da/analysis/1508925094/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: afeee8b4acff87bc469a6f0364a81ae5d60a2add",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "59f060e2-83b8-4fda-b325-415502de0b81",
|
|
"value": "b14d8faf7f0cbcfad051cefe5f39645f"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: afeee8b4acff87bc469a6f0364a81ae5d60a2add",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59f060e2-4e28-44be-8e85-4da202de0b81",
|
|
"value": "https://www.virustotal.com/file/8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93/analysis/1508925088/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 79116fe99f2b421c52ef64097f0f39b815b20907",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "59f060e2-1368-44be-932f-465602de0b81",
|
|
"value": "579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 79116fe99f2b421c52ef64097f0f39b815b20907",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "59f060e2-dc68-4bf7-951d-422d02de0b81",
|
|
"value": "1d724f95c61f1055f0d02c2154bbccd3"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: 79116fe99f2b421c52ef64097f0f39b815b20907",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59f060e2-52b0-4714-824f-453202de0b81",
|
|
"value": "https://www.virustotal.com/file/579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648/analysis/1508923756/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "59f060e2-50b0-4fff-b4e7-4dbd02de0b81",
|
|
"value": "301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "59f060e2-5918-4e11-84aa-436a02de0b81",
|
|
"value": "347ac3b6b791054de3e5720a7144a977"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59f060e2-2324-47b7-8233-4c2b02de0b81",
|
|
"value": "https://www.virustotal.com/file/301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c/analysis/1508918790/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "59f060e2-fadc-4b4a-9639-48e602de0b81",
|
|
"value": "2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "59f060e2-5f18-4ceb-b975-499702de0b81",
|
|
"value": "37945c44a897aa42a66adcab68f560e0"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508925666",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59f060e2-f748-4b93-a714-4b7002de0b81",
|
|
"value": "https://www.virustotal.com/file/2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035/analysis/1508925098/"
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "3",
|
|
"timestamp": "1508922700",
|
|
"uuid": "59f0554c-76c4-42bb-9dbc-4fe9950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "filename",
|
|
"timestamp": "1508922700",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "59f0554c-c8c0-46ad-a129-4243950d210f",
|
|
"value": "dispci.exe"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1508922700",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "59f0554c-e344-4c46-96d0-435c950d210f",
|
|
"value": "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |