Skip to content
Permalink
master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Malware-Misc-RE/2019-03-08-AVE_MARIA-Signed-Chain-IOCs.vk.csv

Go to file
 
 
Cannot retrieve contributors at this time
27 lines (26 sloc) 9.36 KB
Raw Blame
Open in GitHub Desktop
uuid event_id category type value comment to_ids date object_relation attribute_tag object_uuid object_name object_meta_category event_info event_member_org event_source_org event_distribution event_threat_level_id event_analysis event_date event_tag event_timestamp
5c8348e0-89e4-4fc5-97f9-471368f8e8cf 256 Network activity url http://5.206.225.104/ C2 1 1552107744 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c834931-962c-4676-8d9d-474468f8e8cf 256 Payload delivery malware-sample 2019-03-08-AVE_MARIA-first-stage-loader.vk.exe|4de3799ad08d28ca8d0cd0cab0e7b8bf 1 1552107825 malware-sample 5c834931-7838-46e5-a1b4-474468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c834931-37a8-4a17-939c-474468f8e8cf 256 Payload delivery filename 2019-03-08-AVE_MARIA-first-stage-loader.vk.exe 0 1552107825 filename 5c834931-7838-46e5-a1b4-474468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c834931-0b50-4e07-bfa7-474468f8e8cf 256 Payload delivery md5 4de3799ad08d28ca8d0cd0cab0e7b8bf 1 1552107825 md5 5c834931-7838-46e5-a1b4-474468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c834931-386c-402f-9ea6-474468f8e8cf 256 Payload delivery sha1 c2042f6f16844bd002804d12f46586706fc1a4db 1 1552107825 sha1 5c834931-7838-46e5-a1b4-474468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c834931-e75c-4584-ab31-474468f8e8cf 256 Payload delivery sha256 7946969ab6f4c68dd01bc047e65f7b64d364535a3a6697ef62a0b9566d6de874 1 1552107825 sha256 5c834931-7838-46e5-a1b4-474468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c834931-9880-46b3-b858-474468f8e8cf 256 Other size-in-bytes 100352 0 1552107825 size-in-bytes 5c834931-7838-46e5-a1b4-474468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c83494c-1f88-491f-9b64-1b9e68f8e8cf 256 Payload delivery malware-sample 2019-03-08-AVE_MARIA-packed-first-stage-loader.vk.exe|b97f4c88356b672e0936abac7f01f858 1 1552107852 malware-sample 5c83494c-5268-400e-be48-1b9e68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c83494c-a354-4403-90a0-1b9e68f8e8cf 256 Payload delivery filename 2019-03-08-AVE_MARIA-packed-first-stage-loader.vk.exe 0 1552107852 filename 5c83494c-5268-400e-be48-1b9e68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c83494c-3fe8-4d97-8520-1b9e68f8e8cf 256 Payload delivery md5 b97f4c88356b672e0936abac7f01f858 1 1552107852 md5 5c83494c-5268-400e-be48-1b9e68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c83494c-cf34-457f-9f63-1b9e68f8e8cf 256 Payload delivery sha1 02bd7605d4578180bfd2eb1959aef6c3900faa8d 1 1552107852 sha1 5c83494c-5268-400e-be48-1b9e68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c83494c-f24c-415b-9585-1b9e68f8e8cf 256 Payload delivery sha256 1a0885ba3879a7038c1fc991dd71e155a8d1cd997e80c09835b3f49f90c90740 1 1552107852 sha256 5c83494c-5268-400e-be48-1b9e68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c83494c-5d84-4636-bd11-1b9e68f8e8cf 256 Other size-in-bytes 436992 0 1552107852 size-in-bytes 5c83494c-5268-400e-be48-1b9e68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349ae-31bc-4f87-94e9-1b9f68f8e8cf 256 Payload delivery malware-sample 2019-03-08-AVE_MARIA-elevation-util.vk.exe|ad9fd1564dd1c6be54747e84444b8f55 1 1552107950 malware-sample 5c8349ae-3cc4-4fc3-afeb-1b9f68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349ae-77d0-4497-93ff-1b9f68f8e8cf 256 Payload delivery filename 2019-03-08-AVE_MARIA-elevation-util.vk.exe 0 1552107950 filename 5c8349ae-3cc4-4fc3-afeb-1b9f68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349ae-d6ac-4e48-9185-1b9f68f8e8cf 256 Payload delivery md5 ad9fd1564dd1c6be54747e84444b8f55 1 1552107950 md5 5c8349ae-3cc4-4fc3-afeb-1b9f68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349ae-8a4c-41b3-a745-1b9f68f8e8cf 256 Payload delivery sha1 001495af4af443265200340a08b5e07dc2a32553 1 1552107950 sha1 5c8349ae-3cc4-4fc3-afeb-1b9f68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349ae-b598-4878-8ef8-1b9f68f8e8cf 256 Payload delivery sha256 021d01fe3793879f57a2942664fc7c096710e94e87ad13dc21467c12edf61546 1 1552107950 sha256 5c8349ae-3cc4-4fc3-afeb-1b9f68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349ae-d464-477d-9130-1b9f68f8e8cf 256 Other size-in-bytes 11264 0 1552107950 size-in-bytes 5c8349ae-3cc4-4fc3-afeb-1b9f68f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349c2-d1cc-4f28-943f-328468f8e8cf 256 Payload delivery malware-sample 2019-03-08-AVE_MARIA-query-util.vk.exe|6b906764a35508a7fd266cdd512e46b1 1 1552107970 malware-sample 5c8349c2-be5c-42d6-8248-328468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349c2-286c-41e2-8a5f-328468f8e8cf 256 Payload delivery filename 2019-03-08-AVE_MARIA-query-util.vk.exe 0 1552107970 filename 5c8349c2-be5c-42d6-8248-328468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349c2-2e78-4e6a-943f-328468f8e8cf 256 Payload delivery md5 6b906764a35508a7fd266cdd512e46b1 1 1552107970 md5 5c8349c2-be5c-42d6-8248-328468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349c2-7624-4fab-b92d-328468f8e8cf 256 Payload delivery sha1 2a943b5868de4facf52d4f4c1b63f83eacd882a2 1 1552107970 sha1 5c8349c2-be5c-42d6-8248-328468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349c2-483c-4d6f-9b69-328468f8e8cf 256 Payload delivery sha256 fc0c90044b94b080f307c16494369a0796ac1d4e74e7912ba79c15cca241801c 1 1552107970 sha256 5c8349c2-be5c-42d6-8248-328468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970
5c8349c2-a6b4-4de8-b961-328468f8e8cf 256 Other size-in-bytes 4608 0 1552107970 size-in-bytes 5c8349c2-be5c-42d6-8248-328468f8e8cf file file 2019-03-08: AVE_MARIA Signed Execution VK-Intel VK-Intel 1 Medium 0 2019-03-09 Malware: AVE_MARIA,UAC Util, Query Util,Digital Signature,JDS Invest Ltd 1552107970