2756 lines
No EOL
92 KiB
JSON
2756 lines
No EOL
92 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2019-01-16",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - LoJax Command and Control Domains Still Active",
|
|
"publish_timestamp": "1547935425",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1547935413",
|
|
"uuid": "5c4073ea-ed74-44e6-8965-d558950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:tool=\"LoJax\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#305600",
|
|
"local": false,
|
|
"name": "malware_classification:malware-category=\"Rootkit\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0071c3",
|
|
"local": false,
|
|
"name": "osint:lifetime=\"perpetual\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0087e8",
|
|
"local": false,
|
|
"name": "osint:certainty=\"50\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1547732670",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c4086be-64b8-4bd7-9bde-4133950d210f",
|
|
"value": "185.86.148.184"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1547732686",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c4086ce-51f8-4166-8b3d-43ac950d210f",
|
|
"value": "93.113.131.103"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1547796884",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5c418157-ea48-4d37-ac79-4481950d210f",
|
|
"value": "https://www.bleepingcomputer.com/news/security/lojax-command-and-control-domains-still-active/",
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1547796885",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c418171-9b1c-4e7a-91e3-4601950d210f",
|
|
"value": "Security researchers have uncovered new details about the infrastructure used by LoJax UEFI rootkit used in attacks from APT28. The analysis revealed two command and control (C2) servers were still active in early 2019.\r\n\r\nLoJax rootkit is based on LoJack, a legitimate software that tracks and locates laptop, smartphone, or tablet devices. Its campaigns likely started towards the end of 2016, according to new research.\r\n\r\nBecause it has persistence on the system, LoJack was modified by the threat actors - APT28, also known as Fancy Bear, Sednit, Strontium, and Sofacy, to report to their server.",
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1547797268",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5c418304-bb5c-496b-af6e-4746950d210f",
|
|
"value": "https://asert.arbornetworks.com/lojax-fancy-since-2016/",
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547736296",
|
|
"uuid": "5c4094e8-764c-4fa5-909a-4263950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547736296",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c4094e8-27ac-4f72-98ea-48f1950d210f",
|
|
"value": "185.181.102.201"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547736298",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c4094ea-d908-4410-9aa5-40e1950d210f",
|
|
"value": "moldstream.md"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547736611",
|
|
"uuid": "5c409623-7d0c-40d6-bbfa-783a950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547736612",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409624-6e8c-4df5-942b-783a950d210f",
|
|
"value": "185.94.191.65"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547736613",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409625-9e44-4b18-bd73-783a950d210f",
|
|
"value": "webstp.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547736681",
|
|
"uuid": "5c409669-d874-4dde-b084-4413950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547736681",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409669-1570-48b8-a875-4307950d210f",
|
|
"value": "162.208.10.66"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547736683",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c40966b-5470-49b2-b13c-4b00950d210f",
|
|
"value": "oiagives.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547736720",
|
|
"uuid": "5c409690-eb24-4ed7-9432-4f30950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547736721",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409691-1f88-4e45-86d3-464e950d210f",
|
|
"value": "86.106.131.54"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547736722",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409692-1bb8-448b-bfd3-4772950d210f",
|
|
"value": "elaxo.org"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547736756",
|
|
"uuid": "5c4096b4-d72c-4d97-bd48-4340950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547736756",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c4096b4-fc74-4b2a-aeb8-4ce0950d210f",
|
|
"value": "185.183.107.40"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547736757",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c4096b5-f23c-4ec1-bfd0-458b950d210f",
|
|
"value": "peacefund.eu"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547736811",
|
|
"uuid": "5c4096eb-f478-4fc6-af0a-4d14950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547736811",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c4096eb-a3ec-4f05-a5b2-4e60950d210f",
|
|
"value": "185.86.151.104"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547736811",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c4096eb-42f4-43a8-94fb-4ab5950d210f",
|
|
"value": "jflynci.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547736830",
|
|
"uuid": "5c4096fe-83e8-44d5-a92f-448e950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547736830",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c4096fe-0c4c-440e-8025-4193950d210f",
|
|
"value": "185.86.149.116"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547736831",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c4096ff-7594-4465-8b28-4347950d210f",
|
|
"value": "hp-apps.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547737967",
|
|
"uuid": "5c409b6f-80cc-4575-8014-40c6950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547737968",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409b70-20f0-4f7f-97b7-47d3950d210f",
|
|
"value": "46.21.147.76"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547737969",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409b71-dff8-4882-b8b5-498b950d210f",
|
|
"value": "vsnet.co"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547737994",
|
|
"uuid": "5c409b8a-5a68-4627-aea2-4057950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547737995",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409b8b-4c48-4fb2-9a69-4cef950d210f",
|
|
"value": "85.204.124.77"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547737997",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409b8d-58e0-427f-9c21-488a950d210f",
|
|
"value": "remotepx.net"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547738018",
|
|
"uuid": "5c409ba2-faec-4cd9-a7a7-4b9d950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547738018",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409ba2-0ff4-47e3-b3ef-4ac1950d210f",
|
|
"value": "54.37.104.106"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547738018",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409ba2-c760-4096-bfb9-4cb6950d210f",
|
|
"value": "sysanalyticweb.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547738040",
|
|
"uuid": "5c409bb8-5928-456d-878a-4808950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547738041",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409bb9-69c0-445d-a40c-43e2950d210f",
|
|
"value": "185.86.151.2"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547738041",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409bb9-8318-403a-88be-4b73950d210f",
|
|
"value": "unigymboom.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547738060",
|
|
"uuid": "5c409bcc-c698-4676-aa91-4a50950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547738060",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409bcc-f1fc-4442-8e82-46d6950d210f",
|
|
"value": "94.177.12.150"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547738061",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409bcd-3db8-49a3-868e-4c11950d210f",
|
|
"value": "treckanalytics.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547738080",
|
|
"uuid": "5c409be0-0444-46ce-9a2f-4421950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547738080",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409be0-7998-42c6-9cb6-4b05950d210f",
|
|
"value": "179.43.158.20"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547738081",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409be1-a9a4-4cc2-9a5b-41d4950d210f",
|
|
"value": "msfontserver.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547738102",
|
|
"uuid": "5c409bf6-d2ac-4b78-ba89-4a9f950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547738102",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409bf6-dd9c-45e4-a22f-4253950d210f",
|
|
"value": "162.208.10.66"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547738103",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409bf7-9bb8-422a-9814-49d6950d210f",
|
|
"value": "oiatribe.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547738119",
|
|
"uuid": "5c409c07-4290-4f04-bca2-465c950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547738119",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409c07-f5a8-431d-875b-4113950d210f",
|
|
"value": "169.239.128.133"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547738120",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409c08-542c-431f-bcf5-46ee950d210f",
|
|
"value": "ntpstatistics.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547738136",
|
|
"uuid": "5c409c18-82fc-4c1a-8ced-4a39950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547738136",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409c18-67f0-4a42-a418-4c2a950d210f",
|
|
"value": "46.21.147.71"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547738137",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409c19-17b0-458a-8b8c-4ad2950d210f",
|
|
"value": "regvirt.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547738151",
|
|
"uuid": "5c409c27-eb6c-434d-9470-4008950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547738151",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c409c27-0b18-42bb-adee-4bad950d210f",
|
|
"value": "169.239.129.121"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547738151",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c409c27-4658-4053-a939-4f05950d210f",
|
|
"value": "visualrates.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547796979",
|
|
"uuid": "5c4181f3-26ac-4683-959c-4963950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547796979",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c4181f3-1458-4eea-bc91-483a950d210f",
|
|
"value": "185.86.151.2"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547796980",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c4181f4-1694-44ef-ab4e-4249950d210f",
|
|
"value": "unigymboom.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547797002",
|
|
"uuid": "5c41820a-50ec-4e25-861c-4fca950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547797002",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c41820a-1040-4075-874c-438d950d210f",
|
|
"value": "169.239.128.133"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547797003",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c41820b-d354-4e60-b9fe-436e950d210f",
|
|
"value": "ntpstatistics.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Last Seen: Fall 2018",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547797076",
|
|
"uuid": "5c418254-1fac-4e5f-893a-41f3950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547797076",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c418254-ec4c-4608-99a2-4af4950d210f",
|
|
"value": "185.181.102.201"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547797078",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c418256-f698-4f27-aadc-4e4e950d210f",
|
|
"value": "moldstream.md"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Last Seen: Fall 2018",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547797101",
|
|
"uuid": "5c41826d-9dc4-4ca9-b59d-40bb950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547797101",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c41826d-396c-4dce-8b27-46b7950d210f",
|
|
"value": "46.21.147.76"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547797102",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c41826e-6d48-4825-bd87-4797950d210f",
|
|
"value": "vsnet.co"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Last Seen: Fall 2018",
|
|
"deleted": false,
|
|
"description": "A domain and IP address seen as a tuple in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "domain-ip",
|
|
"template_uuid": "43b3b146-77eb-4931-b4cc-b66c60f28734",
|
|
"template_version": "6",
|
|
"timestamp": "1547797134",
|
|
"uuid": "5c41828e-a950-4db9-b0f6-4ea6950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1547797134",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5c41828e-6e60-43da-829f-40c4950d210f",
|
|
"value": "169.239.129.121"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1547797135",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c41828f-9038-476a-816d-44b1950d210f",
|
|
"value": "visualrates.com"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547802397",
|
|
"uuid": "5c41971d-0cb4-4c90-9796-492e950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547802398",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41971e-5038-49ef-9cd0-47a1950d210f",
|
|
"value": "89503b7935a05b1d26cb26ce3793a3fb"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547802399",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41971f-81e8-4de4-85cd-4d80950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547802422",
|
|
"uuid": "5c419736-a020-4a84-a00b-26fd950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547802422",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c419736-974c-4498-aff8-26fd950d210f",
|
|
"value": "cffcae5c5551b4b9489fec5d56269d84"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547802423",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c419737-e720-4c86-9d8d-26fd950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547803034",
|
|
"uuid": "5c41999a-f5ac-4de9-9edf-464c950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547803034",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41999a-12c4-4ba5-99fe-4783950d210f",
|
|
"value": "9be30e2c2e185ccb6cdbbf585d368393"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547803035",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41999b-2c08-4c89-a62f-4cc0950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547803353",
|
|
"uuid": "5c419ad9-24f8-4b94-920e-2700950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547803354",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c419ada-6580-42ff-a9de-2700950d210f",
|
|
"value": "bda5f83ee4a6d64d1057f19a2a1ef071"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547803354",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c419ada-cd64-4618-969e-2700950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547803438",
|
|
"uuid": "5c419b2e-9cdc-4f87-8923-02cb950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547803438",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c419b2e-c508-499e-a339-02cb950d210f",
|
|
"value": "f3c6e16f0dd2b0e55a7dad365c3877d4"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547803439",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c419b2f-25c8-4f42-a1b7-02cb950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547805261",
|
|
"uuid": "5c41a24d-e8e8-486f-93db-4bfe950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547805261",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41a24d-4bf4-4e33-bcd3-40a7950d210f",
|
|
"value": "89503b7935a05b1d26cb26ce3793a3fb"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547805263",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41a24f-3c60-4589-b5bb-442e950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547805317",
|
|
"uuid": "5c41a285-adfc-4031-99e5-6eb9950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547805317",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41a285-3df4-4dae-b603-6eb9950d210f",
|
|
"value": "6eaa1ff5f33df3169c209f98cc5012d0"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547805319",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41a287-9ae8-4c42-8e9b-6eb9950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547805381",
|
|
"uuid": "5c41a2c5-f610-48d8-b15c-27c6950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547805381",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41a2c5-138c-49a6-99b2-27c6950d210f",
|
|
"value": "cffcae5c5551b4b9489fec5d56269d84"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547805382",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41a2c6-8490-4655-a5d1-27c6950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547805537",
|
|
"uuid": "5c41a361-5930-4a1d-a159-27c6950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547805537",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41a361-a8d0-4d4b-a6f6-27c6950d210f",
|
|
"value": "f1df1a795eb784f7bfc3ba9a7e3b00ac"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547805538",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41a362-f5d4-4fae-96b9-27c6950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547805829",
|
|
"uuid": "5c41a486-5a90-4519-9fe5-75ce950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547805830",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41a486-b804-41ed-abe5-75ce950d210f",
|
|
"value": "e5db592704f30d42537b1257e79ff223"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547805830",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41a486-8070-45f9-a0a4-75ce950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547805851",
|
|
"uuid": "5c41a49b-1494-45d9-9d6d-27c6950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547805851",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41a49b-eab8-4efb-99b0-27c6950d210f",
|
|
"value": "f336379bd4a129f0851a24ccea47b4ec"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547805852",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41a49c-583c-42df-9e18-27c6950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547805882",
|
|
"uuid": "5c41a4ba-6a98-4960-924e-27c6950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547805882",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41a4ba-b95c-4579-8619-27c6950d210f",
|
|
"value": "9be30e2c2e185ccb6cdbbf585d368393"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547805883",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41a4bb-0bd8-47a7-92b0-27c6950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547805902",
|
|
"uuid": "5c41a4ce-5638-4983-9617-2700950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547805902",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41a4ce-9cd4-4540-b742-2700950d210f",
|
|
"value": "bda5f83ee4a6d64d1057f19a2a1ef071"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547805903",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41a4cf-cf58-4c61-bdd6-2700950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547805920",
|
|
"uuid": "5c41a4e0-f510-48a0-aacc-448e950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547805920",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41a4e0-3a0c-40fb-a7d8-4f81950d210f",
|
|
"value": "f3c6e16f0dd2b0e55a7dad365c3877d4"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547805920",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41a4e0-8890-49e6-9b72-43ad950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547805941",
|
|
"uuid": "5c41a4f5-4c84-41ce-b59a-756f950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547805941",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41a4f5-1950-4707-85e3-756f950d210f",
|
|
"value": "73ea983ec9c39fb820d086acdf439c95"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547805942",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41a4f6-1a8c-4cff-b090-756f950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1547806021",
|
|
"uuid": "5c41a545-6a00-406f-8ba8-26ef950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547806021",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c41a545-d954-46f8-805a-26ef950d210f",
|
|
"value": "9157f70faaedf66688fc11f4abca83e2"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1547806022",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5c41a546-5c88-442f-a1b6-26ef950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1547893349",
|
|
"uuid": "0183a1ab-460b-4b88-a77f-e844353725b1",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "0183a1ab-460b-4b88-a77f-e844353725b1",
|
|
"referenced_uuid": "e52fff61-4c9f-4e5b-bef9-f697a478674b",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1547893382",
|
|
"uuid": "5c42fa86-798c-4573-b168-45f502de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547893350",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "fa3069bc-3e17-4397-8fb1-0c026dac5d08",
|
|
"value": "e5db592704f30d42537b1257e79ff223"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1547893350",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "71c4124e-3bce-4dc6-9208-179c30be786d",
|
|
"value": "8e138eecea8e9937a83bffe100d842d6381b6bb1"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1547893351",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "744af389-1787-4714-a5f2-c80fefcadb47",
|
|
"value": "eb4e174db15646f71cb1d2c471e5794a8429ca29369c8eff6042122cc6dc6845"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1547893351",
|
|
"uuid": "e52fff61-4c9f-4e5b-bef9-f697a478674b",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1547893351",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "a6704321-e290-4989-a308-9e605e3e0a4c",
|
|
"value": "2019-01-18T08:36:32"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1547893352",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "250629a1-e3ff-40b7-aae8-80414a97eae7",
|
|
"value": "https://www.virustotal.com/file/eb4e174db15646f71cb1d2c471e5794a8429ca29369c8eff6042122cc6dc6845/analysis/1547800592/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1547893352",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "6adf8b2b-48f5-4b2a-8b1f-61e509c7c596",
|
|
"value": "52/70"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1547893352",
|
|
"uuid": "f838d196-f90e-42fd-8f07-0caa8ed78366",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "f838d196-f90e-42fd-8f07-0caa8ed78366",
|
|
"referenced_uuid": "8f8eddca-664b-4af0-b628-2baa269d7911",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1547893383",
|
|
"uuid": "5c42fa87-9944-42b9-82bb-49f002de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547893352",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "280afe90-70af-48f4-ae2c-2d5b5d87b39a",
|
|
"value": "f1df1a795eb784f7bfc3ba9a7e3b00ac"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1547893353",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "955d63c3-1ce3-40a1-a7a1-09f8cd1d8059",
|
|
"value": "1470995de2278ae79646d524e7c311dad29aee17"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1547893353",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "40c7aae2-2f42-4069-8b8c-dd03dd47412d",
|
|
"value": "e029ed8cfe34185c94b15c74f52d6fdf9bf9b635853c466b2589c1d9f3639200"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1547893354",
|
|
"uuid": "8f8eddca-664b-4af0-b628-2baa269d7911",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1547893354",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "9504e767-143b-4297-8514-a1debd3bbff9",
|
|
"value": "2019-01-18T08:36:31"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1547893354",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "32b1d16b-45e3-4c5c-8ee1-658e9bd6965e",
|
|
"value": "https://www.virustotal.com/file/e029ed8cfe34185c94b15c74f52d6fdf9bf9b635853c466b2589c1d9f3639200/analysis/1547800591/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1547893355",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "592422d2-0cdf-49a7-90bd-135408d67248",
|
|
"value": "47/69"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1547893355",
|
|
"uuid": "221467e7-185f-41ed-b996-bcf9a001244b",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "221467e7-185f-41ed-b996-bcf9a001244b",
|
|
"referenced_uuid": "5f175674-cade-4221-9b5d-563c30550687",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1547893383",
|
|
"uuid": "5c42fa87-7aec-4fb4-9c2c-44d002de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547893355",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "80dbd698-1eb1-480d-b7cc-63a2a8b9047c",
|
|
"value": "f336379bd4a129f0851a24ccea47b4ec"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1547893355",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "b1af2ee9-c72b-4f9c-ba00-7d349c75c9a6",
|
|
"value": "e923ac79046ffa06f67d3f4c567e84a82dd7ff1b"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1547893356",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "3be33cc5-fd56-4ab3-83b5-474822ce1291",
|
|
"value": "a97b1a792f7b53929a1c01bad9fc2bd606a15e8e32755daa15570e356baa0112"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1547893356",
|
|
"uuid": "5f175674-cade-4221-9b5d-563c30550687",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1547893356",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "c6f87315-ab4f-48f0-86ef-9b61391d4273",
|
|
"value": "2019-01-18T08:36:32"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1547893357",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "ca93a1c9-c4b9-44eb-bd71-4bc63a45b236",
|
|
"value": "https://www.virustotal.com/file/a97b1a792f7b53929a1c01bad9fc2bd606a15e8e32755daa15570e356baa0112/analysis/1547800592/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1547893358",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "1d18c466-d3b0-42b8-8de2-ce33a96b6537",
|
|
"value": "52/70"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1547893358",
|
|
"uuid": "888dea54-bd23-4759-8388-d3b260a9fcc9",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "888dea54-bd23-4759-8388-d3b260a9fcc9",
|
|
"referenced_uuid": "eff9a551-2cf3-4a87-a1a5-1eefe8443ed8",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1547893383",
|
|
"uuid": "5c42fa87-09bc-410d-a751-47c302de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547893358",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "29e4146f-d3bf-4258-89be-0119f0bcd045",
|
|
"value": "f3c6e16f0dd2b0e55a7dad365c3877d4"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1547893358",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "224329e7-58e9-4142-a5fc-a988e32a7404",
|
|
"value": "397d97e278110a48bd2cb11bb5632b99a9100dbd"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1547893359",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "a1e85f1d-c826-481c-b5bf-e7ec81ba2051",
|
|
"value": "fa8de430fb491d898ee4e557977f036f2aae5f019c3b0552c9e0223da748fc27"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1547893359",
|
|
"uuid": "eff9a551-2cf3-4a87-a1a5-1eefe8443ed8",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1547893360",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "9d437d48-b476-4942-a6e4-9459946936dc",
|
|
"value": "2019-01-18T08:36:28"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1547893360",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "f203ee74-3433-4e80-859d-718a11b5d4bd",
|
|
"value": "https://www.virustotal.com/file/fa8de430fb491d898ee4e557977f036f2aae5f019c3b0552c9e0223da748fc27/analysis/1547800588/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1547893361",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "00fa7630-9f60-47da-94c6-3d1a367df48d",
|
|
"value": "47/71"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1547893361",
|
|
"uuid": "46c70090-aefb-45f3-ae55-1cb02dcf0c80",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "46c70090-aefb-45f3-ae55-1cb02dcf0c80",
|
|
"referenced_uuid": "224f53ae-d99c-4db9-866d-091b185ce68f",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1547893383",
|
|
"uuid": "5c42fa87-98b0-4b92-a3f1-442102de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547893361",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "634b5b20-4665-4343-b0d4-f549caa8e1cf",
|
|
"value": "9be30e2c2e185ccb6cdbbf585d368393"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1547893361",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "83959972-9dc3-4de2-8993-307eb0640860",
|
|
"value": "0860356913ac9e88dbaa8a76a69d9986b8265f81"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1547893362",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "4ecd62d5-30c4-4ae7-ae2b-aab4afa29666",
|
|
"value": "06976912957d4c0c7f5d3a478fc8f3dc2ef1057537bc1548554d6569add2ba3d"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1547893364",
|
|
"uuid": "224f53ae-d99c-4db9-866d-091b185ce68f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1547893364",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "1ffd3174-875e-4f29-857b-46948e494ede",
|
|
"value": "2019-01-18T03:08:09"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1547893364",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "21a4038c-8022-409b-9cfd-13bd2cdb8331",
|
|
"value": "https://www.virustotal.com/file/06976912957d4c0c7f5d3a478fc8f3dc2ef1057537bc1548554d6569add2ba3d/analysis/1547780889/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1547893365",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "f9f0d052-430c-485c-962d-b4fb8cd592ba",
|
|
"value": "46/70"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1547893365",
|
|
"uuid": "422bdf76-7fbd-480d-8a3d-b33a00a3a9a8",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "422bdf76-7fbd-480d-8a3d-b33a00a3a9a8",
|
|
"referenced_uuid": "1d4b1ead-461d-45b0-97b6-9f2db3b56e5b",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1547893383",
|
|
"uuid": "5c42fa87-ad88-4c67-9704-4c8d02de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547893365",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "4090c55a-88b9-41dd-9edf-73f6e2cda6cc",
|
|
"value": "bda5f83ee4a6d64d1057f19a2a1ef071"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1547893365",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "d404970c-a88b-4e78-bf90-b0ec97e81cae",
|
|
"value": "f90ccf57e75923812c2c1da9f56166b36d1482be"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1547893366",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "22469824-1d62-4044-a43e-d88c78d1889f",
|
|
"value": "539cdc37c34eebb28a74f0dceeee0331e6ac6f4682e55fddd69d6f9de7ab9b77"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1547893366",
|
|
"uuid": "1d4b1ead-461d-45b0-97b6-9f2db3b56e5b",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1547893366",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "22b4afe9-fcbc-4514-be9d-d03e6240559f",
|
|
"value": "2019-01-18T08:36:27"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1547893367",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "ee16baeb-2063-4ae6-929b-435aa3cc5dcc",
|
|
"value": "https://www.virustotal.com/file/539cdc37c34eebb28a74f0dceeee0331e6ac6f4682e55fddd69d6f9de7ab9b77/analysis/1547800587/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1547893367",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "16209b4b-4483-49f4-a827-787e7152f0b5",
|
|
"value": "52/70"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1547893367",
|
|
"uuid": "7670c107-8e0d-401c-97ef-0a252fe1ee01",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "7670c107-8e0d-401c-97ef-0a252fe1ee01",
|
|
"referenced_uuid": "b5189a36-b545-4b84-85bd-7fa1fcb7b2f6",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1547893383",
|
|
"uuid": "5c42fa87-1034-4551-897a-481902de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547893367",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "bb9eeca6-b0ca-407f-941b-4a13a7157be6",
|
|
"value": "cffcae5c5551b4b9489fec5d56269d84"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1547893368",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "8c053ca2-b8e2-4a47-8a00-8bcb7ff1ed61",
|
|
"value": "d578667c9222e7f7835694193576b6554a0bca89"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1547893368",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "9acdf316-a4dc-4d92-9ef1-b893fe0c08ff",
|
|
"value": "aa5b25c969234e5c9a8e3aa7aefb9444f2cc95247b5b52ef83bf4a68032980ae"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1547893369",
|
|
"uuid": "b5189a36-b545-4b84-85bd-7fa1fcb7b2f6",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1547893369",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "7791139b-3270-4b18-9d5a-55c7a141e9ea",
|
|
"value": "2019-01-18T03:08:10"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1547893369",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "e1199483-4503-4ab5-88e0-1b068dfcb4b9",
|
|
"value": "https://www.virustotal.com/file/aa5b25c969234e5c9a8e3aa7aefb9444f2cc95247b5b52ef83bf4a68032980ae/analysis/1547780890/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1547893370",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "8b1777c9-9cec-4425-850f-a064c4cc6b93",
|
|
"value": "49/69"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1547893370",
|
|
"uuid": "f16b2940-fed0-4041-8c0e-b9f10c4852f5",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "f16b2940-fed0-4041-8c0e-b9f10c4852f5",
|
|
"referenced_uuid": "5b89a33f-92b9-463c-a8ee-a47928a0138a",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1547893383",
|
|
"uuid": "5c42fa87-915c-4dc6-a90e-48e802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547893370",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "6d65ce1a-4245-433b-98a7-ca31c665a3ae",
|
|
"value": "6eaa1ff5f33df3169c209f98cc5012d0"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1547893370",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "a42c479e-fc73-4e83-9227-038a76d47b2b",
|
|
"value": "10d571d66d3ab7b9ddf6a850cb9b8e38b07623c0"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1547893371",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "35b04a6d-14b9-4b01-9ecd-fd0665db129a",
|
|
"value": "27dd9de09e22efa2ef12e9e2f462fa9da83684bdb4ec900dd86439c5758107d9"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1547893371",
|
|
"uuid": "5b89a33f-92b9-463c-a8ee-a47928a0138a",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1547893372",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "e8cf1f25-1f71-440f-b3f7-9ebb31ef9e8e",
|
|
"value": "2019-01-18T08:36:30"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1547893372",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "4faa67b5-4107-4e81-84cd-1c2c85331549",
|
|
"value": "https://www.virustotal.com/file/27dd9de09e22efa2ef12e9e2f462fa9da83684bdb4ec900dd86439c5758107d9/analysis/1547800590/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1547893373",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "2f5c8b59-15d5-4cfa-85e2-ae5a1f0697ff",
|
|
"value": "51/70"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1547893373",
|
|
"uuid": "47f69294-e7fc-43f7-ab84-03cd4378f8ee",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "47f69294-e7fc-43f7-ab84-03cd4378f8ee",
|
|
"referenced_uuid": "c7b36f6d-7074-4856-bed8-1d54355e070f",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1547893384",
|
|
"uuid": "5c42fa88-fbf8-4b57-8f1d-442302de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547893373",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "9cf9713f-5c5d-4189-9718-beee09708bc8",
|
|
"value": "73ea983ec9c39fb820d086acdf439c95"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1547893373",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "c56a61af-f9da-451c-b44e-546498768bc4",
|
|
"value": "09d2e2c26247a4a908952fee36b56b360561984f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1547893373",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "e004eb49-267a-4cf7-872b-14eb6e3617f1",
|
|
"value": "37f15647c26d475db805048d6592aa153533ac5f4373145c75e24012a51ad9f8"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1547893374",
|
|
"uuid": "c7b36f6d-7074-4856-bed8-1d54355e070f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1547893374",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "95b5ee4d-049d-4caf-b44b-d789e0ebe197",
|
|
"value": "2019-01-18T08:36:35"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1547893374",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "d9824b54-e08e-4702-a90f-5219b5b9c584",
|
|
"value": "https://www.virustotal.com/file/37f15647c26d475db805048d6592aa153533ac5f4373145c75e24012a51ad9f8/analysis/1547800595/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1547893375",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "cdea349b-8070-4ba1-b7e5-0df2b88add75",
|
|
"value": "51/72"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1547893375",
|
|
"uuid": "0ef6b9ac-e1f1-4137-b43c-e23b80bdc36a",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "0ef6b9ac-e1f1-4137-b43c-e23b80bdc36a",
|
|
"referenced_uuid": "fdac57c6-b04e-49a1-a105-aa8b1554ecbe",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1547893384",
|
|
"uuid": "5c42fa88-c304-43ba-9f63-4b3802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547893375",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "3d8fc68c-eae9-442b-9938-a2171cc68cad",
|
|
"value": "9157f70faaedf66688fc11f4abca83e2"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1547893376",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "c51d04ff-038d-4c9a-bd8e-f33da7ff6d98",
|
|
"value": "b818e7a8cb699cd0fa4afcac50b9b7d82c13fa0a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1547893376",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "b7de3833-6678-41a6-b1ff-d743fcbbd697",
|
|
"value": "a6d83fb30af84c18edf829ae4cc29c8c1bfb5eaaf61f9579d2d79c27bd37db59"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1547893377",
|
|
"uuid": "fdac57c6-b04e-49a1-a105-aa8b1554ecbe",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1547893377",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "6e3fc311-0b1a-4804-9797-fbcfcb17f369",
|
|
"value": "2019-01-18T03:08:10"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1547893377",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "ad3fd8d1-f35e-45a7-a286-f0ef2f785902",
|
|
"value": "https://www.virustotal.com/file/a6d83fb30af84c18edf829ae4cc29c8c1bfb5eaaf61f9579d2d79c27bd37db59/analysis/1547780890/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1547893379",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "8d2cc288-1115-44cc-92ce-f4703eed8a9a",
|
|
"value": "45/69"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1547893379",
|
|
"uuid": "3fae5084-db01-4e77-b90f-380ffcc7e226",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "3fae5084-db01-4e77-b90f-380ffcc7e226",
|
|
"referenced_uuid": "f37f274c-d13a-4f4c-a4ad-a17c70eaf778",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1547893384",
|
|
"uuid": "5c42fa88-91e4-4950-b0e2-44f402de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1547893379",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "fa2b1e36-3f12-4f9d-8b83-0a1637870782",
|
|
"value": "89503b7935a05b1d26cb26ce3793a3fb"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1547893379",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "4ce399b9-fd34-4d88-b124-91f187a52de2",
|
|
"value": "5bc901e9267fa7bb7b14943f5f0299a84a7ef519"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1547893380",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "46d2e789-239c-4cfe-8b78-d43adba5880a",
|
|
"value": "6d626c7f661b8cc477569e8e89bfe578770fca332beefea1ee49c20def97226e"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1547893381",
|
|
"uuid": "f37f274c-d13a-4f4c-a4ad-a17c70eaf778",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1547893381",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "f7f35623-cc54-4d52-818a-bf9b5761f2c2",
|
|
"value": "2019-01-18T03:08:11"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1547893381",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "b6c4c28d-1f46-43b2-a18c-f2ce8f84223c",
|
|
"value": "https://www.virustotal.com/file/6d626c7f661b8cc477569e8e89bfe578770fca332beefea1ee49c20def97226e/analysis/1547780891/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1547893382",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "9cc4fe98-6468-439c-9c43-5729ce13e7da",
|
|
"value": "52/72"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |