687 lines
No EOL
25 KiB
JSON
687 lines
No EOL
25 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2016-12-08",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Astrum Drops",
|
|
"publish_timestamp": "1481211023",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1481210879",
|
|
"uuid": "58497a8d-4fb8-4155-a101-4a51950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "175760baa2bbca3fbdc4d8f30c993b89_aningik.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210709",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b55-3bbc-43ef-b30c-7bb3950d210f",
|
|
"value": "175760baa2bbca3fbdc4d8f30c993b89"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "175760baa2bbca3fbdc4d8f30c993b89_aningik.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210709",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b55-e514-4520-a2d9-7bb3950d210f",
|
|
"value": "ae35c375086970b7a20242eaa377e36f20b2e766"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "175760baa2bbca3fbdc4d8f30c993b89_aningik.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210710",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b56-1310-4f62-9591-7bb3950d210f",
|
|
"value": "cb9fbb444a6a0b8fd1984db02f9523f9914df2b0747fecc7a1076beee364eb99"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "6229795fa30ee413d1aaeb1619a89b8f_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210710",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b56-f5d0-4af2-8c11-7bb3950d210f",
|
|
"value": "6229795fa30ee413d1aaeb1619a89b8f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "6229795fa30ee413d1aaeb1619a89b8f_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210710",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b56-9290-4dc9-9471-7bb3950d210f",
|
|
"value": "2197c2632fb0f59ffffba2f26bcd6f12412793bc"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "6229795fa30ee413d1aaeb1619a89b8f_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210710",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b56-88e4-4e49-91f8-7bb3950d210f",
|
|
"value": "70406966f853345efe978ecf6e5f15233aab11296cd71d7adfaee664f33ab6a1"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "9072591fd08526efe69572294a5a0c63_vawtrak_113.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210710",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b56-25b8-4311-a555-7bb3950d210f",
|
|
"value": "9072591fd08526efe69572294a5a0c63"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "9072591fd08526efe69572294a5a0c63_vawtrak_113.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210711",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b57-56e8-49d0-ae5a-7bb3950d210f",
|
|
"value": "bab7a711f30e97caae04add267ddec743eea33cb"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "9072591fd08526efe69572294a5a0c63_vawtrak_113.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210711",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b57-98ec-4776-8978-7bb3950d210f",
|
|
"value": "d8c1ea29e6d5bc1ffbd735749237a7e03cd900fb94c94e2f6f18881479b67922"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "a2fc4c3fbd4efd2c24d26b8ede001a10_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210711",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b57-5c84-4f58-a8a5-7bb3950d210f",
|
|
"value": "a2fc4c3fbd4efd2c24d26b8ede001a10"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "a2fc4c3fbd4efd2c24d26b8ede001a10_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210711",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b57-43bc-4853-ac19-7bb3950d210f",
|
|
"value": "ea839998a9eb52c7c420bf9ca69c90807784ebfd"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "a2fc4c3fbd4efd2c24d26b8ede001a10_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210712",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b58-0c70-4b50-b04e-7bb3950d210f",
|
|
"value": "b88cc172abb47f4a62706a474527bc14a768e8f72f63ae5383320e849b4d3e50"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "a0144df5caa43684f733634d7937fe25_gootkit.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210712",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b58-d470-4748-8d12-7bb3950d210f",
|
|
"value": "231dc8c84a65804a69be351e52892bb7bf1532d9"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "a0144df5caa43684f733634d7937fe25_gootkit.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210712",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b58-c9f8-4416-aa2c-7bb3950d210f",
|
|
"value": "c58c97d8ff93eca30e69335cc7c6428fe00c0876e87cf643d025821d27dbd44f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "b2eead90d9cc54752b027e9a9f32741c_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210712",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b58-f41c-4e35-b142-7bb3950d210f",
|
|
"value": "b2eead90d9cc54752b027e9a9f32741c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "b2eead90d9cc54752b027e9a9f32741c_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210713",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b59-614c-4173-88cf-7bb3950d210f",
|
|
"value": "bf8b2208d242bab61bde878053b2be7a116904eb"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "b2eead90d9cc54752b027e9a9f32741c_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210713",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b59-adb4-49ac-9c11-7bb3950d210f",
|
|
"value": "672f56545491108a5e710b727ee6268d7d9ff83612a573c716b02618e26a370f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "e96f2bfb9527e08fc5f82500ef96e487_vawtrak_114.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210713",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b59-94b0-45d8-a1d2-7bb3950d210f",
|
|
"value": "e96f2bfb9527e08fc5f82500ef96e487"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "e96f2bfb9527e08fc5f82500ef96e487_vawtrak_114.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210713",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b59-4ad4-4b98-8032-7bb3950d210f",
|
|
"value": "281373b455c9d400e1e56e25e7dcd7cd174a7d65"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "e96f2bfb9527e08fc5f82500ef96e487_vawtrak_114.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210713",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b59-ba0c-49f1-b5d5-7bb3950d210f",
|
|
"value": "70a4b312ceec1eb2c259913451c93c138465f3d70c74d0a61eb4c48c5aba0b51"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "ecd1ad7ea3950f29a9afbc000d2b9b1a_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210714",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b5a-1dc4-40b2-9c78-7bb3950d210f",
|
|
"value": "ecd1ad7ea3950f29a9afbc000d2b9b1a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "ecd1ad7ea3950f29a9afbc000d2b9b1a_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210714",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b5a-dcec-4401-a220-7bb3950d210f",
|
|
"value": "e9f0c59a2090e681e5d4b5166e6d60f9fb9db772"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "ecd1ad7ea3950f29a9afbc000d2b9b1a_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210714",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b5a-cc8c-4711-a47c-7bb3950d210f",
|
|
"value": "61b8655dfdb553d8fbd5afab7997e247da4b1e9dfc1bbb2474750617bcca5e0f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "f12cdb36588d661a0cd1c63808df3f20_ramnit.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210714",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b5a-b834-4715-b88a-7bb3950d210f",
|
|
"value": "f12cdb36588d661a0cd1c63808df3f20"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "f12cdb36588d661a0cd1c63808df3f20_ramnit.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210715",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b5b-527c-4ebd-af55-7bb3950d210f",
|
|
"value": "50dc8a7e5df13f94dadbe48d81d136b82b19b131"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "f12cdb36588d661a0cd1c63808df3f20_ramnit.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210715",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b5b-0074-4977-a46c-7bb3950d210f",
|
|
"value": "57adba8dea8bd0eb8dab7a2e77a52823b60b6062df64c77af0f5bfd7eafb542c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "f9243ae7005815ff3e3fbe43505e22b3_godzilla.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210715",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b5b-6020-4810-9e46-7bb3950d210f",
|
|
"value": "f9243ae7005815ff3e3fbe43505e22b3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "f9243ae7005815ff3e3fbe43505e22b3_godzilla.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210715",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b5b-31bc-4f47-a14c-7bb3950d210f",
|
|
"value": "bcfde94dcb4be8be69ca706c703de170956ffe0b"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "f9243ae7005815ff3e3fbe43505e22b3_godzilla.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210715",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b5b-58bc-48b9-bb6a-7bb3950d210f",
|
|
"value": "be1652dbe9bb2fe035e29c8d341f7b54137e47f4d3d5b8a6f70ca7525a27f4c7"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "fa495110b05f2bb572e46214a681e3f3_zloader.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210716",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b5c-5210-46a9-93b7-7bb3950d210f",
|
|
"value": "fa495110b05f2bb572e46214a681e3f3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "fa495110b05f2bb572e46214a681e3f3_zloader.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210716",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b5c-b534-42c2-b86a-7bb3950d210f",
|
|
"value": "e2da4e94a5ace245c0c0acde2660d342f6c00454"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "fa495110b05f2bb572e46214a681e3f3_zloader.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210716",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b5c-7590-4a96-b46c-7bb3950d210f",
|
|
"value": "f5abbc55f71a4df294a9dde70e41617e32a64e4ccf6a0c6baf7f4306ef0070b2"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "0b9e17cec5939bf3ea26bece55949b44_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210716",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b5c-cfa4-44b1-bfba-7bb3950d210f",
|
|
"value": "0b9e17cec5939bf3ea26bece55949b44"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "0b9e17cec5939bf3ea26bece55949b44_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210717",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b5d-7b64-4be5-bb37-7bb3950d210f",
|
|
"value": "e471707419f31a876484df03f2fe84cdac230a8e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "0b9e17cec5939bf3ea26bece55949b44_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210717",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b5d-c2f4-46cb-9cbf-7bb3950d210f",
|
|
"value": "f029a658e6b63e48d791310ffda403f0eb36f8a5108b14a87b85b5be01e18b86"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "0f048d74e11515a4eeee5a28e5eb93d3_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210717",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b5d-0c88-44a1-bbec-7bb3950d210f",
|
|
"value": "0f048d74e11515a4eeee5a28e5eb93d3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "0f048d74e11515a4eeee5a28e5eb93d3_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210717",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b5d-5c00-42ad-bf39-7bb3950d210f",
|
|
"value": "b2e4e5c38be5380558d2ada30c3e30b015cf5b16"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "0f048d74e11515a4eeee5a28e5eb93d3_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210717",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b5d-ef3c-4db5-bc08-7bb3950d210f",
|
|
"value": "8d58eb6316855492b689242d852908a9e9005bb950910fa7f3e1be6d8fe70895"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "1a03106ce5f67f2928d31dfea0f99d63_zloader.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210718",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b5e-cbe8-455b-9ef6-7bb3950d210f",
|
|
"value": "1a03106ce5f67f2928d31dfea0f99d63"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "1a03106ce5f67f2928d31dfea0f99d63_zloader.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210718",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b5e-2708-4703-8b17-7bb3950d210f",
|
|
"value": "5eba3d5c01e404c965e4d51e34e7904b3686c488"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "1a03106ce5f67f2928d31dfea0f99d63_zloader.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210718",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b5e-1114-4ec5-a7e4-7bb3950d210f",
|
|
"value": "da781eb4c3d0bcfa77fa06ec0c0f1d40f1152580744e4d8cdfbf99de82c3f32e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "7a85085f54f4e10a10a3270ccce67cc3_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210718",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b5e-331c-47be-adf2-7bb3950d210f",
|
|
"value": "7a85085f54f4e10a10a3270ccce67cc3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "7a85085f54f4e10a10a3270ccce67cc3_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210719",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b5f-f068-4533-818a-7bb3950d210f",
|
|
"value": "6f155e576bbe80703cf48246c2bea1e35e06acf5"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "7a85085f54f4e10a10a3270ccce67cc3_dreambot.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210719",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b5f-ef3c-48b7-a2b5-7bb3950d210f",
|
|
"value": "d5a492253d0a336a620b8447780ec8efee720f1b9575fb77d2d29b01fbf18ca9"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "97b764282ad33dc7fc19f5dbd7a3649a_gootkit.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210719",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b5f-4550-4720-be86-7bb3950d210f",
|
|
"value": "97b764282ad33dc7fc19f5dbd7a3649a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "97b764282ad33dc7fc19f5dbd7a3649a_gootkit.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210719",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b5f-39a8-45f8-92c6-7bb3950d210f",
|
|
"value": "bfbfa097560e84760201c90d8e4da6a7896c0067"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "97b764282ad33dc7fc19f5dbd7a3649a_gootkit.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210720",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b60-fa9c-49c9-bd64-7bb3950d210f",
|
|
"value": "1d8acc610c84233ecd91a373efa450e0719078c50d17eb927b465d4675d02e7f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "3129c8b9ccf91f3349262c12be21d5ed_godzilla.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210720",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497b60-8b48-4122-894d-7bb3950d210f",
|
|
"value": "3129c8b9ccf91f3349262c12be21d5ed"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "3129c8b9ccf91f3349262c12be21d5ed_godzilla.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210720",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58497b60-7554-4498-af70-7bb3950d210f",
|
|
"value": "d7688d0af073ad89051ca87d8ba31b18ea4f55e9"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "3129c8b9ccf91f3349262c12be21d5ed_godzilla.kaf",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210720",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58497b60-0734-4c2a-9c30-7bb3950d210f",
|
|
"value": "9ae69049018ddb938b454e55ffe75daa2e8a446d226ab3193ea0011870a5e445"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210744",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58497b78-fbc0-433e-ad26-4c63950d210f",
|
|
"value": "https://github.com/Kafeine/public/blob/master/Astrum_drop_2016-12-07.md"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "9072591fd08526efe69572294a5a0c63_vawtrak_113.kaf - Xchecked via VT: d8c1ea29e6d5bc1ffbd735749237a7e03cd900fb94c94e2f6f18881479b67922",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210879",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58497bff-3618-47a3-bb79-432602de0b81",
|
|
"value": "https://www.virustotal.com/file/d8c1ea29e6d5bc1ffbd735749237a7e03cd900fb94c94e2f6f18881479b67922/analysis/1481015797/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "a0144df5caa43684f733634d7937fe25_gootkit.kaf - Xchecked via VT: c58c97d8ff93eca30e69335cc7c6428fe00c0876e87cf643d025821d27dbd44f",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210879",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58497bff-a148-42d0-96ce-4a4002de0b81",
|
|
"value": "a0144df5caa43684f733634d7937fe25"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "a0144df5caa43684f733634d7937fe25_gootkit.kaf - Xchecked via VT: c58c97d8ff93eca30e69335cc7c6428fe00c0876e87cf643d025821d27dbd44f",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210879",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58497bff-5c18-4591-8754-4ac302de0b81",
|
|
"value": "https://www.virustotal.com/file/c58c97d8ff93eca30e69335cc7c6428fe00c0876e87cf643d025821d27dbd44f/analysis/1480426462/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "e96f2bfb9527e08fc5f82500ef96e487_vawtrak_114.kaf - Xchecked via VT: 70a4b312ceec1eb2c259913451c93c138465f3d70c74d0a61eb4c48c5aba0b51",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210880",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58497c00-d978-4056-bb9a-444d02de0b81",
|
|
"value": "https://www.virustotal.com/file/70a4b312ceec1eb2c259913451c93c138465f3d70c74d0a61eb4c48c5aba0b51/analysis/1479586398/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "ecd1ad7ea3950f29a9afbc000d2b9b1a_dreambot.kaf - Xchecked via VT: 61b8655dfdb553d8fbd5afab7997e247da4b1e9dfc1bbb2474750617bcca5e0f",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210881",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58497c01-7e28-488c-8361-414402de0b81",
|
|
"value": "https://www.virustotal.com/file/61b8655dfdb553d8fbd5afab7997e247da4b1e9dfc1bbb2474750617bcca5e0f/analysis/1480979088/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "f12cdb36588d661a0cd1c63808df3f20_ramnit.kaf - Xchecked via VT: 57adba8dea8bd0eb8dab7a2e77a52823b60b6062df64c77af0f5bfd7eafb542c",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210881",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58497c01-ad80-417a-95eb-4d8002de0b81",
|
|
"value": "https://www.virustotal.com/file/57adba8dea8bd0eb8dab7a2e77a52823b60b6062df64c77af0f5bfd7eafb542c/analysis/1475653336/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "f9243ae7005815ff3e3fbe43505e22b3_godzilla.kaf - Xchecked via VT: be1652dbe9bb2fe035e29c8d341f7b54137e47f4d3d5b8a6f70ca7525a27f4c7",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210882",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58497c02-0f90-4ac8-851f-4bad02de0b81",
|
|
"value": "https://www.virustotal.com/file/be1652dbe9bb2fe035e29c8d341f7b54137e47f4d3d5b8a6f70ca7525a27f4c7/analysis/1476781773/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "0b9e17cec5939bf3ea26bece55949b44_dreambot.kaf - Xchecked via VT: f029a658e6b63e48d791310ffda403f0eb36f8a5108b14a87b85b5be01e18b86",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210882",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58497c02-9344-452a-9a0e-4cfa02de0b81",
|
|
"value": "https://www.virustotal.com/file/f029a658e6b63e48d791310ffda403f0eb36f8a5108b14a87b85b5be01e18b86/analysis/1477316139/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "3129c8b9ccf91f3349262c12be21d5ed_godzilla.kaf - Xchecked via VT: 9ae69049018ddb938b454e55ffe75daa2e8a446d226ab3193ea0011870a5e445",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1481210883",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58497c03-4bc4-487a-88a1-484602de0b81",
|
|
"value": "https://www.virustotal.com/file/9ae69049018ddb938b454e55ffe75daa2e8a446d226ab3193ea0011870a5e445/analysis/1479993485/"
|
|
}
|
|
]
|
|
}
|
|
} |