688 lines
No EOL
22 KiB
JSON
688 lines
No EOL
22 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2017-10-25",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Bad Rabbit: Not-Petya is back with improved ransomware",
|
|
"publish_timestamp": "1514467254",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1511385587",
|
|
"uuid": "59f049c0-aae0-47d2-a888-4021950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:ransomware=\"Bad Rabbit\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#004646",
|
|
"local": "0",
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#2c4f00",
|
|
"local": "0",
|
|
"name": "malware_classification:malware-category=\"Ransomware\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": "0",
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:preventive-measure=\"Backup and Restore Process\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:preventive-measure=\"Restrict Workstation Communication\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921673",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59f049cf-329c-4504-a63c-4974950d210f",
|
|
"value": "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": "0",
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "59f04b31-f73c-4d20-95b5-4edf950d210f",
|
|
"value": "185.149.120.3"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "59f04b48-223c-4642-a5cf-412c950d210f",
|
|
"value": "A new ransomware outbreak today and has hit some major infrastructure in Ukraine including Kiev metro.",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": "0",
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "59f04b70-32f4-4c4b-bd74-4775950d210f",
|
|
"value": "1dnscontrol.com"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508920176",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "59f04b70-a00c-47a5-903e-44f2950d210f",
|
|
"value": "install_flash_player.exe"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Mimikatz (32-bits)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f04c8f-fba0-4775-913a-4a4f950d210f",
|
|
"value": "413eba3973a15c1a6429d9f170f3e8287f98c21c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Mimikatz (64-bits)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f04c8f-046c-41dc-a600-4306950d210f",
|
|
"value": "16605a4a29a101208457c47ebfde788487be788d"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04d24-9424-49ec-86bc-403c950d210f",
|
|
"value": "http://caforssztxqzf2nm.onion"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04d24-f6a4-4278-b3b5-406d950d210f",
|
|
"value": "http://185.149.120.3/scholargoogle/"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04d24-0348-4b41-8e40-4887950d210f",
|
|
"value": "http://1dnscontrol.com/flash_install.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-4f04-4174-a93d-4c9d950d210f",
|
|
"value": "http://argumentiru.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-3e78-47fc-ad92-4866950d210f",
|
|
"value": "http://www.fontanka.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-9890-46f0-b252-4884950d210f",
|
|
"value": "http://grupovo.bg"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-de28-4f39-a955-43c6950d210f",
|
|
"value": "http://www.sinematurk.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-7564-446e-80f5-4717950d210f",
|
|
"value": "http://www.aica.co.jp"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-d780-4e3e-a215-44b3950d210f",
|
|
"value": "http://spbvoditel.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-bcc0-415d-9588-4111950d210f",
|
|
"value": "http://argumenti.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-4838-45fc-b75c-48b9950d210f",
|
|
"value": "http://www.mediaport.ua"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-4dc8-470d-9268-45bd950d210f",
|
|
"value": "http://blog.fontanka.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-0600-4c83-8d3a-41ae950d210f",
|
|
"value": "http://an-crimea.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-7eb8-4933-a170-4c3e950d210f",
|
|
"value": "http://www.t.ks.ua"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-7b94-4be1-a497-42c2950d210f",
|
|
"value": "http://most-dnepr.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-fe88-4850-b260-4b7d950d210f",
|
|
"value": "http://osvitaportal.com.ua"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-8294-4d84-862f-46d7950d210f",
|
|
"value": "http://www.otbrana.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-3198-4485-8eae-4833950d210f",
|
|
"value": "http://calendar.fontanka.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-9858-4feb-ad80-4183950d210f",
|
|
"value": "http://www.grupovo.bg"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-7448-4f85-b71a-48d7950d210f",
|
|
"value": "http://www.pensionhotel.cz"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-7d48-426d-9d85-4d32950d210f",
|
|
"value": "http://www.online812.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-fc80-4ddf-822f-47b2950d210f",
|
|
"value": "http://www.imer.ro"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-c6e8-4de1-a60a-42c8950d210f",
|
|
"value": "http://novayagazeta.spb.ru"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-b9c0-485f-b2c3-42cb950d210f",
|
|
"value": "http://i24.com.ua"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-4fc4-4b03-927f-4c92950d210f",
|
|
"value": "http://bg.pensionhotel.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "compromised site",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "59f04ddf-e83c-4d61-b9ab-43ea950d210f",
|
|
"value": "http://ankerch-crimea.ru"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Mimikatz (64-bits) - Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "59f0514a-7310-4dad-b3b1-490002de0b81",
|
|
"value": "2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Mimikatz (64-bits) - Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "59f0514a-df70-416c-bfae-445f02de0b81",
|
|
"value": "37945c44a897aa42a66adcab68f560e0"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "Mimikatz (64-bits) - Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59f0514a-7f84-4846-ba38-449302de0b81",
|
|
"value": "https://www.virustotal.com/file/2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035/analysis/1508915760/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Mimikatz (32-bits) - Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "59f0514a-b3d0-4191-a490-440802de0b81",
|
|
"value": "301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Mimikatz (32-bits) - Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "59f0514a-1be4-4e5c-8fff-48cc02de0b81",
|
|
"value": "347ac3b6b791054de3e5720a7144a977"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "Mimikatz (32-bits) - Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1508921674",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59f0514a-f0d8-4972-9b45-40cb02de0b81",
|
|
"value": "https://www.virustotal.com/file/301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c/analysis/1508918790/"
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "Diskcoder",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "3",
|
|
"timestamp": "1508921861",
|
|
"uuid": "59f04c50-0864-406b-b9fd-4797950d210f",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "59f04c50-0864-406b-b9fd-4797950d210f",
|
|
"referenced_uuid": "59f04cab-7520-4c5d-b6d7-4f46950d210f",
|
|
"relationship_type": "dropped-by",
|
|
"timestamp": "1508921858",
|
|
"uuid": "59f05202-85f0-4f57-8f6c-4940950d210f"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "filename",
|
|
"timestamp": "1508920400",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "59f04c50-54bc-44c5-8b25-4ceb950d210f",
|
|
"value": "infpub.dat"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1508920400",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f04c50-93b0-4a68-aa51-4042950d210f",
|
|
"value": "79116fe99f2b421c52ef64097f0f39b815b20907"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Lockscreen",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "3",
|
|
"timestamp": "1508921972",
|
|
"uuid": "59f04c7a-1ee8-472b-93b7-4f06950d210f",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "59f04c7a-1ee8-472b-93b7-4f06950d210f",
|
|
"referenced_uuid": "59f04c50-0864-406b-b9fd-4797950d210f",
|
|
"relationship_type": "dropped-by",
|
|
"timestamp": "1508921969",
|
|
"uuid": "59f05271-6fac-4f63-9bf2-4028950d210f"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "filename",
|
|
"timestamp": "1508920442",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "59f04c7a-5c84-488a-9acd-4e27950d210f",
|
|
"value": "dispci.exe"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1508920442",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f04c7a-3490-4017-9aa1-48cc950d210f",
|
|
"value": "afeee8b4acff87bc469a6f0364a81ae5d60a2add"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Dropper",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "3",
|
|
"timestamp": "1508921843",
|
|
"uuid": "59f04cab-7520-4c5d-b6d7-4f46950d210f",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "59f04cab-7520-4c5d-b6d7-4f46950d210f",
|
|
"referenced_uuid": "59f04cf4-0f54-4525-8d29-453f950d210f",
|
|
"relationship_type": "dropped-by",
|
|
"timestamp": "1508921840",
|
|
"uuid": "59f051f0-9fa4-4ba0-84d3-4a37950d210f"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "filename",
|
|
"timestamp": "1508920491",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "59f04cab-ca10-4e65-bdc2-4658950d210f",
|
|
"value": "install_flash_player.exe"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1508920491",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f04cab-4674-4ca3-9c66-4d8e950d210f",
|
|
"value": "de5c8d858e6e41da715dca1c019df0bfb92d32c0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "JavaScript on compromised sites",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "3",
|
|
"timestamp": "1508920564",
|
|
"uuid": "59f04cf4-0f54-4525-8d29-453f950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "filename",
|
|
"timestamp": "1508920564",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "59f04cf4-3220-4295-ab59-4dce950d210f",
|
|
"value": "page-main.js"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1508920564",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59f04cf4-6ddc-4387-823f-41b3950d210f",
|
|
"value": "4f61e154230a64902ae035434690bf2b96b4e018"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |