{ "Event": { "analysis": "0", "date": "2022-06-03", "extends_uuid": "", "info": "MAR-10382254.r1.v1: XMRIG Cryptominer", "publish_timestamp": "1656531363", "published": true, "threat_level_id": "4", "timestamp": "1656531356", "uuid": "21db8eec-8797-439d-94c1-4de8a6dac7e2", "Orgc": { "name": "CUDESO", "uuid": "56c42374-fdb8-4544-a218-41ffc0a8ab16" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": "" } ], "Attribute": [ { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1656527445", "to_ids": true, "type": "yara", "uuid": "e0350984-7749-437d-9fce-c9138975ae29", "value": "rule CISA_10382580_03 : loader\n{\n\tmeta:\n\t\tAuthor = \"CISA Code & Media Analysis\"\n\t\tIncident = \"10382580\"\n\t\tDate = \"2022-05-02\"\n\t\tLast_Modified = \"20220602_1200\"\n\t\tActor = \"n/a\"\n\t\tCategory = \"Loader\"\n\t\tFamily = \"n/a\"\n\t\tDescription = \"Detects loader samples\"\n\t\tMD5_1 = \"3764a0f1762a294f662f3bf86bac776f\"\n\t\tSHA256_1 = \"f7f7b059b6a7dbd75b30b685b148025a0d4ceceab405e553ca28cacdeae43fab\"\n\t\tMD5_2 = \"21fa1a043460c14709ef425ce24da4fd\"\n\t\tSHA256_2 = \"66966ceae7e3a8aace6c27183067d861f9d7267aed30473a95168c3fe19f2c16\"\n\t\tMD5_3 = \"e9c2b8bd1583baf3493824bf7b3ec51e\"\n\t\tSHA256_3 = \"7ea294d30903c0ab690bc02b64b20af0cfe66a168d4622e55dee4d6233783751\"\n\t\tMD5_4 = \"de0d57bdc10fee1e1e16e225788bb8de\"\n\t\tSHA256_4 = \"33b89b8915aaa59a3c9db23343e8c249b2db260b9b10e88593b6ff2fb5f71d2b\"\n\t\tMD5_5 = \"9b071311ecd1a72bfd715e34dbd1bd77\"\n\t\tSHA256_5 = \"3c2c835042a05f8d974d9b35b994bcf8d5a0ce19128ebb362804c2d0f3eb42c0\"\n\t\tMD5_6 = \"05d38bc82d362dd57190e3cb397f807d\"\n\t\tSHA256_6 = \"4cd7efdb1a7ac8c4387c515a7b1925931beb212b95c4f9d8b716dbe18f54624f\"\n\tstrings:\n\t\t$s0 = { B8 01 00 00 00 48 6B C0 00 C6 44 04 20 A8 B8 01 }\n\t\t$s1 = { 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 }\n\t\t$s2 = { 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 }\n\t\t$s3 = { C0 03 C6 44 04 20 9B B8 01 00 00 00 48 6B C0 }\n\tcondition:\n\t\tall of them\n}" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1656527445", "to_ids": true, "type": "yara", "uuid": "3244704d-6095-4bb6-9783-6170248c2922", "value": "rule CISA_10382580_01 : rat\n{\n\tmeta:\n\t\tAuthor = \"CISA Code & Media Analysis\"\n\t\tIncident = \"10382580\"\n\t\tDate = \"2022-05-25\"\n\t\tLast_Modified = \"20220602_1200\"\n\t\tActor = \"n/a\"\n\t\tCategory = \"Remote Access Tool\"\n\t\tFamily = \"n/a\"\n\t\tDescription = \"Detects Remote Access Tool samples\"\n\t\tMD5_1 = \"199a32712998c6d736a05b2dbd24a761\"\n\t\tSHA256_1 = \"88a5e4b24747648a4e3f0a2d5282b51683260f9208b06788fc858c44559da1e8\"\n\tstrings:\n\t\t$s0 = { 0F B6 40 0F 6B C8 47 41 0F B6 40 0B 02 D1 6B C8 }\n\t\t$s1 = { 35 41 0F B6 00 41 88 58 01 41 88 78 02 41 88 70 }\n\t\t$s2 = { 66 83 F8 1E }\n\t\t$s3 = { 66 83 F8 52 }\n\tcondition:\n\t\tall of them\n}" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1656527445", "to_ids": false, "type": "attachment", "uuid": "676e607a-d1d8-466c-9db3-1a326b6af955", "value": "Figure 1" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1656527445", "to_ids": false, "type": "attachment", "uuid": "f7c21f37-a573-455a-9007-057b6cfd3427", "value": "Figure 2" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1656527445", "to_ids": false, "type": "attachment", "uuid": "6cc7e180-0c83-4563-b0d5-2b17c48f6728", "value": "Figure 3" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1656527445", "to_ids": false, "type": "port", "uuid": "6155bbb4-940d-4b16-a356-ad48e60ac2b4", "value": "443" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1656527445", "to_ids": true, "type": "ip-dst", "uuid": "33e06228-b22d-4adc-b9a0-8523b6106253", "value": "192.95.20.8" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1656531356", "to_ids": false, "type": "link", "uuid": "64b18bde-ba2f-4bc6-aae8-be7214f8845e", "value": "https://www.cisa.gov/uscert/ncas/alerts/aa22-174a" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "timestamp": "1656527445", "uuid": "c0a210da-3014-4785-b23f-83a8e3124f69", "ObjectReference": [ { "comment": "", "object_uuid": "c0a210da-3014-4785-b23f-83a8e3124f69", "referenced_uuid": "e0350984-7749-437d-9fce-c9138975ae29", "relationship_type": "detected-with", "timestamp": "1656527445", "uuid": "10928494-3128-4921-bed0-066b4e52d294" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "72a13ddf-d226-4c66-9115-150f6fc99f6a", "value": "df81145680b4deab198d9bba091d86e9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1656527445", "to_ids": true, "type": "sha1", "uuid": "2716be86-4f55-41bb-838e-4e3f75b0f6a2", "value": "4235d9a934d26ec688c21e3fc2e470178b7b3c21" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1656527445", "to_ids": true, "type": "sha256", "uuid": "6cf61919-76e9-4590-a1ed-f1ad5a1137b4", "value": "6589a687e69a182e075f11805a755ac1fabbddae1636c6fea8e80e7414521349" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "timestamp": "1656527445", "uuid": "799d199b-ba4b-4c65-87ad-9b5fd073d9ee", "ObjectReference": [ { "comment": "", "object_uuid": "799d199b-ba4b-4c65-87ad-9b5fd073d9ee", "referenced_uuid": "3244704d-6095-4bb6-9783-6170248c2922", "relationship_type": "detected-with", "timestamp": "1656527445", "uuid": "cc9549af-3bfa-477b-83b5-736d12d3b3c0" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "237634e0-4211-4806-ace8-30f728b7d892", "value": "f9e6ca0bdaa43df9ed0449b964e1b8b4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1656527445", "to_ids": true, "type": "sha1", "uuid": "26e4a083-e37a-4c89-b804-a08a859ab934", "value": "24b983856dfdd4e48eeeafc9372b70d6b53ae722" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1656527445", "to_ids": true, "type": "sha256", "uuid": "2a0ca315-df8b-45e8-ac7d-5fce0226d141", "value": "6e3840f11aa02f391edd7e3e65b214f1af128fa207b4feb7f69e438014a2206d" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "cd7c4bd0-e080-44c8-b885-a2053e371cb0", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "47aa6144-8991-4312-b95c-41d1a59ab2be", "value": "2.888609" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "3fd009e8-3afd-4b18-8312-00b0ead616ee", "value": "e16f93c6b1a062a1dc2156fc770594a6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "ffb1be87-8378-435f-b82e-33e45c613c58", "value": "1024" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "b575e636-8dee-46fe-8268-d01f2ca1df2f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "e940a266-f822-4753-b7b5-9f4effb3b382", "value": "c4466c75f41681629fc2ead156f8de84" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "ddf318cf-0ca8-44d7-8dfa-2e95297a1d6f", "value": "6.36696" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "28d951d1-9450-4428-8462-41a4815a36bd", "value": ".text" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "35b3e917-2846-4eec-9aa6-cd2260da4a60", "value": "89088" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "2b5e0851-4216-439d-aa36-b4cde91e35a4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "94096f0b-04d1-4129-9379-88af9b9787d8", "value": "4d9a0bcd9467b5aaee5d4d762219821b" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "85684163-f7d4-44ee-bf8e-c6d6aa216e21", "value": "4.425938" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "294e49d0-1a3f-490e-b9f5-a37b2c8c6752", "value": ".rdata" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "3c4d6fb3-a451-4df8-adb6-ad5495d96e5d", "value": "65536" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "ddea3fc0-14b5-481a-8c9a-b7d98ba35965", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "f54422d3-50fc-4dcd-b291-b255858fe265", "value": "f80417eeab656641c6a5206454b398d3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "6f07184b-fb31-40fc-a428-f199ea147188", "value": "3.054858" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "d12de9b6-66d4-4649-84b5-92bc3a57c5b9", "value": ".data" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "90677e73-0183-409b-9b35-965047bac0db", "value": "6656" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "8ba56101-f756-42c4-aef8-49a6fa9f6685", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "e7e8b1df-97d4-47ef-9c61-bfbfd66da17a", "value": "e0d2510e666231c532ff97edf51abd10" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "4f587549-b191-425b-a757-471b1c12be8d", "value": "4.855993" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "3706c63d-955a-4898-8a68-34f26de79210", "value": ".pdata" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "6a9b6378-070a-4287-9524-803f40f27156", "value": "5120" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "cf82907b-8abe-4411-b6a6-935e135ed9d9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "e42eb937-234b-4d26-adc5-368479c38d57", "value": "fff7f8f7be38486e0a6d01bc0472a6f2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "ccc3eb3d-0868-4ab8-9af6-84a4c39f7a37", "value": "7.914631" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "64205452-9ab8-4bfb-bc1c-bdecb94f5769", "value": ".rsrc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "31b11d5a-19a2-4c25-8f83-e7475cb186c3", "value": "550912" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "84cff36a-d081-4c60-9767-75d41da4eaf1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "ea9b8633-3777-45e4-82de-a401430fcc39", "value": "bca539afcd691a4a238b78fc830dc55a" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "f092620e-7b50-47c0-8575-47f527dfeee6", "value": "4.939573" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "421e7805-59b8-4d4d-9dc0-457d71887286", "value": ".reloc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "95a5bd0b-3665-4e0a-9e96-c56c9a9303c4", "value": "2048" } ] }, { "comment": "", "deleted": false, "description": "Object describing a Portable Executable", "meta-category": "file", "name": "pe", "template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07", "template_version": "7", "timestamp": "1656527445", "uuid": "9e4d332d-1615-4189-a4e8-f17a9c9296f1", "ObjectReference": [ { "comment": "", "object_uuid": "9e4d332d-1615-4189-a4e8-f17a9c9296f1", "referenced_uuid": "cd7c4bd0-e080-44c8-b885-a2053e371cb0", "relationship_type": "header-of", "timestamp": "1656527445", "uuid": "969a2675-015e-4fb5-94a6-cf4390c266a4" }, { "comment": "", "object_uuid": "9e4d332d-1615-4189-a4e8-f17a9c9296f1", "referenced_uuid": "b575e636-8dee-46fe-8268-d01f2ca1df2f", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "b7ce3cbe-e336-4874-a696-015ce90dcd39" }, { "comment": "", "object_uuid": "9e4d332d-1615-4189-a4e8-f17a9c9296f1", "referenced_uuid": "2b5e0851-4216-439d-aa36-b4cde91e35a4", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "95c6d840-cd9b-4609-8437-c79f7a37b8cc" }, { "comment": "", "object_uuid": "9e4d332d-1615-4189-a4e8-f17a9c9296f1", "referenced_uuid": "ddea3fc0-14b5-481a-8c9a-b7d98ba35965", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "5c81027f-155d-41e3-81df-c2329c484c68" }, { "comment": "", "object_uuid": "9e4d332d-1615-4189-a4e8-f17a9c9296f1", "referenced_uuid": "8ba56101-f756-42c4-aef8-49a6fa9f6685", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "73d80e0b-8df1-4fe4-98dc-702d4e03692f" }, { "comment": "", "object_uuid": "9e4d332d-1615-4189-a4e8-f17a9c9296f1", "referenced_uuid": "cf82907b-8abe-4411-b6a6-935e135ed9d9", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "d978449b-ebd7-4528-9f51-e487ef493941" }, { "comment": "", "object_uuid": "9e4d332d-1615-4189-a4e8-f17a9c9296f1", "referenced_uuid": "84cff36a-d081-4c60-9767-75d41da4eaf1", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "c718ca2b-fe7e-4757-817c-abd7350fd427" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "internal-filename", "timestamp": "1656527445", "to_ids": true, "type": "filename", "uuid": "912d4e31-0405-4dd6-83d4-918fa7b20325", "value": "hmsvc.exe" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "original-filename", "timestamp": "1656527445", "to_ids": true, "type": "filename", "uuid": "540051e2-f697-44bf-8964-672e607694ac", "value": "hmsvc.exe" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "number-sections", "timestamp": "1656527445", "to_ids": false, "type": "counter", "uuid": "2c9870a2-5ce5-4d9f-a675-4ddbf89a0a9c", "value": "7" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "timestamp": "1656527445", "uuid": "07196069-4ff5-47f3-94be-b6569883ae2f", "ObjectReference": [ { "comment": "", "object_uuid": "07196069-4ff5-47f3-94be-b6569883ae2f", "referenced_uuid": "9e4d332d-1615-4189-a4e8-f17a9c9296f1", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "7aae7ef6-1eda-4d58-8b53-3671778e81bd" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": false, "type": "md5", "uuid": "828e5f2b-dfb5-473f-bf5c-7232fa9ac07f", "value": "df81145680b4deab198d9bba091d86e9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1656527445", "to_ids": false, "type": "sha1", "uuid": "010dcaf1-39eb-476f-bf3b-db5bd3a88daa", "value": "4235d9a934d26ec688c21e3fc2e470178b7b3c21" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1656527445", "to_ids": false, "type": "sha256", "uuid": "e40b6752-8f65-4f4b-b6eb-e143f7311347", "value": "6589a687e69a182e075f11805a755ac1fabbddae1636c6fea8e80e7414521349" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha512", "timestamp": "1656527445", "to_ids": false, "type": "sha512", "uuid": "47faf031-a826-4066-87ad-1cc1c6bcc810", "value": "de5e8164f58120e624e0546518b5c0c5df864baa9b389162f1be75547e6f684ee94f9df5738cdcf5065dd7bfcd6481c6ea45f4c1ff154edb4e0ad48ea5260d42" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1656527445", "to_ids": false, "type": "ssdeep", "uuid": "06fad27e-9350-433e-93b1-c0c90edc2ddd", "value": "12288:g5eggD3QpKCvO5yPPGtjLFanfI2YAMinlQZUub+RdYhawaGFbhwydP76N5:ceHD3eKU+tVafVgKlQZUlRdYVdP76N5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1656527445", "to_ids": false, "type": "filename", "uuid": "b5eb655e-5b3c-4cff-81a7-04ee633bda40", "value": "hmsvc.exe" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "mimetype", "timestamp": "1656527445", "to_ids": false, "type": "mime-type", "uuid": "6afa13a6-55d5-4396-ba32-f97a1918bef0", "value": "PE32+ executable (GUI) x86-64, for MS Windows" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "0a9b40fe-9925-4f0b-a929-82974bd0c9ab", "value": "720384" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "079033f0-41bb-49f8-b8c7-3460d62b91f8", "value": "7.623341" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "b4de117a-5ef2-43a0-86ca-93de414d164c", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "55bfe72e-1734-4ecf-b749-84961f7945e1", "value": "0.893865" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "5ce5b0d3-d14f-49e8-a867-9395edf77a00", "value": "60df3f67c31781bbec2444de6daf8a2b" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "5238dd44-ff34-4fa8-8e03-6f5dc58bd6c8", "value": "4096" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "7957144c-5de0-41e1-9d98-5bfd04680e36", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "676ac36e-311d-408a-abed-0b9d945d71fb", "value": "9ebe1be469e63ff47601b0c714285509" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "455186f2-e278-4d0a-80d5-462e409b6643", "value": "6.393378" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "197464c7-ff7b-42ae-9c16-6d50e10b2d17", "value": ".text" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "31fc4a31-c445-414b-b5fa-2e53a44c9a24", "value": "327680" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "9f693c19-ee72-45a7-be0f-646d4fd2b8b6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "c9821251-68cb-4c34-82b3-3555e1ed755e", "value": "1cb5bcc8bcade2b3ddee4dc6c617824a" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "d602cf4c-b183-43e5-82c9-4f374dfa811f", "value": "4.552154" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "9602c50d-74a8-4be9-b611-87777a3c0f14", "value": ".rdata" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "1fe3364c-ade3-405f-a762-221b343a55f4", "value": "110592" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "6b81de20-3550-491c-b7d3-06d3f43b2dbe", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "998f2dfc-5f9b-4228-a005-a587d6ced34a", "value": "e89305f8c6e571d82fb370f352192aa2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "e8295b80-db99-4336-8572-356a59b3df91", "value": "3.781076" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "6707c60e-a30a-41e5-822e-d8c40cc4def8", "value": ".data" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "6a3fd2a8-ba60-4d27-87c4-68b733a31ac7", "value": "20480" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "7553a2ad-a30f-457b-aec8-f014a9ff34c1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "76861870-177a-4514-aa3d-e0398d0e4cdd", "value": "ca8c03d7af637fa213b44d065c073c75" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "f66bb5fe-edea-4b13-88c9-3fbf77220f28", "value": "5.309842" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "ca88201c-1d25-4baa-863c-82dd6d2381d2", "value": ".pdata" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "253b555e-ef38-4484-9f31-ecc14238b3fb", "value": "20480" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "3ef7ad18-606e-4d55-9a6c-c49281ef800b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "bc5bea4a-78db-4fe7-ac65-e481e734c092", "value": "bab9a0fee3d912c3b866d3ca88b47510" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "0a73f868-61c6-4911-8746-ea890873cd33", "value": "0.256806" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "253339d5-6eb1-426b-ac08-274c1d9ba85f", "value": "_RDATA" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "a4c4b235-4a66-4baf-b46b-00bd2fa287bf", "value": "4096" } ] }, { "comment": "", "deleted": false, "description": "Object describing a section of a Portable Executable", "meta-category": "file", "name": "pe-section", "template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a", "template_version": "3", "timestamp": "1656527445", "uuid": "8875748d-377d-42df-82be-b54b88353e7f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": true, "type": "md5", "uuid": "4e6ff176-9ee6-4ff8-aed4-ab438e4fae27", "value": "9a68c3f572ae2b201926c193eeed1cab" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "5d7229d6-4160-4088-a8fd-e4faf91b6e26", "value": "4.894447" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "name", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "904c58a0-9217-47e5-8412-805130108da9", "value": ".reloc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "efeb466b-044e-492d-b955-1f0fac9a2bb9", "value": "4096" } ] }, { "comment": "", "deleted": false, "description": "Object describing a Portable Executable", "meta-category": "file", "name": "pe", "template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07", "template_version": "7", "timestamp": "1656527445", "uuid": "68046bf8-1f86-416b-8228-5e3eae739fd6", "ObjectReference": [ { "comment": "", "object_uuid": "68046bf8-1f86-416b-8228-5e3eae739fd6", "referenced_uuid": "b4de117a-5ef2-43a0-86ca-93de414d164c", "relationship_type": "header-of", "timestamp": "1656527445", "uuid": "35c97bbb-844e-4924-9602-842c3eb0c9c1" }, { "comment": "", "object_uuid": "68046bf8-1f86-416b-8228-5e3eae739fd6", "referenced_uuid": "7957144c-5de0-41e1-9d98-5bfd04680e36", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "47f5eda6-c06c-4940-becc-13f2ee0474ce" }, { "comment": "", "object_uuid": "68046bf8-1f86-416b-8228-5e3eae739fd6", "referenced_uuid": "9f693c19-ee72-45a7-be0f-646d4fd2b8b6", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "9160becf-64f2-4b00-a8dc-483cee11d73a" }, { "comment": "", "object_uuid": "68046bf8-1f86-416b-8228-5e3eae739fd6", "referenced_uuid": "6b81de20-3550-491c-b7d3-06d3f43b2dbe", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "0df551a0-d944-43bf-b314-d4e1ac4ec00d" }, { "comment": "", "object_uuid": "68046bf8-1f86-416b-8228-5e3eae739fd6", "referenced_uuid": "7553a2ad-a30f-457b-aec8-f014a9ff34c1", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "4d4a19e3-9939-4545-b863-388d9aed46c6" }, { "comment": "", "object_uuid": "68046bf8-1f86-416b-8228-5e3eae739fd6", "referenced_uuid": "3ef7ad18-606e-4d55-9a6c-c49281ef800b", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "75440ef1-4ab9-4d05-80bc-fc1a9486087c" }, { "comment": "", "object_uuid": "68046bf8-1f86-416b-8228-5e3eae739fd6", "referenced_uuid": "8875748d-377d-42df-82be-b54b88353e7f", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "175b9071-afe6-4c4c-8a08-bca5bfc7352d" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "internal-filename", "timestamp": "1656527445", "to_ids": true, "type": "filename", "uuid": "38dd1e6a-ada3-441b-8a96-f93edacf4a38", "value": "658_dump_64.exe" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "original-filename", "timestamp": "1656527445", "to_ids": true, "type": "filename", "uuid": "4c4be318-ee11-4543-a7a1-278248f90c99", "value": "658_dump_64.exe" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "number-sections", "timestamp": "1656527445", "to_ids": false, "type": "counter", "uuid": "68c08a7b-d42e-44d0-b5cc-a5ff49dfc914", "value": "7" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "timestamp": "1656527445", "uuid": "33568c83-c015-475a-978d-dffdb18d3c05", "ObjectReference": [ { "comment": "", "object_uuid": "33568c83-c015-475a-978d-dffdb18d3c05", "referenced_uuid": "68046bf8-1f86-416b-8228-5e3eae739fd6", "relationship_type": "includes", "timestamp": "1656527445", "uuid": "2ed59117-c300-488c-ac5f-15b52f5ecd4b" }, { "comment": "", "object_uuid": "33568c83-c015-475a-978d-dffdb18d3c05", "referenced_uuid": "676e607a-d1d8-466c-9db3-1a326b6af955", "relationship_type": "characterized-by", "timestamp": "1656527445", "uuid": "66d3a17e-851d-463a-9986-2e38e382ce02" }, { "comment": "", "object_uuid": "33568c83-c015-475a-978d-dffdb18d3c05", "referenced_uuid": "f7c21f37-a573-455a-9007-057b6cfd3427", "relationship_type": "characterized-by", "timestamp": "1656527445", "uuid": "b8a69c69-1d85-477a-8c9d-bd866cbfda93" }, { "comment": "", "object_uuid": "33568c83-c015-475a-978d-dffdb18d3c05", "referenced_uuid": "6cc7e180-0c83-4563-b0d5-2b17c48f6728", "relationship_type": "characterized-by", "timestamp": "1656527445", "uuid": "f4bd863a-5911-46a3-b1b7-6d71199a40a6" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1656527445", "to_ids": false, "type": "md5", "uuid": "a9567b31-cef3-4a50-9c0e-4ad2dec645bd", "value": "f9e6ca0bdaa43df9ed0449b964e1b8b4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1656527445", "to_ids": false, "type": "sha1", "uuid": "31d19c03-1512-485d-be00-24a9daa740c0", "value": "24b983856dfdd4e48eeeafc9372b70d6b53ae722" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1656527445", "to_ids": false, "type": "sha256", "uuid": "063f2ce1-6528-492e-8109-dac5a899a984", "value": "6e3840f11aa02f391edd7e3e65b214f1af128fa207b4feb7f69e438014a2206d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha512", "timestamp": "1656527445", "to_ids": false, "type": "sha512", "uuid": "cd50130d-648e-4408-a8cd-1e4f80538f3f", "value": "5b8bfe6f043cd6e0ee6ac6665e95751c5369ec171050497122533302f2d7f5f5b7a4a23c70618f396bd52b4ec919ff2214cc2641a0e46607707d3d393fd105eb" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1656527445", "to_ids": false, "type": "ssdeep", "uuid": "2a60ccb4-c1f4-488a-bbc8-efe7116e40af", "value": "6144:F4ph6Duxm/k+DesM/uZwZLmixJwxbgaEvUhN8/bSJ40+R833OutenWRaMt:F4b6DV/k+D3MWZFXgJvBX/b0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1656527445", "to_ids": false, "type": "filename", "uuid": "21c9a9e1-550e-4ee1-a9cb-40b9147af559", "value": "658_dump_64.exe" }, { "category": "Artifacts dropped", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "mimetype", "timestamp": "1656527445", "to_ids": false, "type": "mime-type", "uuid": "c3b5053d-bf7e-4d88-b466-1ba168009e5d", "value": "PE32+ executable (console) x86-64, for MS Windows" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1656527445", "to_ids": false, "type": "size-in-bytes", "uuid": "655113f1-84c4-46f7-be36-e859a004d49d", "value": "491520" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "entropy", "timestamp": "1656527445", "to_ids": false, "type": "float", "uuid": "fbeb5bb6-9aee-4abc-8a9a-d59a0c272d01", "value": "6.058119" } ] }, { "comment": "", "deleted": false, "description": "Whois records information for a domain name or an IP address.", "meta-category": "network", "name": "whois", "template_uuid": "429faea1-34ff-47af-8a00-7c62d3be5a6a", "template_version": "10", "timestamp": "1656527445", "uuid": "fab63139-f912-4b75-b8dd-ae28a20f29d3", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "7ac50d74-25a5-4f6a-a898-8abdf0813920", "value": "Queried whois.ovh.com with \"ip-192-95-20.net\"...\n\nDomain Name: ip-192-95-20.net\nRegistry Domain ID: 1765585340_DOMAIN_NET-VRSN\nRegistrar WHOIS Server: whois.ovh.com\nRegistrar URL: https://www.ovh.com\nUpdated Date: 2021-12-01T02:56:46.0Z\nCreation Date: 2012-12-11T13:59:05.0Z\nRegistrar Registration Expiration Date: 2022-12-11T13:59:05.0Z\nRegistrar: OVH, SAS\nRegistrar IANA ID: 433\nRegistrar Abuse Contact Email: abuse@ovh.net\nRegistrar Abuse Contact Phone: +33.972101007\nDomain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited\nDomain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited\nRegistry Registrant ID:\nRegistrant Name: REDACTED FOR PRIVACY\nRegistrant Organization: Hebergement OVH Inc.\nRegistrant Street: REDACTED FOR PRIVACY\nRegistrant City: REDACTED FOR PRIVACY\nRegistrant State/Province: \nRegistrant Postal Code: REDACTED FOR PRIVACY\nRegistrant Country: CA\nRegistrant Phone: REDACTED FOR PRIVACY\nRegistrant Phone Ext: REDACTED FOR PRIVACY\nRegistrant Fax: REDACTED FOR PRIVACY\nRegistrant Fax Ext: REDACTED FOR PRIVACY\nSend message to contact by visiting https://www.ovhcloud.com/en/lp/request-ovhcloud-registered-domain/\nRegistrant Email: 45oplxny9ljiuizg7k3l@w.o-w-o.info\nRegistry Admin ID:\nAdmin Name: REDACTED FOR PRIVACY\nAdmin Organization: REDACTED FOR PRIVACY\nAdmin Street: REDACTED FOR PRIVACY\nAdmin City: REDACTED FOR PRIVACY\nAdmin State/Province: REDACTED FOR PRIVACY\nAdmin Postal Code: REDACTED FOR PRIVACY\nAdmin Country: REDACTED FOR PRIVACY\nAdmin Phone: REDACTED FOR PRIVACY\nAdmin Phone Ext: REDACTED FOR PRIVACY\nAdmin Fax: REDACTED FOR PRIVACY\nAdmin Fax Ext: REDACTED FOR PRIVACY\nSend message to contact by visiting https://www.ovhcloud.com/en/lp/request-ovhcloud-registered-domain/\nAdmin Email: t0xyeloj2uxkh9uyhhjh@y.o-w-o.info\nRegistry Tech ID:\nTech Name: REDACTED FOR PRIVACY\nTech Organization: REDACTED FOR PRIVACY\nTech Street: REDACTED FOR PRIVACY\nTech City: REDACTED FOR PRIVACY\nTech State/Province: REDACTED FOR PRIVACY\nTech Postal Code: REDACTED FOR PRIVACY\nTech Country: REDACTED FOR PRIVACY\nTech Phone: REDACTED FOR PRIVACY\nTech Phone Ext: REDACTED FOR PRIVACY\nTech Fax: REDACTED FOR PRIVACY\nTech Fax Ext: REDACTED FOR PRIVACY\nSend message to contact by visiting https://www.ovhcloud.com/en/lp/request-ovhcloud-registered-domain/\nTech Email: t0xyeloj2uxkh9uyhhjh@y.o-w-o.info\nName Server: dns10.ovh.ca\nName Server: ns10.ovh.ca\nDNSSEC: unsigned\nURL of the ICANN WHOIS Data Problem Reporting System:\nhttp://wdprs.internic.net/" } ] }, { "comment": "", "deleted": false, "description": "Object describing the original file used to import data in MISP.", "meta-category": "file", "name": "original-imported-file", "template_uuid": "4cd560e9-2cfe-40a1-9964-7b2e797ecac5", "template_version": "2", "timestamp": "1656527445", "uuid": "65372ba0-6f57-4816-960e-8076a1f44d54", "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "imported-sample", "timestamp": "1656527445", "to_ids": false, "type": "attachment", "uuid": "e018043e-3406-4855-8aad-3bf25c789cfd", "value": "MAR-10382254.r1.v1.WHITE_stix.xml" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "format", "timestamp": "1656527445", "to_ids": false, "type": "text", "uuid": "153cc72a-e0a8-4429-bf60-2849c0686348", "value": "STIX 1.1" } ] } ] } }