Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
730 lines (730 sloc) 27 KB
{
"Event": {
"orgc_id": "2",
"ShadowAttribute": [],
"id": "10",
"threat_level_id": "1",
"event_creator_email": "tomori.nao.sec@gmail.com",
"uuid": "5a34bc94-1eb8-4213-9ab8-34dbc0a8010a",
"Object": [],
"Orgc": {
"id": "2",
"name": "nao_sec",
"uuid": "59ce3f5b-dde4-4b8d-b08c-5285c0a83832"
},
"Org": {
"id": "2",
"name": "nao_sec",
"uuid": "59ce3f5b-dde4-4b8d-b08c-5285c0a83832"
},
"RelatedEvent": [
{
"Event": {
"orgc_id": "2",
"info": "Seamless-Ramnit",
"uuid": "5a27e451-ab8c-42ed-8205-473cc0a8010a",
"timestamp": "1515823460",
"org_id": "2",
"Orgc": {
"id": "2",
"name": "nao_sec",
"uuid": "59ce3f5b-dde4-4b8d-b08c-5285c0a83832"
},
"analysis": "2",
"published": false,
"date": "2017-12-05",
"Org": {
"id": "2",
"name": "nao_sec",
"uuid": "59ce3f5b-dde4-4b8d-b08c-5285c0a83832"
},
"distribution": "3",
"id": "9",
"threat_level_id": "1"
}
}
],
"sharing_group_id": "0",
"timestamp": "1513448007",
"date": "2017-12-05",
"disable_correlation": false,
"info": "Seamless-Ramnit>AZORult",
"locked": false,
"publish_timestamp": "0",
"Attribute": [
{
"comment": "",
"category": "External analysis",
"event_id": "10",
"uuid": "5a34bca8-9f6c-4aaf-a2af-34e6c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513405608",
"to_ids": false,
"object_id": "0",
"id": "375",
"deleted": false,
"ShadowAttribute": [],
"value": "https://www.hybrid-analysis.com/sample/37b66f9117a2140fa11badad967c09142860d04af9a3564bfe58527d7d7e9270",
"disable_correlation": false,
"object_relation": null,
"type": "link",
"distribution": "3"
},
{
"comment": "AZORult",
"category": "Payload delivery",
"event_id": "10",
"uuid": "5a34bced-5090-4448-996b-34d3c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513405677",
"to_ids": false,
"object_id": "0",
"id": "376",
"deleted": false,
"ShadowAttribute": [],
"value": "37b66f9117a2140fa11badad967c09142860d04af9a3564bfe58527d7d7e9270",
"disable_correlation": false,
"object_relation": null,
"type": "sha256",
"distribution": "3"
},
{
"comment": "",
"category": "Network activity",
"event_id": "10",
"uuid": "5a3550d2-77e8-4da9-a464-34d3c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513443580",
"to_ids": false,
"object_id": "0",
"id": "377",
"deleted": false,
"ShadowAttribute": [],
"value": "babiruska.com|47.74.188.207",
"disable_correlation": false,
"object_relation": null,
"type": "domain|ip",
"distribution": "3"
},
{
"comment": "",
"category": "Network activity",
"event_id": "10",
"uuid": "5a3550e1-a70c-4187-b03e-34d7c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513443553",
"to_ids": false,
"object_id": "0",
"id": "378",
"deleted": false,
"ShadowAttribute": [],
"value": "/gate.php",
"disable_correlation": false,
"object_relation": null,
"type": "url",
"distribution": "3"
},
{
"comment": "Runs shell commands",
"category": "Other",
"event_id": "10",
"uuid": "5a35516a-c3b4-4ceb-9982-34d7c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513443690",
"to_ids": false,
"object_id": "0",
"id": "379",
"deleted": false,
"ShadowAttribute": [],
"value": "/c timeout 1 & del \"{filename}\"",
"disable_correlation": false,
"object_relation": null,
"type": "other",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a3551d1-e078-46a8-a024-34dac0a8010a",
"sharing_group_id": "0",
"timestamp": "1513443793",
"to_ids": false,
"object_id": "0",
"id": "380",
"deleted": false,
"ShadowAttribute": [],
"value": "{3CCD5499-87A8-4B10-A215-608888DD3B55}",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a3551e9-0ad4-4da0-b681-34d4c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513443817",
"to_ids": false,
"object_id": "0",
"id": "381",
"deleted": false,
"ShadowAttribute": [],
"value": "{4BF4C442-9B8A-41A0-B380-DD4A704DDB28}",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355204-2100-41ee-9ee8-34d3c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513443844",
"to_ids": false,
"object_id": "0",
"id": "382",
"deleted": false,
"ShadowAttribute": [],
"value": "NSS_Init",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a35521d-d584-4d3b-ba24-34d7c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513443869",
"to_ids": false,
"object_id": "0",
"id": "383",
"deleted": false,
"ShadowAttribute": [],
"value": "NSS_Shutdown",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a3552ed-4b34-4464-9eaa-34dac0a8010a",
"sharing_group_id": "0",
"timestamp": "1513444077",
"to_ids": false,
"object_id": "0",
"id": "384",
"deleted": false,
"ShadowAttribute": [],
"value": "PK11_GetInternalKeySlot",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355305-b210-4cae-9290-34e6c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513444101",
"to_ids": false,
"object_id": "0",
"id": "385",
"deleted": false,
"ShadowAttribute": [],
"value": "PK11SDR_Decrypt",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355329-e820-4c9b-a2ae-34d4c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513444137",
"to_ids": false,
"object_id": "0",
"id": "386",
"deleted": false,
"ShadowAttribute": [],
"value": "PK11_FreeSlot",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355355-daf8-44cd-bf91-34dbc0a8010a",
"sharing_group_id": "0",
"timestamp": "1513444181",
"to_ids": false,
"object_id": "0",
"id": "387",
"deleted": false,
"ShadowAttribute": [],
"value": "PK11_Authenticate",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a3558f2-8e1c-4249-8b6e-39d2c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513445618",
"to_ids": false,
"object_id": "0",
"id": "388",
"deleted": false,
"ShadowAttribute": [],
"value": ".keys",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355907-42a8-44fc-b207-39d3c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513445639",
"to_ids": false,
"object_id": "0",
"id": "389",
"deleted": false,
"ShadowAttribute": [],
"value": "\\wallet.dat",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355920-3db8-4203-9212-34d7c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513445664",
"to_ids": false,
"object_id": "0",
"id": "390",
"deleted": false,
"ShadowAttribute": [],
"value": "\\mbhd.yaml",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355934-cc28-4c6e-8290-34dbc0a8010a",
"sharing_group_id": "0",
"timestamp": "1513445684",
"to_ids": false,
"object_id": "0",
"id": "391",
"deleted": false,
"ShadowAttribute": [],
"value": "wallet.dat",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355958-a65c-4c74-b5ee-34e6c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513445720",
"to_ids": false,
"object_id": "0",
"id": "392",
"deleted": false,
"ShadowAttribute": [],
"value": "Software\\monero-project\\monero-core",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355976-5ad8-4da4-b991-34d4c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513445750",
"to_ids": false,
"object_id": "0",
"id": "393",
"deleted": false,
"ShadowAttribute": [],
"value": ".wallet",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a35598d-99c0-4171-8bcd-34dac0a8010a",
"sharing_group_id": "0",
"timestamp": "1513445773",
"to_ids": false,
"object_id": "0",
"id": "394",
"deleted": false,
"ShadowAttribute": [],
"value": "\\.wallet",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355a05-6218-435e-8ec9-39d1c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513445893",
"to_ids": false,
"object_id": "0",
"id": "395",
"deleted": false,
"ShadowAttribute": [],
"value": "\\mbhd.wallet.aes",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355a18-abec-48bc-b11f-39d2c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513445912",
"to_ids": false,
"object_id": "0",
"id": "396",
"deleted": false,
"ShadowAttribute": [],
"value": "electrum.dat",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355a62-e84c-40d2-8535-39d3c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513445986",
"to_ids": false,
"object_id": "0",
"id": "397",
"deleted": false,
"ShadowAttribute": [],
"value": "\\mbhd.checkpoints",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355a76-5a30-439b-86fd-39d4c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513446006",
"to_ids": false,
"object_id": "0",
"id": "398",
"deleted": false,
"ShadowAttribute": [],
"value": "\\mbhd.spvchain",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355a95-5f80-4780-a1b2-34d7c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513446037",
"to_ids": false,
"object_id": "0",
"id": "399",
"deleted": false,
"ShadowAttribute": [],
"value": "wallet_path",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355ef2-1844-493c-a2ee-34e6c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513447154",
"to_ids": false,
"object_id": "0",
"id": "400",
"deleted": false,
"ShadowAttribute": [],
"value": "mbhd.checkpoints",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355f2d-6ff4-4432-8185-34d3c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513447213",
"to_ids": false,
"object_id": "0",
"id": "401",
"deleted": false,
"ShadowAttribute": [],
"value": "%APPDATA%\\\\MultiBitHD",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355f47-1854-4008-8bae-39d1c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513447239",
"to_ids": false,
"object_id": "0",
"id": "402",
"deleted": false,
"ShadowAttribute": [],
"value": "mbhd.yaml",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355f7e-7f38-4f2c-a006-39d3c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513447294",
"to_ids": false,
"object_id": "0",
"id": "403",
"deleted": false,
"ShadowAttribute": [],
"value": "Software\\Bitcoin\\Bitcoin-Qt",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355f8d-a9e8-4c82-807a-39d4c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513447309",
"to_ids": false,
"object_id": "0",
"id": "404",
"deleted": false,
"ShadowAttribute": [],
"value": "mbhd.wallet.aes",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355fb5-26f4-46be-8326-34d7c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513447349",
"to_ids": false,
"object_id": "0",
"id": "405",
"deleted": false,
"ShadowAttribute": [],
"value": "\\BitcoinBitcoinQT\\wallet.dat",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355fd8-02b0-4936-83b9-34dbc0a8010a",
"sharing_group_id": "0",
"timestamp": "1513447384",
"to_ids": false,
"object_id": "0",
"id": "406",
"deleted": false,
"ShadowAttribute": [],
"value": ".address.txt",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a355fea-71b4-4c5d-869b-34e6c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513447402",
"to_ids": false,
"object_id": "0",
"id": "407",
"deleted": false,
"ShadowAttribute": [],
"value": "strDataDir",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a3561fb-c9fc-41df-b942-34dac0a8010a",
"sharing_group_id": "0",
"timestamp": "1513447931",
"to_ids": false,
"object_id": "0",
"id": "408",
"deleted": false,
"ShadowAttribute": [],
"value": "\\electrum.dat",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a35621b-efb0-444b-910a-34d3c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513447963",
"to_ids": false,
"object_id": "0",
"id": "409",
"deleted": false,
"ShadowAttribute": [],
"value": "\\MultiBitHD\\",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a35622e-6cfc-40f4-8370-39d1c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513447982",
"to_ids": false,
"object_id": "0",
"id": "410",
"deleted": false,
"ShadowAttribute": [],
"value": "\\Monero\\",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
},
{
"comment": "",
"category": "Artifacts dropped",
"event_id": "10",
"uuid": "5a356247-ea00-4245-a208-39d2c0a8010a",
"sharing_group_id": "0",
"timestamp": "1513448007",
"to_ids": false,
"object_id": "0",
"id": "411",
"deleted": false,
"ShadowAttribute": [],
"value": "mbhd.spvchain",
"disable_correlation": false,
"object_relation": null,
"type": "pattern-in-memory",
"distribution": "3"
}
],
"attribute_count": "37",
"org_id": "2",
"analysis": "2",
"published": false,
"distribution": "3",
"proposal_email_lock": false,
"Galaxy": []
}
}