2283 lines
No EOL
76 KiB
JSON
2283 lines
No EOL
76 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2018-10-04",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Indicators of Compromise for Malware used by APT28",
|
|
"publish_timestamp": "1538643817",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1538643710",
|
|
"uuid": "5bb5d045-acf8-42ac-97ce-45c5950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#12e000",
|
|
"local": false,
|
|
"name": "misp-galaxy:threat-actor=\"Sofacy\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0c9900",
|
|
"local": false,
|
|
"name": "misp-galaxy:tool=\"X-Tunnel\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0c9800",
|
|
"local": false,
|
|
"name": "misp-galaxy:tool=\"X-Agent\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5bb5d10c-0674-4b1c-bfc8-c4b3950d210f",
|
|
"value": "https://www.ncsc.gov.uk/alerts/indicators-compromise-malware-used-apt28"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d166-9890-499a-a671-c4b3950d210f",
|
|
"value": "139.5.177.205"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d167-d8ac-415a-9ca1-c4b3950d210f",
|
|
"value": "80.255.6.15"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d167-81c4-4f97-b256-c4b3950d210f",
|
|
"value": "89.34.111.107"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d169-71cc-4869-ae98-c4b3950d210f",
|
|
"value": "86.106.131.229"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d169-16d8-4961-aa8b-c4b3950d210f",
|
|
"value": "139.5.177.206"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d16a-a108-4237-b8a8-c4b3950d210f",
|
|
"value": "185.181.102.203"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d16a-f3cc-4ca9-80d9-c4b3950d210f",
|
|
"value": "185.181.102.204"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d16a-2780-4012-a411-c4b3950d210f",
|
|
"value": "169.239.129.31"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d16b-b5d0-47fe-824c-c4b3950d210f",
|
|
"value": "malaytravelgroup.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d16b-bf50-4cea-b981-c4b3950d210f",
|
|
"value": "worldimagebucket.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d16c-4910-4922-8e60-c4b3950d210f",
|
|
"value": "fundseats.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d16c-d10c-4be3-a955-c4b3950d210f",
|
|
"value": "globaltechengineers.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d16d-cf00-4e63-91b3-c4b3950d210f",
|
|
"value": "beststreammusic.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d16d-a53c-4321-9eea-c4b3950d210f",
|
|
"value": "thepiratecinemaclub.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d16e-b670-42a3-add0-c4b3950d210f",
|
|
"value": "coindmarket.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1ca-3df4-4822-bd62-c1ce950d210f",
|
|
"value": "213.252.247.112"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1cb-d934-4924-986f-c1ce950d210f",
|
|
"value": "185.86.148.15"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1cc-ee40-470d-b092-c1ce950d210f",
|
|
"value": "89.45.67.110"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1cc-c3f0-472c-b8d5-c1ce950d210f",
|
|
"value": "185.86.150.205"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1cc-0d70-47be-8c1f-c1ce950d210f",
|
|
"value": "193.37.255.10"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642381",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1cd-6ee0-4029-9050-c1ce950d210f",
|
|
"value": "195.12.50.171"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1cd-57f8-46ca-a83c-c1ce950d210f",
|
|
"value": "51.38.128.110"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1ce-df28-4687-b97a-c1ce950d210f",
|
|
"value": "185.144.83.124"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1ce-ffa0-4a69-a827-c1ce950d210f",
|
|
"value": "185.216.35.10"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1cf-6d5c-4f9a-90a7-c1ce950d210f",
|
|
"value": "185.94.192.122"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1cf-9f9c-4d21-bbba-c1ce950d210f",
|
|
"value": "185.216.35.7"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1d0-5b5c-4074-bf11-c1ce950d210f",
|
|
"value": "103.253.41.124"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1d2-2464-4f9b-95e5-c1ce950d210f",
|
|
"value": "185.189.112.195"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1d6-b204-48ce-a655-c1ce950d210f",
|
|
"value": "185.230.124.246"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1d7-333c-4291-9538-c1ce950d210f",
|
|
"value": "87.120.254.106"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642391",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1d7-0da4-4af0-a0e6-c1ce950d210f",
|
|
"value": "77.81.98.122"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1d8-73d0-4aaf-a912-c1ce950d210f",
|
|
"value": "89.34.111.132"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1d8-09c0-4dcc-b662-c1ce950d210f",
|
|
"value": "46.21.147.55"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1d9-6a78-4e6c-b5a1-c1ce950d210f",
|
|
"value": "103.208.86.57"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1d9-f01c-43c8-9798-c1ce950d210f",
|
|
"value": "185.128.24.104"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1da-c230-40cc-9174-c1ce950d210f",
|
|
"value": "145.239.67.8"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1da-2c88-46f0-9d33-c1ce950d210f",
|
|
"value": "185.210.219.250"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d1db-13ac-464b-93e9-c1ce950d210f",
|
|
"value": "86.105.9.174"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1db-2e8c-4af8-bcfe-c1ce950d210f",
|
|
"value": "creekcounty.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1db-a804-4da6-8a19-c1ce950d210f",
|
|
"value": "virtsvc.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1dc-b4cc-4d04-8b28-c1ce950d210f",
|
|
"value": "moderntips.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1dc-3a0c-44a2-95c1-c1ce950d210f",
|
|
"value": "daysheduler.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1dd-0614-4c6f-bf02-c1ce950d210f",
|
|
"value": "escochart.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1dd-8474-4dfc-938c-c1ce950d210f",
|
|
"value": "loungecinemaclub.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1de-7174-4cc8-9a17-c1ce950d210f",
|
|
"value": "genericnetworkaddress.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1de-54c0-43e9-8dc3-c1ce950d210f",
|
|
"value": "bulgariatripholidays.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1df-3b1c-44e7-90b8-c1ce950d210f",
|
|
"value": "georgia-travel.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1df-699c-40dc-b6d5-c1ce950d210f",
|
|
"value": "bbcweather.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1e0-9604-4c74-849c-c1ce950d210f",
|
|
"value": "politicweekend.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1e0-2504-4112-88f4-c1ce950d210f",
|
|
"value": "truefashionnews.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1e0-29d8-4e71-bec6-c1ce950d210f",
|
|
"value": "protonhardstorage.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1e1-111c-4871-99e8-c1ce950d210f",
|
|
"value": "moldtravelgroup.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1e4-b89c-4cf8-84d5-c1ce950d210f",
|
|
"value": "iboxmit.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1e6-e000-49f7-a4ee-c1ce950d210f",
|
|
"value": "brownvelocity.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1e7-e364-4e33-ba48-c1ce950d210f",
|
|
"value": "pointtk.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1e8-2464-4d1e-87bd-c1ce950d210f",
|
|
"value": "narrowpass.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1e8-a384-4de3-805c-c1ce950d210f",
|
|
"value": "powernoderesources.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bb5d1e9-567c-45b7-9103-c1ce950d210f",
|
|
"value": "topcinemaclub.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "snort",
|
|
"uuid": "5bb5d244-d7ac-487b-acb8-347d950d210f",
|
|
"value": "alert tcp $HOME_NET any -> $EXTERNAL_NET any (flow:established,from_client; msg: \"XAgent Beacon\"; content:\"HTTP/1.1|0d 0a|Accept|3a|text/html,application/xhtml+xml,application/xml|3b|q=0.9,*\";!\"Host|3a| yandex.ru\";; pcre: \"/^(?:GET|POST)\\ /(?:watch|search|find|results|open|search|close)\\/\\?(?:text=|from=|aq=|ai=|ags=|oe=|btnG=|oprnd=|utm=|channel=|itwm=)/\";)"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "snort",
|
|
"uuid": "5bb5d25b-fbc8-4a6b-9fb8-ef06950d210f",
|
|
"value": "alert tcp $HOME_NET any -> $EXTERNAL_NET any (flow:established,from_client; msg:: \"XAgent itwm beacon v1\"; content:\"/?itwm\"; fast_pattern; pcre: \"/itwm=[A-Za-z0-9\\-\\_]{29,35}/\";)"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "X-Agent",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642577",
|
|
"to_ids": true,
|
|
"type": "snort",
|
|
"uuid": "5bb5d27b-901c-4bdb-90f8-c448950d210f",
|
|
"value": "alert tcp $HOME_NET any -> $EXTERNAL_NET any (flow:established,from_client; msg:: \"XAgent itwm beacon v2\"; content:\"&itwm\"; fast_pattern; pcre: \"/&itwm=[A-Za-z0-9\\-\\_]{29,35}/\";)"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "X-Agent - chost.exe",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642681",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5bb5d2f9-3b6c-4b33-a7ef-c472950d210f",
|
|
"value": "46e2957e699fae6de1a212dd98ba4e2bb969497d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "X-Agent - msoutlook.dll",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642682",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5bb5d2fa-72e4-4f7e-b41d-c472950d210f",
|
|
"value": "c53930772beb2779d932655d6c3de5548810af3d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "X-Agent - Samp_(16).file",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642682",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5bb5d2fa-5c08-4396-b9cd-c472950d210f",
|
|
"value": "fa695e88c87843ca0ba9fc04b176899ff90e9ac5"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "X-Agent - outlook.dll",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642682",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5bb5d2fa-ea80-4f30-99fe-c472950d210f",
|
|
"value": "046a8adc2ef0f68107e96babc59f41b6f0a57803"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642729",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d329-86c4-44ba-bf2a-c1ce950d210f",
|
|
"value": "185.86.151.2"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642729",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d329-b624-414f-b52d-c1ce950d210f",
|
|
"value": "46.21.147.76"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642732",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d32c-6704-4d4f-99e8-c1ce950d210f",
|
|
"value": "46.21.147.71"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642733",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d32d-6c70-44bf-87af-c1ce950d210f",
|
|
"value": "162.208.10.66"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642733",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d32d-ef70-4882-ac34-c1ce950d210f",
|
|
"value": "185.86.151.104"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642734",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d32e-2f2c-473d-809a-c1ce950d210f",
|
|
"value": "185.86.149.116"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642736",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d330-9880-45a6-af27-c1ce950d210f",
|
|
"value": "86.106.131.54"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642737",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d331-46c0-4bcc-9db4-c1ce950d210f",
|
|
"value": "185.181.102.201"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642737",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d331-7ce0-4875-aea8-c1ce950d210f",
|
|
"value": "179.43.158.20"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642737",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d331-e3e0-4d37-a87b-c1ce950d210f",
|
|
"value": "85.204.124.77"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642738",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d332-55a0-47ca-97c0-c1ce950d210f",
|
|
"value": "185.86.148.184"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642738",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d332-4c88-48ba-b4da-c1ce950d210f",
|
|
"value": "185.183.107.40"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642739",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d333-90b8-42a7-b2dd-c1ce950d210f",
|
|
"value": "185.94.191.65"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642739",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d333-2b4c-447e-a336-c1ce950d210f",
|
|
"value": "94.177.12.150"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642740",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d334-b85c-4214-a3f9-c1ce950d210f",
|
|
"value": "54.37.104.106"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642740",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d334-0ffc-4ccd-8dca-c1ce950d210f",
|
|
"value": "93.113.131.103"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642741",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d335-40c0-45df-9473-c1ce950d210f",
|
|
"value": "169.239.129.121"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "IP addresses have been used as Command and Control (C2) servers for APT28 LoJack communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642741",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d335-6358-408b-bbd9-c1ce950d210f",
|
|
"value": "169.239.128.133"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "The Snort rule provided may detect false positives due to CompuTrace/Lojack being legitimate software. The NCSC highly recommend 4 of 8network administrators assess their environment for the presence of CompuTrace/Lojack and adjust the signatures accordingly to exclude the legitimate use of CompuTrace.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642808",
|
|
"to_ids": true,
|
|
"type": "snort",
|
|
"uuid": "5bb5d378-41b4-4b13-a739-c1cf950d210f",
|
|
"value": "alert tcp any any <> any any (flow: established; msg: \"APT28 -CompuTrace_Beacon_UserAgent\"; content: \"|0d0a|TagId|3a| \";fast_pattern; content: \"POST / \"; content:!\"namequery.com\";content:!\"Host: 209.53.113.\"; content:!\"dnssearch.org\";content:!\"Cookie:\"; content:!\"fnbcorporate.co.za\";content:!\"207.6.98.\"; pcre: \"/Mozilla\\/[0-9]{1,2}.[0-9]{1,2}\\(compatible\\; MSIE [0-9]{1,2}.[0-9]{1,2}\\;\\)\\x0d\\x0a/\";)"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "SHA-1 hash of a CompuTrace file used by APT28 - filename dcbfd12321fa7c4fa9a72486ced578fdc00dcee79e6d95aa481791f044a55dll",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642854",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5bb5d3a6-3140-4a82-88ee-ef05950d210f",
|
|
"value": "d70db6a6d660aae58ccfc688a2890391fd873bfb"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "XTUNNEL - picturecrawling.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642939",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d3c9-dfa4-4e25-a4f1-c1bd950d210f",
|
|
"value": "23.163.0.59"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "XTUNNEL",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642895",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d3cf-c108-4b0b-bcce-c1bd950d210f",
|
|
"value": "86.105.1.123"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "XTUNNEL",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642897",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d3d1-de18-4c22-b9fa-c1bd950d210f",
|
|
"value": "185.86.149.218"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "XTUNNEL",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642900",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d3d4-8ef4-4288-8c7a-c1bd950d210f",
|
|
"value": "185.145.128.80"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "XTUNNEL",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642907",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d3db-3010-4743-9545-c1bd950d210f",
|
|
"value": "89.37.226.106"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "XTUNNEL",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538642909",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d3dd-0bd4-4c9c-8b2e-c1bd950d210f",
|
|
"value": "94.177.12.238"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "gpu.dll - XTUNNEL",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643004",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5bb5d43c-dbac-4b0b-8b1d-c1bd950d210f",
|
|
"value": "8dbe37dfb0d498f96fb7f1e09e9e5c8f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "lncstnt.exe - XTUNNEL",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643007",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5bb5d43f-ea80-4cac-a371-c1bd950d210f",
|
|
"value": "5086989639aed17227b8d6b041ef3163"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "following IP addresses have been used for ZEBROCY victim communications",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643067",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d47b-2248-4fe5-9cde-c472950d210f",
|
|
"value": "176.223.111.243"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "following IP addresses have been used for ZEBROCY victim communications",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643070",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d47e-d378-4536-8004-c472950d210f",
|
|
"value": "172.104.21.26"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "following IP addresses have been used for ZEBROCY victim communications",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643072",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d480-a5a8-471d-986f-c472950d210f",
|
|
"value": "188.241.68.118"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "following IP addresses have been used for ZEBROCY victim communications",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643076",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d484-8ae8-47e3-b684-c472950d210f",
|
|
"value": "89.45.67.153"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "following IP addresses have been used for ZEBROCY victim communications",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643078",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d486-c108-438c-81ac-c472950d210f",
|
|
"value": "185.25.50.93"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "following IP addresses have been used for ZEBROCY victim communications",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643087",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5bb5d48f-2934-46d2-a216-c472950d210f",
|
|
"value": "45.124.132.127"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "ZEBROCY victim communication",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643141",
|
|
"to_ids": true,
|
|
"type": "snort",
|
|
"uuid": "5bb5d4c5-272c-4e74-9c60-fa9a950d210f",
|
|
"value": "alert tcp $HOME_NET any -> $EXTERNAL_NET any (flow:established,from_client; msg: \"APT28 - Web/request -FILE- content-type\"; content: \"-FILE-\"; pcre: \"/[A-Z0-9\\-]{16}-FILE-[^\\r\\n]+.tmp/\""
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "ZEBROCY file",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643200",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5bb5d500-7ee4-45c6-bd0c-c4b1950d210f",
|
|
"value": "913ac13ff245baeff843a99dc2cbc1ff5f8c025c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "ZEBROCY file",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643203",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5bb5d503-ac48-47ee-af45-c4b1950d210f",
|
|
"value": "b758c7775d9bcdc0473fc2e738b32f05b464b175"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "UpnP Error Handler",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1538643224",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5bb5d518-6338-482f-a79c-c448950d210f",
|
|
"value": "3e7dfe9a8d5955a825cb51cb6eec0cd07c569b41"
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1538643327",
|
|
"uuid": "caa8d31d-eb67-43f6-8999-5509553133ec",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "caa8d31d-eb67-43f6-8999-5509553133ec",
|
|
"referenced_uuid": "674e1271-97d4-41e3-91d0-54c6bbf08991",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1538643538",
|
|
"uuid": "5bb5d652-ae80-4553-bdf4-c4b802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1538643327",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "3cabf356-4627-4673-a269-fd961063199c",
|
|
"value": "5086989639aed17227b8d6b041ef3163"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1538643329",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "ec89cda2-4451-4525-b494-3094fb30cf23",
|
|
"value": "5fa9f62b9616849e1f23ae3582f7d72eff030768"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1538643332",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "81e6bf11-b703-4474-aac5-6092cac14e37",
|
|
"value": "c5f8236e578a2b877fe538b2ef6f4aeceeb1b9cb73bba4d02fd368a5eb85cfab"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1538643335",
|
|
"uuid": "674e1271-97d4-41e3-91d0-54c6bbf08991",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1538643337",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "6223a185-c824-4867-a415-02ecf1749930",
|
|
"value": "2018-09-21T16:46:48"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1538643340",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "b8dfbb91-e70f-4d1d-b69f-068f90e5409e",
|
|
"value": "https://www.virustotal.com/file/c5f8236e578a2b877fe538b2ef6f4aeceeb1b9cb73bba4d02fd368a5eb85cfab/analysis/1537548408/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1538643343",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "f4b84a8a-267d-4055-83ed-6bb5df945245",
|
|
"value": "39/64"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1538643347",
|
|
"uuid": "485ae42f-750e-4236-a90f-160868391c0b",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "485ae42f-750e-4236-a90f-160868391c0b",
|
|
"referenced_uuid": "8bd069b9-50a6-405a-ac7a-2b37c349c988",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1538643538",
|
|
"uuid": "5bb5d652-2cdc-48c8-b0ce-c4b802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1538643347",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "df97bd36-5cac-456c-b72f-85d5f8a8056a",
|
|
"value": "8dbe37dfb0d498f96fb7f1e09e9e5c8f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1538643350",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "9d5458f0-6556-493b-9e09-8d62f0548592",
|
|
"value": "4c1f39ae7ac7cafc3554790b0d3cdc0136dc43d2"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1538643353",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "f7e1a668-f69b-4a34-8bd7-5a3f4230865e",
|
|
"value": "fc224a6cca956a59812a13e53ba08a279996ea2ee194fe20fb10170ca5c2db6a"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1538643356",
|
|
"uuid": "8bd069b9-50a6-405a-ac7a-2b37c349c988",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1538643359",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "e05a496d-23ad-431f-9c3c-c7ad8b72c262",
|
|
"value": "2018-09-24T12:43:53"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1538643363",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "3681b6d3-8233-42cb-b947-5ec748df0093",
|
|
"value": "https://www.virustotal.com/file/fc224a6cca956a59812a13e53ba08a279996ea2ee194fe20fb10170ca5c2db6a/analysis/1537793033/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1538643366",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "4a94b98c-18f3-43d2-87d2-5c0c83bd195b",
|
|
"value": "43/66"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1538643369",
|
|
"uuid": "5ae8b212-92e6-41bb-a081-ce4048cd35cd",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "5ae8b212-92e6-41bb-a081-ce4048cd35cd",
|
|
"referenced_uuid": "bb0904bb-62d2-4005-bff9-eec2f9714288",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1538643538",
|
|
"uuid": "5bb5d652-4d2c-483c-9e54-c4b802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1538643368",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "35d65802-3cb6-42b4-ab43-a2f292496b30",
|
|
"value": "10036063be45f92a9a743425fbf5abc7"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1538643372",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "93ec6c66-21be-4b58-8a4a-b4252a9c136c",
|
|
"value": "d70db6a6d660aae58ccfc688a2890391fd873bfb"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1538643375",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "7b42a47b-b0eb-4634-ad87-93e240e147be",
|
|
"value": "3f48dbbf86f29e01809550f4272a894ff4b09bd48b0637bd6745db84d2cec2b6"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1538643378",
|
|
"uuid": "bb0904bb-62d2-4005-bff9-eec2f9714288",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1538643381",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "1d1dcb0e-2b06-4bc5-a54f-71b6903a983a",
|
|
"value": "2018-10-04T03:26:52"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1538643383",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "b98a15e8-cce7-4837-ac91-ad987e0c4628",
|
|
"value": "https://www.virustotal.com/file/3f48dbbf86f29e01809550f4272a894ff4b09bd48b0637bd6745db84d2cec2b6/analysis/1538623612/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1538643386",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "cef987d3-50f2-441d-9432-25bd46fe2aa9",
|
|
"value": "41/67"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1538643389",
|
|
"uuid": "0bd5f889-77cf-401b-a393-461130ea63de",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "0bd5f889-77cf-401b-a393-461130ea63de",
|
|
"referenced_uuid": "88f4c7c3-4777-4590-8e27-931fe204135c",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1538643538",
|
|
"uuid": "5bb5d652-93b8-4d64-a85b-c4b802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1538643386",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "eea02b54-de23-4f1a-b85e-334bbd1e8112",
|
|
"value": "d29899195c604f0615885bc6c2fdf7a8"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1538643389",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "c3834319-4534-4a8e-913a-c58ab52a9ce2",
|
|
"value": "fa695e88c87843ca0ba9fc04b176899ff90e9ac5"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1538643391",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "3bd3bcb4-497e-4fb2-b87a-1567e3c3a16b",
|
|
"value": "86a588672837afdc1900ad9e78c7d0ae7a842bdd972dbdc5bdff2574a37f5acc"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1538643394",
|
|
"uuid": "88f4c7c3-4777-4590-8e27-931fe204135c",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1538643398",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "49596d84-c139-4047-b2ef-cce2037c1751",
|
|
"value": "2018-07-27T00:32:44"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1538643400",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "af68e965-cc52-439f-a26b-e179ad304d05",
|
|
"value": "https://www.virustotal.com/file/86a588672837afdc1900ad9e78c7d0ae7a842bdd972dbdc5bdff2574a37f5acc/analysis/1532651564/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1538643403",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "0441ed29-7eb2-4777-a467-ca297b1c6789",
|
|
"value": "35/61"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1538643406",
|
|
"uuid": "d4c3355f-a6ff-4aad-b733-effa1fa3f446",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "d4c3355f-a6ff-4aad-b733-effa1fa3f446",
|
|
"referenced_uuid": "64589ade-c0e3-46cb-8dc9-bd2b8e03958d",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1538643538",
|
|
"uuid": "5bb5d652-fcc0-4892-804b-c4b802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1538643406",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "86de6075-1470-4d48-9977-0ee570dc4df0",
|
|
"value": "fc0cb1dbab4bc6504e644f311d9bb4a1"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1538643409",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "3d5c7948-fe58-42dc-bdba-50ce2cd26f12",
|
|
"value": "c53930772beb2779d932655d6c3de5548810af3d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1538643411",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "147687a4-79fc-4c4d-b463-311dd953ae21",
|
|
"value": "a1c73ce193ffa5323aaef73fbabbc2a984e10900f09cf9fcb0cb11606a23c402"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1538643414",
|
|
"uuid": "64589ade-c0e3-46cb-8dc9-bd2b8e03958d",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1538643415",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "c1ff0d67-f8df-497f-95b6-2ffd6bf7176e",
|
|
"value": "2018-07-03T09:59:52"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1538643418",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "02324d5a-0a2a-4a8f-b65e-cf774956dddd",
|
|
"value": "https://www.virustotal.com/file/a1c73ce193ffa5323aaef73fbabbc2a984e10900f09cf9fcb0cb11606a23c402/analysis/1530611992/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1538643421",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5e788972-1d3d-4b9a-95f7-3fb76db9715d",
|
|
"value": "41/65"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1538643424",
|
|
"uuid": "8a110b38-0dad-4295-b40f-fb60fb395e8f",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "8a110b38-0dad-4295-b40f-fb60fb395e8f",
|
|
"referenced_uuid": "5afd32c5-ee31-48c3-ba20-0a1f10b339e6",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1538643538",
|
|
"uuid": "5bb5d652-2ebc-4cdd-a123-c4b802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1538643421",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "28d5ed41-afb0-4ef8-a776-753cb12cea3a",
|
|
"value": "b50640a28a1d4f2acdce93adf2ea326c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1538643424",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "4d2b4952-8f89-42f0-9682-b92c7818fe8d",
|
|
"value": "b758c7775d9bcdc0473fc2e738b32f05b464b175"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1538643428",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "4337bb40-11b1-4325-a98c-e312f6d8d60f",
|
|
"value": "2b19497db8cb05cd3d22996efe5af8eac0f2ea51e80f606b7b8a79dfaa2f58e2"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1538643430",
|
|
"uuid": "5afd32c5-ee31-48c3-ba20-0a1f10b339e6",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1538643433",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "37ca8cc3-2a4e-4acc-8f95-3411382dc8b0",
|
|
"value": "2018-09-11T00:23:21"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1538643436",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "81ac484b-e234-4312-bb47-ded2265b8b8e",
|
|
"value": "https://www.virustotal.com/file/2b19497db8cb05cd3d22996efe5af8eac0f2ea51e80f606b7b8a79dfaa2f58e2/analysis/1536625401/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1538643439",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "f29b012f-ca21-41b2-9b40-6697832b2a12",
|
|
"value": "44/68"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1538643445",
|
|
"uuid": "b063122d-ef2d-47dc-b3d1-7efb48e23569",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "b063122d-ef2d-47dc-b3d1-7efb48e23569",
|
|
"referenced_uuid": "1181b169-e791-49d6-af39-3729a8a9859b",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1538643538",
|
|
"uuid": "5bb5d652-9060-4f1a-a189-c4b802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1538643442",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "bac5d92f-7f50-44e1-8ffd-75a3bd36d9c7",
|
|
"value": "4fa6cd01571905b9c7c8fc9a359b655e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1538643446",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "fd0a975d-1206-4d3d-b39c-37dcf9271e10",
|
|
"value": "46e2957e699fae6de1a212dd98ba4e2bb969497d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1538643449",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5a5a22ac-5b04-4f7b-84bc-da297466f85c",
|
|
"value": "b814fdbb7cfe6e5192fe1126835b903354d75bfb15a6c262ccc2caf13a8ce4b6"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1538643452",
|
|
"uuid": "1181b169-e791-49d6-af39-3729a8a9859b",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1538643456",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "cdaedd02-5290-470f-b143-be59989f1464",
|
|
"value": "2018-09-04T10:08:34"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1538643459",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "34363d3f-d54e-41ed-9dfe-4ba2b8b9214b",
|
|
"value": "https://www.virustotal.com/file/b814fdbb7cfe6e5192fe1126835b903354d75bfb15a6c262ccc2caf13a8ce4b6/analysis/1536055714/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1538643462",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "212837d3-8b9c-4da8-b2ba-0cee22d2760a",
|
|
"value": "21/65"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1538643468",
|
|
"uuid": "37b700a5-e7a6-4b89-b39f-639dc8d788e4",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "37b700a5-e7a6-4b89-b39f-639dc8d788e4",
|
|
"referenced_uuid": "05e3f750-290b-4985-ba2e-b639851b0ddf",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1538643538",
|
|
"uuid": "5bb5d652-c8c0-43a1-bd45-c4b802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1538643468",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "a3ff9bfc-ac9f-48b4-adaa-a5cdbeceed98",
|
|
"value": "961e79a33f432ea96d2c8bf9eb010006"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1538643471",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "c1e8fd64-2ab8-4f34-b0b0-3b22d9c47197",
|
|
"value": "913ac13ff245baeff843a99dc2cbc1ff5f8c025c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1538643474",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "b9c7a4da-f19a-4a2b-96fd-4e5d3c4722de",
|
|
"value": "a15a4e21fe3b06870d52f7383ef45e4ac0dde727b02b3d340f0ba6346b43add1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1538643477",
|
|
"uuid": "05e3f750-290b-4985-ba2e-b639851b0ddf",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1538643482",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "4c862a8c-164a-4e20-beac-21a28e57f450",
|
|
"value": "2018-10-03T17:22:50"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1538643485",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "3c5c3a4d-27ce-40af-8115-b07e34311568",
|
|
"value": "https://www.virustotal.com/file/a15a4e21fe3b06870d52f7383ef45e4ac0dde727b02b3d340f0ba6346b43add1/analysis/1538587370/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1538643488",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "44a8fce4-4591-47c1-a599-0ff5195b2167",
|
|
"value": "40/68"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1538643491",
|
|
"uuid": "a67002ca-f1b7-4ae5-89b7-92ae322384c4",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "a67002ca-f1b7-4ae5-89b7-92ae322384c4",
|
|
"referenced_uuid": "6490158f-6e4a-4b70-8615-db28a126e06f",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1538643539",
|
|
"uuid": "5bb5d653-1ddc-4b26-9599-c4b802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1538643488",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "81ac6763-3ce1-4c44-b632-b7d8ff6ba060",
|
|
"value": "809cbf6cfded8d571d20fe27d6cf91f9"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1538643491",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "cbb29c50-ee3f-4b08-9934-0adcd040bbd4",
|
|
"value": "046a8adc2ef0f68107e96babc59f41b6f0a57803"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1538643494",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "dc993734-acbf-48ff-bf01-1dff43536422",
|
|
"value": "001d65185910ae8cd9e7e2472745e593be62b98eae3f5f2266a29c37e56daa1d"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1538643497",
|
|
"uuid": "6490158f-6e4a-4b70-8615-db28a126e06f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1538643497",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "ecf40020-4547-44fb-8bd8-b0294caa709a",
|
|
"value": "2018-06-21T12:27:14"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1538643501",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "388a0d75-ae89-475d-af6f-2d1e1c741581",
|
|
"value": "https://www.virustotal.com/file/001d65185910ae8cd9e7e2472745e593be62b98eae3f5f2266a29c37e56daa1d/analysis/1529584034/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1538643505",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "e1c92c53-6e9a-41c2-9b7d-c0b75c75ed20",
|
|
"value": "38/66"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1538643511",
|
|
"uuid": "a48848a5-0b95-4b22-a285-de582b5e4213",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "a48848a5-0b95-4b22-a285-de582b5e4213",
|
|
"referenced_uuid": "80a96246-61ca-4ad7-92ee-1fec639cc36c",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1538643539",
|
|
"uuid": "5bb5d653-e994-49ce-9a14-c4b802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1538643512",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "10ad84d8-67c4-4a04-97b9-73959a176c4e",
|
|
"value": "be6f600e05d6d958a9f614fc415ecba1"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1538643515",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5929be26-9d6c-4ece-84cd-f4313da19b7e",
|
|
"value": "3e7dfe9a8d5955a825cb51cb6eec0cd07c569b41"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1538643518",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "16929d12-281f-48b6-9d8c-0005b95ba3d8",
|
|
"value": "a6576282d17cca390e35306a423dcb5ac9276c28eaba63f74001757edc3688df"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1538643523",
|
|
"uuid": "80a96246-61ca-4ad7-92ee-1fec639cc36c",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1538643528",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "6afd14d5-aaa2-4e91-8b35-67b241367c28",
|
|
"value": "2018-08-24T15:03:55"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1538643532",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "fc3ea1a9-30c5-4b9b-9521-779263a44955",
|
|
"value": "https://www.virustotal.com/file/a6576282d17cca390e35306a423dcb5ac9276c28eaba63f74001757edc3688df/analysis/1535123035/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1538643535",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5f106e2c-460a-4bf1-ac69-cd1ab771761b",
|
|
"value": "37/67"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |