1392 lines
No EOL
48 KiB
JSON
1392 lines
No EOL
48 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2018-07-24",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Kronos Reborn",
|
|
"publish_timestamp": "1532610869",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1532610824",
|
|
"uuid": "5b597959-6310-43e8-80b2-4d30950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:tool=\"Smoke Loader\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:mitre-enterprise-attack-malware=\"Smoke Loader - S0226\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:banker=\"Kronos\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#002f76",
|
|
"local": false,
|
|
"name": "ms-caro-malware-full:malware-family=\"Banker\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#284800",
|
|
"local": false,
|
|
"name": "malware_classification:malware-category=\"Trojan\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532607653",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b597e9e-b88c-4bc1-8f11-af6a950d210f",
|
|
"value": "The Kronos banking Trojan was first discovered in 2014 and was a steady fixture in the threat landscape for a few years before largely disappearing. Now a new variant has appeared, with at least three distinct campaigns targeting Germany, Japan, and Poland respectively, to date.\r\n\r\nIn April 2018, the first samples of a new variant of the banking Trojan appeared in the wild. The most notable new feature is that the command and control (C&C) mechanism has been refactored to use the Tor anonymizing network. There is some speculation and circumstantial evidence suggesting that this new version of Kronos has been rebranded \u00e2\u20ac\u0153Osiris\u00e2\u20ac\u009d and is being sold on underground markets. In this blog, we present information on the German, Japanese, and Polish campaigns as well as a fourth campaign that looks to be a work in progress and still being tested.",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532607646",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5b597ee4-7370-4258-88b5-b098950d210f",
|
|
"value": "https://www.proofpoint.com/us/threat-insight/post/kronos-reborn",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Mahnung_9415171.doc payload used in German campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608632",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c078-03e4-4a71-a48f-4503950d210f",
|
|
"value": "https://dkb-agbs.com/25062018.exe"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608632",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5b59c078-3b9c-4f25-9aeb-4691950d210f",
|
|
"value": "Mahnung_9415171.doc"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Kronos C&C used in German campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608633",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c079-0180-477e-b041-457e950d210f",
|
|
"value": "http://jhrppbnh4d674kzh.onion/kpanel/connect.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Webinject C&C used in the German campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608633",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c079-cd18-4e05-a267-451f950d210f",
|
|
"value": "https://startupbulawayo.website/d03ohi2e3232/"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Contains malicious redirect to RIG EK used in the Japan campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608634",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c07a-1d28-454c-94ba-4f0f950d210f",
|
|
"value": "http://envirodry.ca"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "RIG EK used in the Japan campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608634",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5b59c07a-8cd8-4b86-ad8e-4635950d210f",
|
|
"value": "5.23.54.158"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SmokeLoader C&C used in the Japan campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608635",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c07b-bb84-4c15-baa0-4135950d210f",
|
|
"value": "http://lionoi.adygeya.su"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SmokeLoader C&C used in the Japan campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608635",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c07b-09f8-4fdd-b9f2-41f3950d210f",
|
|
"value": "http://milliaoin.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "New version of Kronos download link used in the Japan campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608636",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c07c-c7fc-4ea5-9afe-4bd6950d210f",
|
|
"value": "http://fritsy83.website/Osiris.exe"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "New version of Kronos download link used in the Japan campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608636",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c07c-1cc4-453a-8c26-495a950d210f",
|
|
"value": "http://oo00mika84.website/Osiris_jmjp_auto2_noinj.exe"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Kronos C&C used in the Japan campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608637",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c07d-f114-401d-af89-4f4e950d210f",
|
|
"value": "http://jmjp2l7yqgaj5xvv.onion/kpanel/connect.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Webinject C&C used in the Japan campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608637",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c07d-22e0-48c4-8b04-4ec0950d210f",
|
|
"value": "https://kioxixu.abkhazia.su/"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "New version of Kronos download link used in the Poland campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608638",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c07e-f9f4-4770-b1cc-428e950d210f",
|
|
"value": "http://mysit.space/123//v/0jLHzUW"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Kronos C&C used in the Poland campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608638",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c07e-d050-4843-9c9a-4cba950d210f",
|
|
"value": "http://suzfjfguuis326qw.onion/kpanel/connect.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "New version of Kronos download link used in \u00e2\u20ac\u0153Work in progress\u00e2\u20ac\u009d campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608639",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c07f-d42c-469e-846a-4fa3950d210f",
|
|
"value": "http://gameboosts.net/app/Player_v1.02.exe"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Kronos C&C used in \u00e2\u20ac\u0153Work in progress\u00e2\u20ac\u009d campaign",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1532608639",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5b59c07f-732c-4cb6-adb4-4d48950d210f",
|
|
"value": "http://mysmo35wlwhrkeez.onion/kpanel/connect.php"
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "used in German campaign",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532608163",
|
|
"uuid": "5b59bea3-9a30-4e9f-b748-4239950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532608164",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b59bea4-6228-494f-a687-41ad950d210f",
|
|
"value": "bb308bf53944e0c7c74695095169363d1323fe9ce6c6117feda2ee429ebf530d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1532608164",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5b59bea4-0eb0-4510-8f92-47d7950d210f",
|
|
"value": "Mahnung_9415171.doc"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1532608164",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b59bea4-46c0-4bcc-820d-4267950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "New version of Kronos used in German campaign",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532608181",
|
|
"uuid": "5b59beb5-0e9c-4f68-85f4-4a77950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532608181",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b59beb5-61fc-4b37-a468-4c1f950d210f",
|
|
"value": "4af17e81e9badf3d03572e808e0a881f6c61969157052903cd68962b9e084177"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1532608181",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b59beb5-f5d8-43e9-97c1-4c15950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "SmokeLoader used in the Japan campaign",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532608242",
|
|
"uuid": "5b59bef2-cdf8-40b2-8000-4298950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532608242",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b59bef2-b0dc-4e5d-a7bf-43b0950d210f",
|
|
"value": "3cc154a1ea3070d008c9210d31364246889a61b77ed92b733c5bf7f81e774c40"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1532608242",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b59bef2-e064-4c84-87c6-41b2950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "\u00e2\u20ac\u0153Faktura 2018.07.16.doc\u00e2\u20ac\u009d used in the Poland campaign",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532608268",
|
|
"uuid": "5b59bf0c-5950-4f90-9596-43da950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532608268",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b59bf0c-e928-4d7e-8d5b-4657950d210f",
|
|
"value": "045acd6de0321223ff1f1c579c03ea47a6abd32b11d01874d1723b48525c9108"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1532608268",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5b59bf0c-4894-46c1-92a8-4aad950d210f",
|
|
"value": "Faktura 2018.07.16.doc"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1532608268",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b59bf0c-3330-4a62-a40a-4de8950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "New version of Kronos used in the Japan campaign",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532608281",
|
|
"uuid": "5b59bf19-3770-40b1-aa0e-4824950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532608282",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b59bf1a-9ec4-4a7a-a9bc-48c2950d210f",
|
|
"value": "3eb389ea6d4882b0d4a613dba89a04f4c454448ff7a60a282986bdded6750741"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1532608282",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b59bf1a-4274-4c9d-b5be-4fde950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "New version of Kronos used in the Poland campaign",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532608305",
|
|
"uuid": "5b59bf31-2514-482c-9f84-4a20950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532608305",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b59bf31-46f4-458f-aec6-4642950d210f",
|
|
"value": "e7d3181ef643d77bb33fe328d1ea58f512b4f27c8e6ed71935a2e7548f2facc0"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1532608306",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b59bf32-7ab4-4c5b-aa08-4d15950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "New version of Kronos used in \u00e2\u20ac\u0153Work in progress\u00e2\u20ac\u009d campaign",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532608327",
|
|
"uuid": "5b59bf47-4fc4-44cc-b7bc-4967950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532608327",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b59bf47-1098-4772-95e8-4402950d210f",
|
|
"value": "93590cb4e88a5f779c5b062c9ade75f9a5239cd11b3deafb749346620c5e1218"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1532608328",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b59bf48-5b2c-4605-b353-4660950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532609495",
|
|
"uuid": "5b59c3d7-c760-41e4-9afd-40b7950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1532609495",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5b59c3d7-6d8c-4a6b-b3fb-488d950d210f",
|
|
"value": "agb_9415166.doc"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1532609495",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b59c3d7-bac4-4ead-9330-4570950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532609513",
|
|
"uuid": "5b59c3e9-d500-4e86-9f7f-45f3950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1532609513",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5b59c3e9-7368-4c06-b828-47b7950d210f",
|
|
"value": "Mahnung_9415167.doc"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1532609513",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b59c3e9-6340-4382-b830-4fbf950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532610799",
|
|
"uuid": "716245aa-e298-4be6-a638-f2073e0af588",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "716245aa-e298-4be6-a638-f2073e0af588",
|
|
"referenced_uuid": "e3d7369a-27c2-41f0-96fc-d35aaa499890",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1532610813",
|
|
"uuid": "5b59c8fd-b71c-487a-aa0d-4e7e02de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1532610797",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "ad219d45-8654-4557-895a-4d10d491a768",
|
|
"value": "0248465d9edd866d7d8929af1f9685b4"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1532610797",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "a4148bc1-1ffe-43ae-80ad-5f00455dc211",
|
|
"value": "00135cbca3057dced3f9b6305a5645b92ba4cc0f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532610798",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "4a41ec9c-a63b-4017-adf8-c48567c7f153",
|
|
"value": "3cc154a1ea3070d008c9210d31364246889a61b77ed92b733c5bf7f81e774c40"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1532610798",
|
|
"uuid": "e3d7369a-27c2-41f0-96fc-d35aaa499890",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1532610798",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "51255631-b21f-4261-ada2-7ca685b3ed85",
|
|
"value": "2018-07-26T00:33:17"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1532610798",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "680b979e-19fc-4a05-b706-c9031fc50a65",
|
|
"value": "https://www.virustotal.com/file/3cc154a1ea3070d008c9210d31364246889a61b77ed92b733c5bf7f81e774c40/analysis/1532565197/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1532610799",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "ade9ad59-02f1-438b-87c2-7d19be304bb6",
|
|
"value": "51/67"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532610802",
|
|
"uuid": "a2a94c03-111d-4ec9-a615-dfff35bc1a0d",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "a2a94c03-111d-4ec9-a615-dfff35bc1a0d",
|
|
"referenced_uuid": "823ec556-3163-4a3f-b1c2-a15ba60baee8",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1532610813",
|
|
"uuid": "5b59c8fd-d838-4519-be7c-4bb902de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1532610799",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "4a075bd2-2926-4f66-86c1-d50849b8fa4a",
|
|
"value": "a301ee7f1cdb9b1f71deda6c29bb0a32"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1532610799",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "b9608c81-e161-4e2c-98ed-3883f4727b1c",
|
|
"value": "8d6bc587e3abfcfd6b4a771c85a8af90f528d2c7"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532610800",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "b86c3938-da74-4f34-8aa7-5c3731907b08",
|
|
"value": "3eb389ea6d4882b0d4a613dba89a04f4c454448ff7a60a282986bdded6750741"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1532610800",
|
|
"uuid": "823ec556-3163-4a3f-b1c2-a15ba60baee8",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1532610800",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "f224913c-b4e7-49e3-9834-f4faac6a3c75",
|
|
"value": "2018-07-26T00:37:33"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1532610801",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "4fa5dab3-b72e-4426-bea1-fb759d9aa71f",
|
|
"value": "https://www.virustotal.com/file/3eb389ea6d4882b0d4a613dba89a04f4c454448ff7a60a282986bdded6750741/analysis/1532565453/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1532610801",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "b5e75892-ebc1-4a65-aa68-601fc9df3dcc",
|
|
"value": "48/67"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532610804",
|
|
"uuid": "fb02d0e7-a2f6-4398-8968-619c6a329054",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "fb02d0e7-a2f6-4398-8968-619c6a329054",
|
|
"referenced_uuid": "5b3ad0ca-d0ae-4326-9bc1-889ddbafc549",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1532610813",
|
|
"uuid": "5b59c8fd-e6c0-40a1-884d-4fb002de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1532610801",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "716c234e-7515-4eca-88d8-24004b9c38c8",
|
|
"value": "b2ddd1a228db47234dad1fb164573d82"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1532610802",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "2bf4569e-25c2-4c0d-bdb5-2a82c540c5a1",
|
|
"value": "7fd8631ab719eca44457630014674a95bc431b91"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532610802",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "6c432963-e271-41b0-a77e-74be35101ba3",
|
|
"value": "bb308bf53944e0c7c74695095169363d1323fe9ce6c6117feda2ee429ebf530d"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1532610802",
|
|
"uuid": "5b3ad0ca-d0ae-4326-9bc1-889ddbafc549",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1532610802",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "dff34f97-1b1d-491b-865e-64884359e723",
|
|
"value": "2018-07-26T01:29:15"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1532610803",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "3d44fe98-1dac-4ea3-b4d9-cd70307f0786",
|
|
"value": "https://www.virustotal.com/file/bb308bf53944e0c7c74695095169363d1323fe9ce6c6117feda2ee429ebf530d/analysis/1532568555/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1532610803",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "202c5da7-96a7-42b0-a002-f403095b9dcb",
|
|
"value": "35/60"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532610806",
|
|
"uuid": "e935fea1-ffe1-40eb-ba18-16cc432874f8",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "e935fea1-ffe1-40eb-ba18-16cc432874f8",
|
|
"referenced_uuid": "df90c284-e467-445b-a51e-7837ec98db7a",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1532610813",
|
|
"uuid": "5b59c8fd-caa0-4a88-95ca-48ad02de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1532610803",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "1553c165-9c72-492d-b7db-de4aa08b3348",
|
|
"value": "d475c84d99c2bf461c294d75769b7707"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1532610804",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "a7f84f82-1482-462d-949c-a83d26a4dbb6",
|
|
"value": "aecaf84953641d835e7c754f559fc555169d8aec"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532610804",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "80147a37-5a84-47e6-8492-b784d4284254",
|
|
"value": "045acd6de0321223ff1f1c579c03ea47a6abd32b11d01874d1723b48525c9108"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1532610805",
|
|
"uuid": "df90c284-e467-445b-a51e-7837ec98db7a",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1532610805",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "5678e189-dcf2-4434-8f88-9313120fd768",
|
|
"value": "2018-07-26T00:38:31"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1532610805",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "b3f70f28-c3cd-41ef-88f6-36ce3cebe80c",
|
|
"value": "https://www.virustotal.com/file/045acd6de0321223ff1f1c579c03ea47a6abd32b11d01874d1723b48525c9108/analysis/1532565511/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1532610806",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "77caf24b-6b28-4ed6-8d35-e773b7793f1d",
|
|
"value": "35/60"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532610809",
|
|
"uuid": "2238785f-23bd-467b-b588-484fba9e78f9",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "2238785f-23bd-467b-b588-484fba9e78f9",
|
|
"referenced_uuid": "812d0386-43e0-4813-ac94-b8248cb565d5",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1532610813",
|
|
"uuid": "5b59c8fd-ff70-46e4-9d68-428202de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1532610806",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "3a867626-95c2-4472-9d9f-fb9e9c89f1b1",
|
|
"value": "5e6764534b3a1e4d3abacc4810b6985d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1532610806",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "1c13576c-d17c-49e9-bb23-df67ad74502d",
|
|
"value": "f10ad287f126f577f197070453812a7e88c2cc52"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532610807",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "0bedcdb0-9f36-4c5c-86ec-511c1f93fcc3",
|
|
"value": "e7d3181ef643d77bb33fe328d1ea58f512b4f27c8e6ed71935a2e7548f2facc0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1532610807",
|
|
"uuid": "812d0386-43e0-4813-ac94-b8248cb565d5",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1532610807",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "b1d7c0e1-f10b-43cb-ace4-1ce0276e6da5",
|
|
"value": "2018-07-26T09:13:49"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1532610808",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "63646768-523d-40d4-8ce0-4c25dd4bd7b6",
|
|
"value": "https://www.virustotal.com/file/e7d3181ef643d77bb33fe328d1ea58f512b4f27c8e6ed71935a2e7548f2facc0/analysis/1532596429/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1532610808",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "69d98df9-22d5-4184-bec4-65ab26cb4def",
|
|
"value": "46/66"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532610811",
|
|
"uuid": "dccb7ee7-e104-44bf-8971-0e90e34d244d",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "dccb7ee7-e104-44bf-8971-0e90e34d244d",
|
|
"referenced_uuid": "8b19e923-dfa2-4dab-80ee-5a291ebe7b30",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1532610813",
|
|
"uuid": "5b59c8fd-0fbc-474b-82af-469e02de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1532610808",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "8a658f91-dca2-47f6-b79a-592786348d8f",
|
|
"value": "820d3fb49af10fa714c4bdd5745d865b"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1532610809",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "ecab4478-9930-4df2-89dd-b35d488f91d7",
|
|
"value": "49b42b7ed9c3db0b1a4d45e37e4a6bc2b8079ff6"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532610809",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "d25d26ab-aafe-44a0-8722-64c8ffe15e70",
|
|
"value": "93590cb4e88a5f779c5b062c9ade75f9a5239cd11b3deafb749346620c5e1218"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1532610810",
|
|
"uuid": "8b19e923-dfa2-4dab-80ee-5a291ebe7b30",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1532610810",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "5fa195bf-7dd4-44d9-afe7-37503dd49378",
|
|
"value": "2018-07-26T10:11:06"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1532610810",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "2f69c414-6dbe-4eed-90b1-2737b06676eb",
|
|
"value": "https://www.virustotal.com/file/93590cb4e88a5f779c5b062c9ade75f9a5239cd11b3deafb749346620c5e1218/analysis/1532599866/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1532610811",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "702d3ac7-5146-4cc5-a11a-a4341696d973",
|
|
"value": "29/67"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1532610814",
|
|
"uuid": "02c92c9e-6ed0-4a26-8913-4cb0b61c6eb1",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "02c92c9e-6ed0-4a26-8913-4cb0b61c6eb1",
|
|
"referenced_uuid": "8c660602-2e65-4d92-82c1-9a70525e6c19",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1532610813",
|
|
"uuid": "5b59c8fd-f0fc-4dec-9d62-4b3102de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1532610811",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "dfbd1666-79c1-4524-8082-5567ea99ebac",
|
|
"value": "17903c3d83125a5fc3e3f77d8a775bfe"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1532610811",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "68c72bab-9173-4216-a50d-c5db0a8e4a6f",
|
|
"value": "91da487143d931e00e935245e698ea2a582871e4"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1532610812",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "721a08f6-cb2a-4071-9c65-18b153d987ac",
|
|
"value": "4af17e81e9badf3d03572e808e0a881f6c61969157052903cd68962b9e084177"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1532610812",
|
|
"uuid": "8c660602-2e65-4d92-82c1-9a70525e6c19",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1532610812",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "34bd7968-4830-4d15-8875-ddd51c4c740f",
|
|
"value": "2018-07-26T07:37:11"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1532610813",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "fcaa4c90-8b64-40b0-89ec-57b498f2aa8b",
|
|
"value": "https://www.virustotal.com/file/4af17e81e9badf3d03572e808e0a881f6c61969157052903cd68962b9e084177/analysis/1532590631/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1532610813",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "f3ebb8a4-7d00-49ad-ae82-0d93cb2fd3e9",
|
|
"value": "41/66"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |