583 lines
No EOL
21 KiB
JSON
583 lines
No EOL
21 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2019-05-08",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak",
|
|
"publish_timestamp": "1557328840",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1557328832",
|
|
"uuid": "5cd2ec29-16fc-4842-b954-282902de0b81",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"name": "type:OSINT"
|
|
},
|
|
{
|
|
"colour": "#0071c3",
|
|
"name": "osint:lifetime=\"perpetual\""
|
|
},
|
|
{
|
|
"colour": "#0087e8",
|
|
"name": "osint:certainty=\"50\""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
},
|
|
{
|
|
"colour": "#0fbe00",
|
|
"name": "misp-galaxy:threat-actor=\"UPS\""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"name": "misp-galaxy:mitre-intrusion-set=\"APT3 - G0022\""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"name": "osint:source-type=\"blog-post\""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Pirpi (first variant)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5cd2ed5b-ed08-4fe3-bf5d-2829950d210f",
|
|
"value": "7020bcb347404654e17f6303848b7ec4"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Pirpi (first variant)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5cd2ed5b-f164-4f34-8ecd-2829950d210f",
|
|
"value": "cbe23daa9d2f8e1f5d59c8336dd5b7d7ba1d5cf3f0d45e66107668e80b073ac3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Pirpi (second variant)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5cd2ed5b-b458-4acf-b636-2829950d210f",
|
|
"value": "aacfef51a4a242f52fbb838c1d063d9b"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Pirpi (second variant)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5cd2ed5b-eca8-4834-a29a-2829950d210f",
|
|
"value": "53145f374299e673d82d108b133341dc7bee642530b560118e3cbcdb981ee92c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Command line utility to list user accounts on remote machine",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5cd2ed5b-8ce0-4eab-bdf1-2829950d210f",
|
|
"value": "c2f902f398783922a921df7d46590295"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Command line utility to list user accounts on remote machine",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5cd2ed5b-639c-4e92-9ef1-2829950d210f",
|
|
"value": "01f53953db8ba580ee606043a482f790082460c8cdbd7ff151d84e03fdc87e42"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (C/C++)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5cd2ed5b-b7c4-45a4-8544-2829950d210f",
|
|
"value": "6458806a5071a7c4fefae084791e8c67"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (C/C++)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5cd2ed5b-75ac-4259-9dc9-2829950d210f",
|
|
"value": "6b1f8b303956c04e24448b1eec8634bd3fb2784c8a2d12ecf8588424b36d3cbc"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (Powershell)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5cd2ed5b-8600-4adf-8514-2829950d210f",
|
|
"value": "0d2d0d8f4989679f7c26b5531096b8b2"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (Powershell)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5cd2ed5b-6c24-4586-b546-2829950d210f",
|
|
"value": "7bfad342ce88de19d090a4cb2ce332022650abd68f34e83fdc694f10a4090d65"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (py2exe)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5cd2ed5b-3434-4064-bf3c-2829950d210f",
|
|
"value": "a3932533efc04ac3fe89fb5b3d60128a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (py2exe)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5cd2ed5b-a248-4e3e-8892-2829950d210f",
|
|
"value": "3dbe8700ecd27b3dc39643b95b187ccfd44318fc88c5e6ee6acf3a07cdaf377e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Command line SMB client",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5cd2ed5b-5860-4fbd-a655-2829950d210f",
|
|
"value": "58f784c7a292103251930360f9ca713e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Command line SMB client",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5cd2ed5b-b054-4431-b920-2829950d210f",
|
|
"value": "1c9f1c7056864b5fdd491d5daa49f920c3388cb8a8e462b2bc34181cef6c1f9c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "HTran",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5cd2ed5b-6b38-47d6-9a7c-2829950d210f",
|
|
"value": "a469d48e25e524cf0dec64f01c182b25"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "HTran",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5cd2ed5b-0258-45d5-930e-2829950d210f",
|
|
"value": "951f079031c996c85240831ea1b61507f91990282daae6da2841311322e8a6d7"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557328783",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5cd2f38f-2274-4de6-b0a0-482402de0b81",
|
|
"value": "https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557328818",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5cd2f3b2-d488-4322-b60c-445f02de0b81",
|
|
"value": "Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak\r\nWindows zero day was exploited by Buckeye alongside Equation Group tools during 2016 attacks. Exploit and tools continued to be used after Buckeye's apparent disappearance in 2017.\r\nKey Findings\r\n\r\n The Buckeye attack group was using Equation Group tools to gain persistent access to target organizations at least a year prior to the Shadow Brokers leak.\r\n Variants of Equation Group tools used by Buckeye appear to be different from those released by Shadow Brokers, potentially indicating that they didn't originate from that leak.\r\n Buckeye's use of Equation Group tools also involved the exploit of a previously unknown Windows zero-day vulnerability. This zero day was reported by Symantec to Microsoft in September 2018 and patched in March 2019.\r\n While Buckeye appeared to cease operations in mid-2017, the Equation Group tools it used continued to be used in attacks until late 2018. It is unknown who continued to use the tools. They may have been passed to another group or Buckeye may have continued operating longer than supposed.\r\n\r\nThe 2017 leak of Equation Group tools by a mysterious group calling itself the Shadow Brokers was one of the most significant cyber security stories in recent years. Equation is regarded as one of the most technically adept espionage groups and the release of a trove of its tools had a major impact, with many attackers rushing to deploy the malware and exploits disclosed."
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1557327315",
|
|
"uuid": "cb969a73-6e24-4be3-9e56-19d7b012bdf9",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "cb969a73-6e24-4be3-9e56-19d7b012bdf9",
|
|
"referenced_uuid": "b8448b23-79bc-4adb-b285-e620e36372f9",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1557327316",
|
|
"uuid": "5cd2edd4-e958-4f38-92b4-451402de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (C/C++)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5bad86b4-7eb6-42eb-b508-20e66be75b57",
|
|
"value": "6458806a5071a7c4fefae084791e8c67"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (C/C++)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "00cca285-e050-4235-8bb9-8fdbefbc072c",
|
|
"value": "ec6cf407e4f791abb04a2bafde0980a2ba1fd2a8"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (C/C++)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "982504b6-81d9-48df-83a9-f993c52514a5",
|
|
"value": "6b1f8b303956c04e24448b1eec8634bd3fb2784c8a2d12ecf8588424b36d3cbc"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1557327315",
|
|
"uuid": "b8448b23-79bc-4adb-b285-e620e36372f9",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "Filensfer (C/C++)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1557327195",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "94260963-ba53-478d-8521-3a62b6a411cb",
|
|
"value": "2019-05-08T05:07:44"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (C/C++)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1557327195",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5701e708-1d8c-4670-8b47-0acb9670c276",
|
|
"value": "https://www.virustotal.com/file/6b1f8b303956c04e24448b1eec8634bd3fb2784c8a2d12ecf8588424b36d3cbc/analysis/1557292064/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (C/C++)",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1557327195",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "e950587d-ed19-426c-96ac-b93f8a0cd985",
|
|
"value": "45/73"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1557327315",
|
|
"uuid": "29707d14-8018-4c35-9bb4-2ee259cf9724",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "29707d14-8018-4c35-9bb4-2ee259cf9724",
|
|
"referenced_uuid": "9f0f1973-38c8-4a2c-9ab8-0b71e5a37a2c",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1557327316",
|
|
"uuid": "5cd2edd4-9fac-4210-b587-4dea02de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (py2exe)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "f71933b6-a686-4704-8cba-35308fefbe23",
|
|
"value": "a3932533efc04ac3fe89fb5b3d60128a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (py2exe)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "26882595-ca54-43eb-9901-4a769879914f",
|
|
"value": "2a01d103b2bb66cba2cdb201f09933fee2055db3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (py2exe)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "25fcff98-a11f-43d9-b328-a9a5aed3fb17",
|
|
"value": "3dbe8700ecd27b3dc39643b95b187ccfd44318fc88c5e6ee6acf3a07cdaf377e"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1557327315",
|
|
"uuid": "9f0f1973-38c8-4a2c-9ab8-0b71e5a37a2c",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "Filensfer (py2exe)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1557327195",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "7773b23b-26f6-4274-9911-ff7ce63a8c4b",
|
|
"value": "2019-05-08T05:07:41"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (py2exe)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1557327195",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "7c4abf50-a135-4369-bc1c-12aeabe252b7",
|
|
"value": "https://www.virustotal.com/file/3dbe8700ecd27b3dc39643b95b187ccfd44318fc88c5e6ee6acf3a07cdaf377e/analysis/1557292061/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Filensfer (py2exe)",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1557327195",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "a31469f5-82a2-4210-88a4-4ffc8a06fcdc",
|
|
"value": "19/73"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1557327315",
|
|
"uuid": "6b996ac5-d722-4603-a955-0264c5081cb2",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "6b996ac5-d722-4603-a955-0264c5081cb2",
|
|
"referenced_uuid": "cdbb3fad-5a1c-4032-b488-71878e955d17",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1557327316",
|
|
"uuid": "5cd2edd4-b2a4-4ceb-aa54-42a702de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "HTran",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "9ea8acc0-c871-4530-95ee-0e3a85b60660",
|
|
"value": "a469d48e25e524cf0dec64f01c182b25",
|
|
"Tag": [
|
|
{
|
|
"colour": "#0088cc",
|
|
"name": "misp-galaxy:malpedia=\"HTran\""
|
|
},
|
|
{
|
|
"colour": "#0b8900",
|
|
"name": "misp-galaxy:tool=\"Htran\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "HTran",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "65cbee29-919f-48cf-bf72-1ed80ac1740b",
|
|
"value": "312f62f4b6a6251a8b6501d665da3069ce21a3b6"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "HTran",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1557327195",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "fb6374ef-fbdb-4b29-be3d-321074d7b765",
|
|
"value": "951f079031c996c85240831ea1b61507f91990282daae6da2841311322e8a6d7"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1557327315",
|
|
"uuid": "cdbb3fad-5a1c-4032-b488-71878e955d17",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "HTran",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1557327195",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "440ea4c6-db42-4154-b545-9a240b49dc79",
|
|
"value": "2019-05-08T05:07:48"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "HTran",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1557327195",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "e1e619bf-cf06-4e72-bce0-1badbcceb720",
|
|
"value": "https://www.virustotal.com/file/951f079031c996c85240831ea1b61507f91990282daae6da2841311322e8a6d7/analysis/1557292068/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "HTran",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1557327195",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "129a5a26-1fe5-4fa8-a304-8b1e6b2c3e30",
|
|
"value": "47/73"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |