796 lines
No EOL
25 KiB
JSON
796 lines
No EOL
25 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2018-09-06",
|
|
"extends_uuid": "",
|
|
"info": "powerpool-malware-exploits-zero-day-vulnerability",
|
|
"publish_timestamp": "1589183606",
|
|
"published": true,
|
|
"threat_level_id": "2",
|
|
"timestamp": "1621849865",
|
|
"uuid": "5b9162c3-90b4-423b-bd69-28330acd0835",
|
|
"Orgc": {
|
|
"name": "Synovus Financial",
|
|
"uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"name": "osint:source-type=\"blog-post\""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1536254918",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5b9162d7-70bc-4802-a3e8-2efb0acd0835",
|
|
"value": "https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1536255394",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5b916597-a96c-43dc-bcc0-2f0b0acd0835",
|
|
"value": "newsrental.net",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00aad0",
|
|
"name": "veris:action:malware:variety=\"C2\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1536255394",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5b916597-7bc0-45f8-a810-2f0b0acd0835",
|
|
"value": "rosbusiness.eu",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00aad0",
|
|
"name": "veris:action:malware:variety=\"C2\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1536255394",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5b916597-dc78-43cb-b1df-2f0b0acd0835",
|
|
"value": "afishaonline.eu",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00aad0",
|
|
"name": "veris:action:malware:variety=\"C2\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1536255394",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5b916597-7ba8-4aaa-98b5-2f0b0acd0835",
|
|
"value": "sports-collectors.com",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00aad0",
|
|
"name": "veris:action:malware:variety=\"C2\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2\r\nCountry: Korea, Republic Of\r\nRegion: Gyeonggi-do\r\nCity: Yongin\r\nISP: Daou Technology",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1536256145",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5b916597-ec48-4d1f-b15f-2f0b0acd0835",
|
|
"value": "27.102.106.149",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00aad0",
|
|
"name": "veris:action:malware:variety=\"C2\""
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "13",
|
|
"timestamp": "1536254905",
|
|
"uuid": "5b91638b-01d0-4303-9938-28310acd0835",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1536254957",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5b91638b-f688-4841-b4d2-28310acd0835",
|
|
"value": "32b8d08e67cf509236ae8142fbeb30b3",
|
|
"Tag": [
|
|
{
|
|
"colour": "#5fb4b2",
|
|
"name": "Stage 1"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1536254957",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b91638b-5d60-4865-9be0-28310acd0835",
|
|
"value": "8c2e729bc086921062e214b7e4c9c4ddf324a0fa53b4ed106f1341cfe8274fe4",
|
|
"Tag": [
|
|
{
|
|
"colour": "#5fb4b2",
|
|
"name": "Stage 1"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1536254957",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5b91638b-250c-4e03-b6f7-28310acd0835",
|
|
"value": "038f75dcf1e5277565c68d57fa1f4f7b3005f3f3",
|
|
"Tag": [
|
|
{
|
|
"colour": "#5fb4b2",
|
|
"name": "Stage 1"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "size-in-bytes",
|
|
"timestamp": "1536254859",
|
|
"to_ids": false,
|
|
"type": "size-in-bytes",
|
|
"uuid": "5b91638b-480c-4627-95ab-28310acd0835",
|
|
"value": "198656"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ssdeep",
|
|
"timestamp": "1536254963",
|
|
"to_ids": true,
|
|
"type": "ssdeep",
|
|
"uuid": "5b91638b-a4dc-450f-9bc6-28310acd0835",
|
|
"value": "3072:y0FPC7QAKohdraoNpLOxx85wzWVTBfGGMZhm05Pb8QOutp:ba7zfragLOxx85JVTBezZXbLOut",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
},
|
|
{
|
|
"colour": "#5fb4b2",
|
|
"name": "Stage 1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1536254859",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b91638b-d750-48ec-aeaa-28310acd0835",
|
|
"value": "Malicious"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "text",
|
|
"timestamp": "1536254905",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b9163b9-43a4-43cc-831b-2eff0acd0835",
|
|
"value": "First stage backdoor"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "13",
|
|
"timestamp": "1536255024",
|
|
"uuid": "5b916430-9e3c-4911-b3e9-ca520acd0835",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1536255053",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5b916430-0124-4a45-bf94-ca520acd0835",
|
|
"value": "efe3518ee7d62299d01b7882f72ffd0a",
|
|
"Tag": [
|
|
{
|
|
"colour": "#5fb4b2",
|
|
"name": "Stage 1"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "text",
|
|
"timestamp": "1536255024",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b916430-f9b4-45ed-b526-ca520acd0835",
|
|
"value": "First stage backdoor"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1536255053",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b916430-4898-4071-b4f5-ca520acd0835",
|
|
"value": "035f97af0def906fbd8f7f15fb8107a9e852a69160669e7c0781888180cd46d5",
|
|
"Tag": [
|
|
{
|
|
"colour": "#5fb4b2",
|
|
"name": "Stage 1"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1536255054",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5b916430-e110-4bc6-8427-ca520acd0835",
|
|
"value": "247b542af23ad9c63697428c7b77348681aadc9a",
|
|
"Tag": [
|
|
{
|
|
"colour": "#5fb4b2",
|
|
"name": "Stage 1"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "size-in-bytes",
|
|
"timestamp": "1536255024",
|
|
"to_ids": false,
|
|
"type": "size-in-bytes",
|
|
"uuid": "5b916430-0fac-4102-a6c2-ca520acd0835",
|
|
"value": "195072"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ssdeep",
|
|
"timestamp": "1536255054",
|
|
"to_ids": true,
|
|
"type": "ssdeep",
|
|
"uuid": "5b916430-0b5c-49c8-b20b-ca520acd0835",
|
|
"value": "3072:hMBIQ8vnQQgZKc1WZL0Az3jGSp0TBfmXnZS1m05xI8QOutt:eBIbPDgZK0yL0Az36e0TBeXZStILOut",
|
|
"Tag": [
|
|
{
|
|
"colour": "#5fb4b2",
|
|
"name": "Stage 1"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1536255024",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b916430-0634-4a60-b821-ca520acd0835",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "13",
|
|
"timestamp": "1536255120",
|
|
"uuid": "5b91647e-fb8c-475d-a647-2eff0acd0835",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1536255177",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5b91647e-5998-450e-b763-2eff0acd0835",
|
|
"value": "e2bd4044fab4214c4aa7dd65d65fca21",
|
|
"Tag": [
|
|
{
|
|
"colour": "#fccc51",
|
|
"name": "Stage 2"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1536255177",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b91647e-172c-4f3e-be5d-2eff0acd0835",
|
|
"value": "af2abf0748013a7084507f8e96f6e7c21a3f962fbbb148dcbb482a98c06940a1",
|
|
"Tag": [
|
|
{
|
|
"colour": "#fccc51",
|
|
"name": "Stage 2"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1536255177",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5b91647e-bb5c-4513-980d-2eff0acd0835",
|
|
"value": "0423672fe9201c325e33f296595fb70dcd81bcd9",
|
|
"Tag": [
|
|
{
|
|
"colour": "#fccc51",
|
|
"name": "Stage 2"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "size-in-bytes",
|
|
"timestamp": "1536255102",
|
|
"to_ids": false,
|
|
"type": "size-in-bytes",
|
|
"uuid": "5b91647e-de40-459d-8828-2eff0acd0835",
|
|
"value": "395776"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ssdeep",
|
|
"timestamp": "1536255177",
|
|
"to_ids": true,
|
|
"type": "ssdeep",
|
|
"uuid": "5b91647e-a5fc-4161-b118-2eff0acd0835",
|
|
"value": "6144:Py7VqCkozgC2uNmz/MbVflIaPhlHvuFFNTP9DZ8EX8kE5KRf+L8uvyvcQ0BiF:Py7V6N/wISZvk7TP9F1X8 hcRe8u6wW",
|
|
"Tag": [
|
|
{
|
|
"colour": "#fccc51",
|
|
"name": "Stage 2"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1536255102",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b91647e-eec4-4749-8e33-2eff0acd0835",
|
|
"value": "Malicious"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "text",
|
|
"timestamp": "1536255120",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b916490-d93c-4284-9455-28330acd0835",
|
|
"value": "Second stage backdoor"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "13",
|
|
"timestamp": "1536255239",
|
|
"uuid": "5b916507-21cc-4a2f-aa8c-28280acd0835",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1536255270",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5b916507-cdc0-4c61-ac3f-28280acd0835",
|
|
"value": "80e7a7789286d3fb69f083f1a2dddbe6",
|
|
"Tag": [
|
|
{
|
|
"colour": "#fccc51",
|
|
"name": "Stage 2"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "text",
|
|
"timestamp": "1536255239",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b916507-2a48-4b4f-9d72-28280acd0835",
|
|
"value": "Second stage backdoor"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1536255270",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b916507-38cc-4434-90f8-28280acd0835",
|
|
"value": "58a50840c04cd15f439f1cc1b684e9f9fa22c0d64f44a391d9e2b1222e5cd6bd",
|
|
"Tag": [
|
|
{
|
|
"colour": "#fccc51",
|
|
"name": "Stage 2"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1536255270",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5b916507-c8a4-4c50-9886-28280acd0835",
|
|
"value": "b4ec4837d07ff64e34947296e73732171d1c1586",
|
|
"Tag": [
|
|
{
|
|
"colour": "#fccc51",
|
|
"name": "Stage 2"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "size-in-bytes",
|
|
"timestamp": "1536255239",
|
|
"to_ids": false,
|
|
"type": "size-in-bytes",
|
|
"uuid": "5b916507-88d0-49cd-b0ba-28280acd0835",
|
|
"value": "396288"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ssdeep",
|
|
"timestamp": "1536255270",
|
|
"to_ids": true,
|
|
"type": "ssdeep",
|
|
"uuid": "5b916507-d174-4cec-85ee-28280acd0835",
|
|
"value": "6144:kSH62LyBiglfDq9wD7aG2HODV9cF7Bt7/hNWhZHhvMKpA7KSgodwIFsA40Bia:kSH6F9DiY9udjNW7BvMKp yKsWI97",
|
|
"Tag": [
|
|
{
|
|
"colour": "#fccc51",
|
|
"name": "Stage 2"
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Backdoor\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1536255239",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b916507-5344-4ccd-bcee-28280acd0835",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "13",
|
|
"timestamp": "1536255324",
|
|
"uuid": "5b91655c-3648-48a0-82e3-2f140acd0835",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1536255355",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5b91655c-25d0-4a8c-80e8-2f140acd0835",
|
|
"value": "99670267cbece5f5cc3ce92efd5bb04b",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Exploit vuln\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "text",
|
|
"timestamp": "1536255324",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b91655c-7730-4639-89de-2f140acd0835",
|
|
"value": "ALPC LPE exploit"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1536255355",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b91655c-21a0-4189-b441-2f140acd0835",
|
|
"value": "97b5b4478d234632df4c65ec251051a6b032ce21e9e68495e31f077bf4074831",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Exploit vuln\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1536255355",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5b91655d-3ee8-42f6-8276-2f140acd0835",
|
|
"value": "9dc173d4d4f74765b5fc1e1c9a2d188d5387beea",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Exploit vuln\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "size-in-bytes",
|
|
"timestamp": "1536255325",
|
|
"to_ids": false,
|
|
"type": "size-in-bytes",
|
|
"uuid": "5b91655d-3714-464e-86f5-2f140acd0835",
|
|
"value": "183296"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ssdeep",
|
|
"timestamp": "1536255355",
|
|
"to_ids": true,
|
|
"type": "ssdeep",
|
|
"uuid": "5b91655d-3c88-4839-90d3-2f140acd0835",
|
|
"value": "3072:STZt5j+T9LjP4JqIBhNV0St7TZEjOYI1TVmqG7rg:q5j+T9LjPPIBhN2Q7TZAfI1TVwg",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00a9ce",
|
|
"name": "veris:action:malware:variety=\"Exploit vuln\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1536255325",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b91655d-d1bc-4241-95c3-2f140acd0835",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |