271 lines
No EOL
9.6 KiB
JSON
271 lines
No EOL
9.6 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "1",
|
|
"date": "2016-09-01",
|
|
"extends_uuid": "",
|
|
"info": "Malware Posing as Human Rights Organizations and Commercial Software Targeting Iranians, Foreign Policy Institutions and Middle Eastern Countries (ExtremeDownloader and Strealer)",
|
|
"publish_timestamp": "1472740551",
|
|
"published": true,
|
|
"threat_level_id": "1",
|
|
"timestamp": "1472740516",
|
|
"uuid": "57c8398d-2238-41df-bbc7-45b7950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#3b7500",
|
|
"name": "circl:incident-classification=\"malware\""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Payloads",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740174",
|
|
"to_ids": true,
|
|
"type": "filename|sha256",
|
|
"uuid": "57c83a33-f6d4-4791-a524-47fe950d210f",
|
|
"value": "newlity.exe|a62dde31eecf650c2dd39eeda9daf8fd35b1dff5330e72035d1846579ea838dc"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Payloads",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740174",
|
|
"to_ids": true,
|
|
"type": "filename|sha256",
|
|
"uuid": "57c83a33-53e8-4a85-88cb-4c30950d210f",
|
|
"value": "private_chat.exe|1a24714fd99030bd63804ab96fc2612f148a5f08d1c2845152c3a0e168600db9"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Payloads",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740174",
|
|
"to_ids": true,
|
|
"type": "filename|sha256",
|
|
"uuid": "57c83a34-7500-4033-a076-47f4950d210f",
|
|
"value": "multiplay-register.exe|e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Payloads",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740174",
|
|
"to_ids": true,
|
|
"type": "filename|sha256",
|
|
"uuid": "57c83a34-eb4c-4010-9c4f-432f950d210f",
|
|
"value": "TeamSpeak.EXE|13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Extreme downloader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740192",
|
|
"to_ids": true,
|
|
"type": "filename|sha256",
|
|
"uuid": "57c83a34-3e24-4416-8f90-4a25950d210f",
|
|
"value": "dwm.exe|e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Dropper / Moreoriz",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740201",
|
|
"to_ids": true,
|
|
"type": "filename|sha256",
|
|
"uuid": "57c83a35-0c04-4523-8f40-42bb950d210f",
|
|
"value": "contask.exe|b0afef1ee97c8a9a7a7d4a83b5d8aab3a710062d9df98f909a3306c031e2cc21"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Strealer",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740213",
|
|
"to_ids": true,
|
|
"type": "filename|sha256",
|
|
"uuid": "57c83a35-4ab4-49b0-80a3-43c3950d210f",
|
|
"value": "mozilla.exe|3a8995413b8e63dca766999c5a3220114e4ab4c446130c5bd7c852a618dd2fa7"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "TightVNC",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740216",
|
|
"to_ids": true,
|
|
"type": "filename|sha256",
|
|
"uuid": "57c83a36-7eb8-418f-8181-4bb4950d210f",
|
|
"value": "vn.exe|1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740003",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "57c83aa3-897c-4a04-ba98-435d950d210f",
|
|
"value": "apache-utility.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740004",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "57c83aa4-42e4-40b0-a045-470c950d210f",
|
|
"value": "microsoft-hotfix.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740004",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "57c83aa4-d7ac-4cb8-a9cb-4d31950d210f",
|
|
"value": "5.152.202.53"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740004",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "57c83aa4-99b4-4d1a-9bbb-4542950d210f",
|
|
"value": "update-finder.com"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740347",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57c83bfb-4838-4a75-9522-41bc950d210f",
|
|
"value": "https://iranthreats.github.io/resources/human-rights-impersonation-malware/"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "TightVNC - Xchecked via VT: 1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740516",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "57c83ca4-d5bc-49b7-9778-48a102de0b81",
|
|
"value": "b89d8b5bd6f9bf1c1d61f0d3851dec9cf4216b9b"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "TightVNC - Xchecked via VT: 1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740517",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "57c83ca5-2308-4ce2-b870-4cc202de0b81",
|
|
"value": "a2ff24322c12558eb1f29aea3ca6f24a"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "TightVNC - Xchecked via VT: 1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740517",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57c83ca5-89ac-4e60-b7d0-4eda02de0b81",
|
|
"value": "https://www.virustotal.com/file/1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae/analysis/1452468082/"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Extreme downloader - Xchecked via VT: e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740517",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "57c83ca5-ec84-4e30-90f7-4f8d02de0b81",
|
|
"value": "d5144c73f7e7c961bc2823cf002892eee70c4dbf"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Extreme downloader - Xchecked via VT: e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740517",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "57c83ca5-f860-4991-b6ee-486302de0b81",
|
|
"value": "ccaf21e122ca9d2e2397a9e28eb4cc87"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "Extreme downloader - Xchecked via VT: e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740517",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57c83ca5-971c-45a8-89ae-428d02de0b81",
|
|
"value": "https://www.virustotal.com/file/e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716/analysis/1470948989/"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Payloads - Xchecked via VT: 13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740518",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "57c83ca6-be84-471d-bc23-428402de0b81",
|
|
"value": "f2179dbba6a4f132864d8edd38c26991ac21559d"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Payloads - Xchecked via VT: 13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740518",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "57c83ca6-d4e0-46d3-9a59-4e8702de0b81",
|
|
"value": "77857588c41f778b7660d4e52634a4e3"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "Payloads - Xchecked via VT: 13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1472740518",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57c83ca6-ca38-4a27-805b-4e8702de0b81",
|
|
"value": "https://www.virustotal.com/file/13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9/analysis/1470330553/"
|
|
}
|
|
]
|
|
}
|
|
} |