{ "Event": { "published": true, "date": "2021-09-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-09-01", "timestamp": 1630540981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "01a57361-21b2-4498-8497-3f74bd15565d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e0c1ab-0b2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630505183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505183, "uuid": "60c773d8-ea62-473f-8928-3a5f041bbfc2", "comment": "Malware payload (AgentTesla)", "value": "d52e68607658d5b60d2ce047b41801df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505183, "uuid": "8f2130bd-8bf5-4fb1-9248-490784e3b67c", "comment": "Malware payload (AgentTesla)", "value": "0124c9434101eac2aa56eb56e2ef68eb35f7ad1c042db04cedf0014843b2c8a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505183, "uuid": "1689f9ab-cead-4644-9ce9-493b771b0355", "comment": "Malware payload (AgentTesla)", "value": "6f2d6c0184117fb6329b91495124629974a141af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505183, "uuid": "3f522fb3-1657-4558-a308-0b04b3879a36", "comment": "Malware payload (AgentTesla)", "value": "b6662f1520b6e75f33d4592342ea945bb5c53ab9ff361c3886601373b987b1ec6587e9aa86b1fd3b8a6b7d4758df43d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505183, "uuid": "ece9abcb-124a-4fd0-9222-d11d9aa21622", "value": "T1F7F4FB7F19BDA127A175C6F58BE74423F0018BAF31216925B6D643164323A7AB4F332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505183, "uuid": "38466131-46a2-4ca0-89b4-063e8105a0cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505183, "uuid": "be805bae-3d09-4f6a-982a-63bc5e361483", "value": "12288:cFxY1alvSjVPdCvj2i3/AeEnU0dNVsxZRCtm:GYE1ShuCi3/Ae3aNERC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630505183, "uuid": "fb3c0913-8f83-4570-b6e9-cf0c8067cb6a", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630505183, "uuid": "0b5252dc-7cd1-4114-a9c7-1c4ed0b1fcb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505183, "uuid": "84cd2be3-b3ec-4775-ab6f-d5db57927d84", "value": "revised order-number 3A6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c144eb5-0b52-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630520755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520755, "uuid": "af2cd052-b436-461c-b870-8ed204c6167f", "comment": "Malware payload (RedLineStealer)", "value": "5514d7f00f8566e827efed4ca34f05db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520755, "uuid": "c75ba1c4-643c-4512-8111-1bc362d8fea3", "comment": "Malware payload (RedLineStealer)", "value": "01b259c2a07e81f3a2636fcf80ddd3d90a7daaafc218eee30f9a8247f09e1f39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520755, "uuid": "a1614718-d3e7-4b97-b7e6-4c9b44e4e4f4", "comment": "Malware payload (RedLineStealer)", "value": "b46c0ecaa9168dee63292a3d2f5e01f2455e4a07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520755, "uuid": "8700fca4-6af9-49f1-a03b-776d6ee2582d", "comment": "Malware payload (RedLineStealer)", "value": "826a1b33c04996fd2c40458d33334dd9d687b1cd890f189c0a19248644f4eccdd9041a3bcccfafb5550fb8a4de81720c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520755, "uuid": "7cb91e12-7f0d-41f0-9ecb-5c7be636fcd5", "value": "T120C34B7523DCCB28E7FE0E75B470010147F0E18B6502EB5B9DC6ACFA5E66B8267542E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520755, "uuid": "69eb42da-40b8-46f3-94b2-f26c1b074f66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520755, "uuid": "5c74d959-fd7c-4974-89ef-5d4773826fcb", "value": "1536:UteNE4bYKW1E5gfK1FSQFaAQAWdjbuRGdznLuyq/dJV4dbknErG6qTaoigyXX8:2epS6FSsMxvznCyOdJckEuiXX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630520755, "uuid": "e5244779-cfb0-4460-851e-eefb895a2e2b", "value": 119016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630520755, "uuid": "a4333cf7-98c4-4b07-8f65-ca6be1a78919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520755, "uuid": "ac5bfba6-8572-417b-998b-f425a399ba07", "value": "5514d7f00f8566e827efed4ca34f05db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcece4a-0b41-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630513561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513561, "uuid": "be8b5b5a-40aa-4b2b-9333-38a0598a011d", "comment": "Malware payload (DiamondFox)", "value": "74f57657c904faaf18f9423ce1764469", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513561, "uuid": "d41b4321-3809-4f76-9a7e-3c8213c88e4d", "comment": "Malware payload (DiamondFox)", "value": "051c5d064ba3816e2eb061b2f1b96c8bf3609b038831464596c3a8436d3415eb", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513561, "uuid": "48cb2a46-b09d-431c-8363-62ebfd6fd96d", "comment": "Malware payload (DiamondFox)", "value": "1b16696a621004b0cc5dd293598d1d585608874d", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513561, "uuid": "78b28f31-b641-4ffd-87dd-83cab5b4a54c", "comment": "Malware payload (DiamondFox)", "value": "d26a224ecfd826e106f182e999f77ca00a6ac88f1a80406448aece225f02b88dbbe343f48cf5aadb2fa9c7868404791b", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513561, "uuid": "c7b71b57-2dc1-45e9-84ef-0aaa26db4172", "value": "T1B7363358BE9188FEDD8211390C54A7B3A2FED3494E3828EB5F4758395F189E3935EC09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513561, "uuid": "bdfdaf2d-84c6-4932-8c62-77b0a903c9b0", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513561, "uuid": "bed42bf1-0e71-418d-8a2e-29d3a9a70120", "value": "98304:xwCvLUBsgBgXYnBqxLdOKR0na+ieB11ajgqs2Avn:xNLUCgBgXhLoKinfnB1OKvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630513561, "uuid": "100cd6e2-a1a5-45c6-b3cb-d1203b8a4556", "value": 4925552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630513561, "uuid": "f0d664f8-d426-48bf-98d6-b6dc30a198c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513561, "uuid": "fd33ac12-c4ee-4a41-8420-852c2ecbdf2a", "value": "74F57657C904FAAF18F9423CE1764469.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65756f70-0b43-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630514463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514463, "uuid": "e6b34e4c-4355-43d7-88d0-1f35a4df23eb", "comment": "Malware payload (RaccoonStealer)", "value": "fa6a741a0e1b5a044d7a8e3aba36abf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514463, "uuid": "17b883df-2df4-43c4-84ea-c5ecce8c1cef", "comment": "Malware payload (RaccoonStealer)", "value": "057be0a4a2e82716a1d4034c4d909940a161a481cff4ba358a5b012bdd75ce96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514463, "uuid": "39a000bf-8005-4ea9-a4d4-f1c244be6eea", "comment": "Malware payload (RaccoonStealer)", "value": "b64a6b380bc27d25cb1a622a60f737a6614f3895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514463, "uuid": "ee39e55a-ca01-44ee-945f-c34bf64d7f71", "comment": "Malware payload (RaccoonStealer)", "value": "36d64181cc3d8ae8876f2597966a524b468f192c8abfc95644b89f2da00b94773c72d574118f67778430eb4d5b265cc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514463, "uuid": "32568fe0-24fe-4d0f-9419-1ceebbfb91a5", "value": "T163C4F13BB2A2D43FD19146754CB5D7F94D36BCAB5922C18B37C4661A2EF13C2AB12306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514463, "uuid": "aee6d9e5-bc71-4aaa-a78b-89db94123419", "value": "7449bb1bd2f7cf11b31b665cb048bd37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514463, "uuid": "c7a59539-c6b7-4e8b-85f9-b021f531cb87", "value": "12288:nBRsoxqQBmZMn7gfr+5AorhuQPb6JPCwi9SAD+EqaX59Y:nBqhK7n9hJb6JKwi9SADHq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630514463, "uuid": "b4bfec44-d341-40fe-9557-3732cbb92197", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630514463, "uuid": "39ef9d00-86d7-448c-b18f-e8344b591c94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514463, "uuid": "03b8d361-a67a-4b40-96f3-58b535eb8214", "value": "057be0a4a2e82716a1d4034c4d909940a161a481cff4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5bc18e-0aec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630477028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477028, "uuid": "d2477c05-5ba5-4e3a-bac9-1e707a2b5f02", "comment": "Malware payload (AveMariaRAT)", "value": "05b98998e91a24dda86e0b2537f28461", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477028, "uuid": "36d718aa-37ed-460f-bcc3-cdfc9825f3fc", "comment": "Malware payload (AveMariaRAT)", "value": "0741c36ad10f51f858eefc2e2f0879c9ef1ae90af61d766bd50ebcc67f4d5579", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477028, "uuid": "b30e02ce-3db8-4b42-af55-57f372a904b7", "comment": "Malware payload (AveMariaRAT)", "value": "9686445fbf799fa342f1618d9162122a59e2f227", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477028, "uuid": "67b99174-e8bb-4129-87f4-b8cf56ca6a7f", "comment": "Malware payload (AveMariaRAT)", "value": "5a51d70ea13eea944ec3f2ab361805f78a963b0c4cd9cd5cd23feb1a323281ae182acf2bb9a2582acf7403aa9d9c6707", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477028, "uuid": "36f23932-4b05-46a4-a2f0-26a33cd66a36", "value": "T178C3F70636848B51C55809B9C1EB593007E7BDC772BAD2863D4877DE4E223E8CD9EBC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477028, "uuid": "ceb7d637-89a0-401d-82d0-28978c54b65e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477028, "uuid": "8787948a-c9e4-4766-975e-18dbd42f172c", "value": "3072:HML/Hnpd6Fa/tG4aNis1eM92CYoxYz0BoqZ:srJd1tG4aNis0M92DcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630477028, "uuid": "93a8ff5b-1306-4501-835c-10c137260112", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630477028, "uuid": "34ce7d14-2062-4a80-b7ac-250ac1fe22c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477028, "uuid": "f139627c-2e41-4b3e-b112-4f1ef100b0ba", "value": "WIRE TRANSFER 09487577474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f14e967-0b65-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630529163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630529163, "uuid": "58510474-1af5-4923-9581-753c44b5fc1a", "comment": "Malware payload (RaccoonStealer)", "value": "69f8c1e6fe07bda7f48bae667ebf0d79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630529163, "uuid": "7c631c26-6e8b-42ed-a04c-24df3565a7e9", "comment": "Malware payload (RaccoonStealer)", "value": "078e506c4e20407cceedfc077550269a46504c5c845b0142d4b4c426490a8199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630529163, "uuid": "bb68741c-a7b0-428e-9f12-5b2f04aa2c3d", "comment": "Malware payload (RaccoonStealer)", "value": "0dcb6ac8f7bae775c5d9418970292fe381b1faae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630529163, "uuid": "411e7f59-e6ab-48b8-a3ed-d1f314d80b4c", "comment": "Malware payload (RaccoonStealer)", "value": "bddb503b3388e683bd4d6d0fda973fec92fd804f701676c3f5c5da42339578bface833279b2936ba850b3a317a32773b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630529163, "uuid": "02b2ab67-3082-46f7-be27-db7bb1cea587", "value": "T192A40203BAA1EC33CDD649315878C7B15B3ABC6C9561C449B259366FB9F13A06F22362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630529163, "uuid": "99e34838-f708-4b2c-9aaa-b1791cdd850d", "value": "b9f5edd648bb5b289a01d65b4e883b6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630529163, "uuid": "54aeec68-c473-42f9-ae05-3d73c1760572", "value": "6144:WFLETyBtvhWGOXdZO0tQYJdHQXYat4dFaPvwuLe84a/QaJiIi:WYTs5hWGGfOVYJd9atSFu4uLZ4a/Q+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630529163, "uuid": "e4a6732e-e210-4f36-9543-7507902914a0", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630529163, "uuid": "47b6a630-ee7b-4834-9884-7537d8851d4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630529163, "uuid": "636b3640-1074-465e-9815-d28002031bfb", "value": "69f8c1e6fe07bda7f48bae667ebf0d79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c560fc47-0b18-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630496156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630496156, "uuid": "cd8c0151-0e7e-4bf3-9df9-1028b48c3f8a", "comment": "Malware payload (DiamondFox)", "value": "3e83abe805ea3cd0852235f3365e1cf9", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630496156, "uuid": "ac443866-58ce-4c6f-bf07-72eae184c413", "comment": "Malware payload (DiamondFox)", "value": "079e8468f9e6f11a839e931ab04d45036acb2574aa37a4f749d6db98a61509cc", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630496156, "uuid": "7a7e5fa3-6f3d-4414-b83c-16fec01a319b", "comment": "Malware payload (DiamondFox)", "value": "6bfb7ee7cb01ed2e9e50658193847954900f26a5", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630496156, "uuid": "a19eab9c-118d-4785-880e-4bf82d1decff", "comment": "Malware payload (DiamondFox)", "value": "805dd5c630123ea9c742c5e3bffb7c9ff44b221646e2b2622cc0aa65ed6731e6008cfaf8ddf481c7c38e903588888102", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630496156, "uuid": "678fc3db-03f9-43de-ac5d-bb96224a5c04", "value": "T18AF53314B2E6C2F7CA8251719C092FB2E0B9E39D1732489323605B1F1DAFD25936E9D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630496156, "uuid": "8c0301b6-25eb-4487-82ac-3ea5a8ea9391", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630496156, "uuid": "7a079131-0175-46b3-8f95-af2ba22fe958", "value": "49152:xcBfxD1zheQnY4So8DiYJnmlJxqqWkDpyZvVivHtlJp/k3EwJ84vLRaBtIl9mT0C:xQ18QgiBlJxzW3ZWtlPcUCvLUBsKS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630496156, "uuid": "75e82c50-370f-4203-a97b-b83078c8bf39", "value": 3500618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630496156, "uuid": "c868c22e-05e5-48f7-a900-e5e41d8209ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630496156, "uuid": "a922e4a8-1c9c-4c3d-9414-a65e2fd471b7", "value": "079E8468F9E6F11A839E931AB04D45036ACB2574AA37A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc3c77e-0adf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630471396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471396, "uuid": "4b51cec0-bc1e-458e-ae5c-2cbb8def7d29", "comment": "Malware payload (Mirai)", "value": "2e2a898b44f65efff235224a8e270d33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471396, "uuid": "853142b4-9877-4eeb-8757-307b03ad9d93", "comment": "Malware payload (Mirai)", "value": "081652aa3720522c2f0b3d57a0c58efc667c918335c13d15c339efa7c8059de0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471396, "uuid": "30767e24-bb25-4c2c-87c3-f597de38bf43", "comment": "Malware payload (Mirai)", "value": "51571576aa4c50f32f434eef8bfd0190cd7f2179", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471396, "uuid": "80e8f341-25b4-4e91-8eba-33681828f63b", "comment": "Malware payload (Mirai)", "value": "610dc3cbc8f319ec5f65cb1b6ec90993856e8809c533e33c8c49b456b54e335504ca0a58144a8f08daacc299947e3d8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471396, "uuid": "1a1f9daa-844f-4e4c-81c1-a40f34e2df63", "value": "T181640287FB327C0BCB010BF125DB4B9EA97CA69B82CB9091B6C0854F35F61C576A12C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471396, "uuid": "b47faf93-cce8-4fd8-89dd-2f579f8fcbe6", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioS:p3lOYoaja8xzx/0wsxzSi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630471396, "uuid": "c2470f83-82db-40e9-a6aa-f10d40d3b8c5", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630471396, "uuid": "d1a37aad-8645-4c32-bd76-e5ac6aaf2297", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471396, "uuid": "a5f02286-74d6-42c5-bb41-3c474735b427", "value": "2e2a898b44f65efff235224a8e270d33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d993e8-0b2e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630505389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505389, "uuid": "0948bb8f-1376-49b2-a0ea-2d94dc2e2ebc", "comment": "Malware payload", "value": "69ec1685e9b69e091b6bd6fafafe4f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505389, "uuid": "3f46a8b9-248c-4a29-b17d-1489497bc929", "comment": "Malware payload", "value": "08884d4ee51df79cdb311524ec99783ddd3d73bde064cffe98b0b79118e817e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505389, "uuid": "eb692b85-c03c-47e2-9e64-3d7fb3cf7b44", "comment": "Malware payload", "value": "cfc8f942dd658da73ac23065dc64e694e5e059e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505389, "uuid": "b0479704-07a6-414b-b6c7-c7b6724dd019", "comment": "Malware payload", "value": "68d2fbe203cb76ac7a0a1181e625b863fb2de6a9d6e2ef54b4dfadf272eea53594c23494ef60d64f07ea30b5572a0b8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505389, "uuid": "e29d8659-df66-4012-a775-69be81a24122", "value": "T1E1051285D8793997D93A147A9348C6F309136E7DC2B00A33B2E97A7F462B43BA571133", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505389, "uuid": "2c2eb41b-3de0-4759-ac72-4d1b8f3be259", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505389, "uuid": "dba7a580-9d03-4d87-bcad-2aefb111104f", "value": "12288:PXe9PPlowWX0t6mOQwg1Qd15CcYk0We1zzjm0WNuJvRidGB0rnK0WFnhfBb8aH0R:WhloDX0XOf49e08sRmGyrGhZb8aUGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630505389, "uuid": "4ed58e3f-93df-45be-af7d-8fb0d3ba9fd1", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630505389, "uuid": "acd893dd-5106-40ea-af40-2ee30b117f73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505389, "uuid": "ae386798-195d-429e-9d4b-eb6c681d78dc", "value": "CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed867ce8-0b25-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630501806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501806, "uuid": "9eac7e60-2c0d-4cfe-94f7-3ac10edb504b", "comment": "Malware payload", "value": "cad650822285664c52fbaed65acb22b4", "object_relation": "md5", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501806, "uuid": "b892d960-b8bc-4927-8564-196adccd5990", "comment": "Malware payload", "value": "09f2b4b6ddb2f0311812bd06802a37f7b15c0b4160becc8287b6a6329ae31074", "object_relation": "sha256", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501806, "uuid": "15ae523c-f862-4c0f-9e25-5a3a0a66e182", "comment": "Malware payload", "value": "93f6995438640ae1ff7d0eef2b27490ac7a46a18", "object_relation": "sha1", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501806, "uuid": "99d550b7-2547-40f0-abf0-d4e939a7b1f5", "comment": "Malware payload", "value": "ddfb387112dd3e19c84781f882461ca56ec442d0130d2b6a743376736482e3f262def8f89e70313f48f1d7ee16663c3e", "object_relation": "sha3-384", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501806, "uuid": "b542a00e-dacf-4510-b614-4b66293db09b", "value": "T18F6374E05CC88063E5DB972CB55EBEBD46B2316786ED1C90BB3EE4501BFE6922B4414C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501806, "uuid": "dccb698e-41b2-46f2-9a7a-6d7077d92874", "value": "768:w0J+nECIq24SHBMZr3WBoiohOW7tco0fw7tg4ECV36twfP/ppXq/v/fyD2rJ3Juq:LJ+nG8SHCdEScofjR//qPe2rJJulvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630501806, "uuid": "4f6957be-c030-40f7-92f8-132feb846b17", "value": 68183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630501806, "uuid": "b1393584-2fef-47d1-90ed-a160da147c92", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501806, "uuid": "dda2ef95-5349-402c-afa8-7808acab382c", "value": "lnk-decoded-2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8d0904-0b6f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630533348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630533348, "uuid": "9fdec65a-6206-4202-a853-4254c4ea83b2", "comment": "Malware payload", "value": "cd3f88a43b2764c4896ab8f879fb2c10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630533348, "uuid": "a5ed7001-3fb5-45d2-8f5b-1f4c9814933a", "comment": "Malware payload", "value": "0a7f5f666fb7a1cdda25353191ddaced97674f596af7230d58af2ee14ea14819", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630533348, "uuid": "6e3b634c-9b7f-48f6-a2d6-0a083c47b022", "comment": "Malware payload", "value": "bb85a6645a908be90ff4015e069904194cb282cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630533348, "uuid": "1bb2fc6d-1a5a-4f8e-b84d-ef49f5797185", "comment": "Malware payload", "value": "c9ea865523ab6c9628f8c18cfea68bd667a4a834493fb46d7577dc56889a531fe0676afded225fe8a4db4b202e511677", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630533348, "uuid": "72eac54d-6e97-4161-a47b-8a32f00c07b8", "value": "T1DCE40A3E18FE23279176C7D5CBE18823F2D498AF3233A96567D747264316A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630533348, "uuid": "f9917c7f-65e9-441c-a5b0-4b81b669b2ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630533348, "uuid": "029ae0a2-e1d1-475a-86b6-1a206d3a88ba", "value": "6144:LQBD8ozQzHR21FJLgGz0kUTVvSERat1Hin2n+jX/oKrcqIyfm/a7bB3+Xv:LQBD8DWsvS+ICn2n0AKgqIyfmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630533348, "uuid": "368d5007-0fb3-42cf-aa12-7f33f2be60f3", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630533348, "uuid": "9863e4a0-f41e-475e-8d9f-62b054de2d9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630533348, "uuid": "623bde41-d67e-4aef-a863-0d42813845f6", "value": "cd3f88a43b2764c4896ab8f879fb2c10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be439aae-0b3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630511176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511176, "uuid": "d7d2bfa1-8db8-455b-8752-97f1a8516a05", "comment": "Malware payload (AsyncRAT)", "value": "94ed49d3c575df88d5ba060f54d7052c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511176, "uuid": "21886574-c6b8-4451-a665-2752c5567bbe", "comment": "Malware payload (AsyncRAT)", "value": "0b81cdf0c7b3ffe1fc09dcc87cb07dbd5ea662517d783f6481886720e368610e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511176, "uuid": "a2e93a69-b1e2-41fe-8b24-fd40a41eccac", "comment": "Malware payload (AsyncRAT)", "value": "ed7b2d51cd27715d50609ef7c51841a2fa3d50f0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511176, "uuid": "385a2467-a662-4430-a562-d9826bf76f34", "comment": "Malware payload (AsyncRAT)", "value": "61cbb161403bd49478c2ab42c5e34b9d947975fbab3832751dea3a560a52380c32e4028b2c4595e5d5792bd23917df0e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511176, "uuid": "05dfff96-d571-4a2f-a0a8-95f55e289a9b", "value": "T1B506125BB691EB41E8683735C7EBB13003FE67413573C2A9AF89336D4A963E3C50A458", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511176, "uuid": "f5643299-9c09-4329-be41-5d44db630e8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511176, "uuid": "fbf24736-1520-4902-8c8f-1d625807965b", "value": "98304:SqKgp7Q0TgIoB/oB/oB/oB/oB/oB/oB/oBWfSK:PoB/oB/oB/oB/oB/oB/oB/oBWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630511176, "uuid": "9cb69bbd-47e4-4e04-8396-e7b5920d0da9", "value": 3667968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630511176, "uuid": "fda264eb-38e3-4d8e-af8e-f30e251a5d22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511176, "uuid": "b359d7c6-9e10-498b-971e-e27be81906ab", "value": "0B81CDF0C7B3FFE1FC09DCC87CB07DBD5EA662517D783.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987669e4-0af6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630481477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481477, "uuid": "ffbe6342-cc6d-4860-8a6b-c03e6b161372", "comment": "Malware payload (Formbook)", "value": "90cafbae85d97e06bb4d20f1283dd5b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481477, "uuid": "8c88e69b-ec81-437a-8b39-9bc1a8a9ea22", "comment": "Malware payload (Formbook)", "value": "0b8a5cbe236a7057a2904f18480b85ce9b59b891c0a1a041516248d35760744d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481477, "uuid": "e6946032-a006-4749-afde-20657e8a62ff", "comment": "Malware payload (Formbook)", "value": "993e4e36fe6718e67d616d6662e1624e831c020e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481477, "uuid": "03b1ac4a-cac9-46c6-bae2-84c31b23cd22", "comment": "Malware payload (Formbook)", "value": "be67e0bf24877fc61b49209419b9fec679dd83871a47af0117157ac44096610bac997bc1e9f771bdefd751df0b810016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481477, "uuid": "8377ad77-bf9e-4f07-9346-edb32c1afced", "value": "T12255128E7610759FC627C97BDA981C209A707036570BE243A05325EEAE4E79BCF161F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481477, "uuid": "9c7ff9bf-37fa-4441-ad89-df0f7cedc432", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481477, "uuid": "b7cdfe27-e4cb-4b6b-8b50-37c17546e234", "value": "24576:lOGA8h16GMR06hLnLNXxKKWaGQy6C7xd1St8cBipFcUIZnSZ0MXAGfF:HAm6D06hV7GQy6C7o8c+WNSZ0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630481477, "uuid": "ab1a8dd6-e28b-488b-9caf-e5b2a94536be", "value": 1311744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630481477, "uuid": "d97c5511-44ee-46e4-b6cd-adafab6c23bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481477, "uuid": "76739cce-ff94-49ca-9dc4-713e90e594be", "value": "IMG0038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b54d91a-0b68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630530445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530445, "uuid": "176b3128-5958-4df6-b1b7-674c12c5de22", "comment": "Malware payload (DanaBot)", "value": "65ef67c7a0948a1235d18daac0499df8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530445, "uuid": "245e6d20-5594-4a50-91eb-1c54cb261a11", "comment": "Malware payload (DanaBot)", "value": "0c4a2724dde281c53472af2a5f70073565ce14aa7d9e911717f9b1a0749b231f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530445, "uuid": "d151ca34-7b73-4877-af79-d8728f45572b", "comment": "Malware payload (DanaBot)", "value": "b5ae2406d499f9bbf4483442abaa7b360b60cf14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530445, "uuid": "a9bdfab7-6f4f-442f-9fa2-d5ad662068c2", "comment": "Malware payload (DanaBot)", "value": "778e8e7424022ccd97395a38b0f565f10503e4094d54dec9057a4d7c596c7b46ee298a7b82cf05b4a24b1c12098793f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530445, "uuid": "067a9c4c-1c60-4bd2-8f38-f7c01e48b5c5", "value": "T15505012B37D0C537D25506718C61B7F85A36FCAA5A22E287F7D5326F2EF12909B12342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530445, "uuid": "7d85f605-1c26-46a3-a8a5-4d9f28b790db", "value": "6c24281dcaa86901b7166ae3ce878d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530445, "uuid": "558e5e3c-0c93-4ed5-9edc-4d95507ee147", "value": "12288:JzJFpjqjxBo2hkWzKA1yU4UrilebD2dqC9e8VBzv8kaSNuK6X93PaX59Y:TqjxBo26WuA1ybeyd3LBzUhh9f1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630530445, "uuid": "4c93aa02-669e-482a-906b-ddb16c4cffa3", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630530445, "uuid": "15855e9c-d262-4c3c-8ea8-1b5e46df3982", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530445, "uuid": "e2aca84e-3eab-453a-b23b-af18554577f5", "value": "65ef67c7a0948a1235d18daac0499df8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8541c2e-0b53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630521474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521474, "uuid": "6639217d-30c6-4c06-a74e-a6e1f620a984", "comment": "Malware payload (Glupteba)", "value": "61eb2106ec53d3d89973b46e60c9e527", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521474, "uuid": "7d3384bb-7c5b-4da1-b32f-b1fc128139d6", "comment": "Malware payload (Glupteba)", "value": "0c535fc0755f04c889292d4bcae072d090f67030cb7a369b6a2113bfc37e1697", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521474, "uuid": "f21dd695-5302-4944-b49f-fdd1eb5eb19c", "comment": "Malware payload (Glupteba)", "value": "8ccc27b9674a52d870b6185cbb321191a089564a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521474, "uuid": "4a2ec848-7969-49b7-ab6d-5fd9929d0364", "comment": "Malware payload (Glupteba)", "value": "bc91bf511c9c4d98fd799603d5dffcfb67c45398f1510ca60cd71d18527cd0885afd2cee5a4016029c3b0609beab5a4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521474, "uuid": "1c94d928-e4b1-4e38-ba28-4d594ed52d41", "value": "T19A26337F3604DC36E96802760C2CDBB75DA17CAF9E92DD8577E8255F2BF1282A312610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521474, "uuid": "948fd052-d7b3-468a-bc4f-4fbadc9e59cd", "value": "6c24281dcaa86901b7166ae3ce878d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521474, "uuid": "7954fe45-00d9-4f55-8576-cef79a6b0d70", "value": "98304:rwJUj/cXGt2L8cUsaMVXZJowRFipdCyz9iv6itkCkrpEqkD19Ir2JAZP:WGT2hzXZeZz9iv6TJFhk4rk+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630521474, "uuid": "6cf7af4c-4a61-4f75-9590-e1f12ebca947", "value": 4707880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630521474, "uuid": "9998d3f8-5f14-4ba7-b3a5-7eebefb886ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521474, "uuid": "374f4c3c-e260-4c23-8352-b5a2707bca6a", "value": "61eb2106ec53d3d89973b46e60c9e527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43b54cb-0aea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630476343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476343, "uuid": "0402c8df-fc95-4c66-b3d3-75f13cd1e228", "comment": "Malware payload (Formbook)", "value": "c00f3a742e38444e5aa7a547ca3a15fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476343, "uuid": "8d194964-dbba-41ea-b936-d942af632575", "comment": "Malware payload (Formbook)", "value": "0dca8d2ca04898823c4d8d6db30a6c1652a1dc53168f301e4a9eb1f1f7bc1643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476343, "uuid": "4aa71a23-f962-4e62-ba6c-cfb4e83dcd85", "comment": "Malware payload (Formbook)", "value": "80c97b1b071651e7456cc018a2f3dee73e56ca06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476343, "uuid": "02c2e050-ff79-4154-8552-9068333f5b12", "comment": "Malware payload (Formbook)", "value": "8049b64dc8a90063b4faf326838fe8de42336370aee1be89bb536405c19cfa47226e169255267749e6d2b865fa8baa85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476343, "uuid": "a9343bd6-9b06-476e-8af6-9f84060b28ef", "value": "T166B4BF03A3DBE9F6E6C311724441A9315CE0E9312B3F4893AFC56E8EC636AC15679B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476343, "uuid": "b32efa1b-c3ed-4939-922e-7901b9d42270", "value": "ce008f986e42a25436f84e99334e8abd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476343, "uuid": "db0b7b58-eabb-49d7-8edd-579835dc5fbf", "value": "12288:8IFJK0mHlCFQf4092j910kLshvwsm9AU75OumuKC3Ao:8IDTmHlCFQf40S0kLsDm9ZQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476343, "uuid": "ec8e23a3-dd4a-42a9-a417-d156dbbc269e", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476343, "uuid": "187e7a21-1f07-40fe-a9c0-ec0f0b4b73e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476343, "uuid": "b9953ec6-0008-483f-bef1-3ea375b0df2c", "value": "Data Sheet and Profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0aeb95-0ac4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630460175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630460175, "uuid": "47faac8c-07d4-48f4-b827-46ce6cc70240", "comment": "Malware payload (Formbook)", "value": "91b3a89d2c0a881737df49fac38744e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630460175, "uuid": "9e550600-4911-411e-8634-03641032d847", "comment": "Malware payload (Formbook)", "value": "0de86452c290d019c526a389413f34dd41e67d4ae1ae6d9d39ef119a9cf81605", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630460175, "uuid": "45c68241-f34d-4613-a19f-7ab6fadf7f07", "comment": "Malware payload (Formbook)", "value": "dee4d42aa9375e1fdab86f052d821ed2294118a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630460175, "uuid": "686a9f52-330e-491b-9bd1-9e279b220d4e", "comment": "Malware payload (Formbook)", "value": "18d548e99c57f7d31891fe6df9d6f489bbac66938a2b2db29edb485b36e6ce31e7eb0bb20451327838882f2928bc5ffd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630460175, "uuid": "4ec38573-02ac-459a-98ba-5e4769f9c994", "value": "T1C8F4FB7F19BDA1279171C6F58BE78423F0018BAF31206925B6D643164323A7AB5F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630460175, "uuid": "16078092-10d0-4b3e-838c-0dc85f937809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630460175, "uuid": "234359b7-f3a7-4ab5-91c4-aefe2d3ba12d", "value": "12288:bRkyilH1O0y/P0CImkS5kAVr86HPIu/Y:9kyidRy/bO2DroN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630460175, "uuid": "05e28411-8b03-4613-b36a-551a2e7c9462", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630460175, "uuid": "207eb95d-78ee-4252-a15d-7ff166f9e944", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630460175, "uuid": "ecfd99b2-35f4-4d2b-8cfe-10d58036bde8", "value": "91b3a89d2c0a881737df49fac38744e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6fcf98-0b0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630491419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491419, "uuid": "bd56b3cd-d849-469d-a509-6cfe3e6dc82b", "comment": "Malware payload (AgentTesla)", "value": "2590387aff49b2feb7ba864735f34f25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491419, "uuid": "f5294ca5-945a-41df-ac6b-4a0e4d074b93", "comment": "Malware payload (AgentTesla)", "value": "0e44ef0035d252a8bce7f2fbd965871d3fc3b1669cbe7f7a6e57b62a1cab6c5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491419, "uuid": "b66a74de-5442-4144-9b05-c54390680e08", "comment": "Malware payload (AgentTesla)", "value": "beb60f9c90a545fd135478121f8bbec2d38e7a8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491419, "uuid": "e76fc8a5-e088-4156-9f28-72ab32c057f1", "comment": "Malware payload (AgentTesla)", "value": "cc458bc2961d98f2aeefa2c4f33ffdfbf2196a8f9675584bc16bff2b1ab89856f3756ff93fdaadb0f511853271a3a1b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491419, "uuid": "8fbf47ac-b75e-4dd1-a32d-0898d6293c6e", "value": "T1FAD4E1A0E189DCD6F9471DB6487BCC3120A7BA6D98748A1D244E77295AF334330ABD1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491419, "uuid": "0c0d264a-16c7-4b91-be3c-744b0913f5d0", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491419, "uuid": "974cb05e-0be9-4e33-8acf-91de88fc0bc5", "value": "12288:WXe9PPlowWX0t6mOQwg1Qd15CcYk0We1FeG+VXVwPcSW6gUshjY:rhloDX0XOf4KVXVwPzhgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630491419, "uuid": "eab043e4-cf3c-485e-b57a-e91ae20eabc2", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630491419, "uuid": "3122b4b4-a0ad-4301-a245-881abd8c263b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491419, "uuid": "24a156ce-b302-41ce-ad85-b6eef64cd317", "value": "Dhl Scanned documents", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487f618f-0b80-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1630540614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540614, "uuid": "f7ce838e-d785-4f40-b0b3-bb6071e2fbf6", "comment": "Malware payload (NetWire)", "value": "9345d2c9bd66c5e23f0558c6d38d1763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540614, "uuid": "3ebd90fb-c097-485a-baef-06094121aecf", "comment": "Malware payload (NetWire)", "value": "0f67fd50b46ca7283dc172211a42e3ffab7b524a1e2e23433c34c88e657cd364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540614, "uuid": "1af741f7-8b09-4bb9-9ed5-d208ca46064d", "comment": "Malware payload (NetWire)", "value": "7ecbbac88c4f2b4253e481ee398dcf38df5f721a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540614, "uuid": "0cbc3e5e-ba90-41ac-b58d-fcef22012adb", "comment": "Malware payload (NetWire)", "value": "b7dd18f5f8e34c256884b9d069d7cbf0ed18c41792eae861827257563b10fc1187eebf3fa2fa252121234984b49ed78b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540614, "uuid": "02521738-0fd3-483d-bd95-13e758d54c10", "value": "T1A1E5D66637986F92E8E98778811F101493E0FF99E310DB9A7FC970BC1E75B044AC1D6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540614, "uuid": "7336468b-a59c-4494-842a-fab891a6b5a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540614, "uuid": "5bbaf6be-5f7e-4fb7-ad68-01367448b8c6", "value": "24576:MB/8Nnxg99IlM4dtxAuWRLRFRYPqSnOzAIPNo6H9lgLxd4Bn1sw4jKn3Zgf2YSNm:M4ni9p36O8JoXhojUpO2YS4/XVwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630540614, "uuid": "bebbe38f-83c8-4b81-bb2c-73b274f84667", "value": 3049984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630540614, "uuid": "ecf008d1-8895-4993-be06-3e9e64beff2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540614, "uuid": "49ce324f-b6a3-4fd8-b2a8-0cb3501cb576", "value": "9345D2C9BD66C5E23F0558C6D38D1763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ff9f79-0b3a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630510498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510498, "uuid": "abcb09bd-c944-4699-a1c8-4292df030fcd", "comment": "Malware payload (RemcosRAT)", "value": "0629911d271af1a69e2a09dc9ef8cfb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510498, "uuid": "f310b720-5792-4907-9113-0d99dbd0b3e0", "comment": "Malware payload (RemcosRAT)", "value": "0fe89951109e6ef6331f9c96ee018493fdfc88e063a8a42e0ec369c9514c95d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510498, "uuid": "cb3bc69c-0ee8-4d3a-980e-4c25f15c376e", "comment": "Malware payload (RemcosRAT)", "value": "d4a04d08eeee3a2e4cd620c5efdb73865db3dd98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510498, "uuid": "20b44307-3b7d-4cb5-b8ae-e3d209fd8ae7", "comment": "Malware payload (RemcosRAT)", "value": "c53a3f7b8783a5ec2855e3c212441cad53a3cc0e704f3f5bbdfea8c645af6544995161b20a051f7ce35512c736a99694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510498, "uuid": "11ad642b-5fc0-45b5-80ac-16cde34dce48", "value": "T167D47E3AFDF1513ED1632138CC5D672B301BBEE1792924DAABD8AC4485AA5903D6F313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510498, "uuid": "cf518c00-460b-4243-8139-16f29a0bdda1", "value": "b22795c7c5933bf88ce6268fbff58dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510498, "uuid": "c23bf568-cf50-4903-9665-6bd16fea1c65", "value": "12288:ddKKG7bKBAsmMmkTPO+8xbeinq25zff/m/nPsilqj5:dLyshiW+xEgzff/6nJm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630510498, "uuid": "75ae59f2-37a2-4e1e-8b8c-b74bd73a10d2", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630510498, "uuid": "04c17cbb-679f-4fc6-b3e0-42ff71fcd99d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510498, "uuid": "981d78a1-e436-479a-bc04-a36a346988d0", "value": "New_Order_for_September#442625272-doc-signed copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62470d7-0b37-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1630509418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509418, "uuid": "a2f990b9-ba66-40d4-8b6f-91d0feb49ee2", "comment": "Malware payload (Dridex)", "value": "7647498eb8fabd6a7e43ae2c0e328e6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509418, "uuid": "7f8f9b7b-ea2b-4059-b9b5-19470d224bf5", "comment": "Malware payload (Dridex)", "value": "1222325ba5f1e3dc845851be82446af8fa71366ebd702050fd9adcb9dd9b6ea1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509418, "uuid": "7d0d1913-252b-4074-beeb-7cd70e385380", "comment": "Malware payload (Dridex)", "value": "52a3e0731f7a4043d7d070f0bdc60473e169ca2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509418, "uuid": "c2ff9c59-278d-4b9e-b004-ecbdfa82c4a0", "comment": "Malware payload (Dridex)", "value": "a67176ae8ee5f186a74f380f147ada7fdc1f115f0d0065cc2a2f700cb6e050692a35db8ed4059928a211fbcd3ab68113", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509418, "uuid": "d17de0bd-36fa-4b97-b2ea-7cb6859d4c2c", "value": "T16114D067EE8704D9D2D704B0619A283FF75A1A17C538CE2EC5CAC70E8DB652250FE2D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509418, "uuid": "19025406-7ab8-41d5-9520-e16fb643b4be", "value": "186f1499d3d5ae3e8092b83cefdeeba0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509418, "uuid": "31f7fc1c-d794-484d-9e1a-b13c70748807", "value": "3072:cteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzb9qM:gq7fYIHBZkTB6DWruUCOwjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630509418, "uuid": "69f80a6e-868c-4cfd-a1c4-dca8805eabdf", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630509418, "uuid": "71743251-4914-4ef1-817e-901b8586fdc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509418, "uuid": "c7e39a14-3dc4-47c6-8d6a-cd723f4afbde", "value": "7647498eb8fabd6a7e43ae2c0e328e6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd67e07-0b36-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630509058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509058, "uuid": "9e7e827d-fd34-46de-8350-fca82246ddc3", "comment": "Malware payload (njrat)", "value": "0e6d1a1750ba2e5607f3a4c30cd4d3fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509058, "uuid": "79c24fe0-4285-4619-8d77-e4bba4a62a1b", "comment": "Malware payload (njrat)", "value": "12a274ddd6b7467b4e9374d80a3d3fd4e8cfc576da550801adf0bc6b6617bb07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509058, "uuid": "97de885e-03fa-47a3-94ee-4abb11966d5d", "comment": "Malware payload (njrat)", "value": "83ead02316dd86eda8b44a447e3f6760cd8c7a19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509058, "uuid": "1772cb04-6df5-4a95-852a-c3bc390d6165", "comment": "Malware payload (njrat)", "value": "837aebbf4a49319eb5595e8bbbb8b5a47eaec9d0e6b3da3a9ca09e625cdb85ee8f584de49000789065c6ed56b6559ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509058, "uuid": "3b20affc-4e59-4628-949d-dd8c663ab0d3", "value": "T19D05483FAD1635335B99B12ED492194EE69418EF3AF14DDBC1DAB38CA027513B29630C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509058, "uuid": "f4abc9c4-66f7-4290-8fe3-b0ba02f74f16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509058, "uuid": "044cf158-2817-4fb1-8e61-227dea1d79bb", "value": "12288:T26/F84DtPASSVdYiO5GpS4u6C5oWpf0y3k0Vb/AElj8iDxLBYR1p2Z3+Xf6Meiy:T26YjqhXbeaOsvqZyuPd8v1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630509058, "uuid": "b4bdc95d-d4bf-42b7-8ecc-457cb9285250", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630509058, "uuid": "33c6674b-e93b-42a4-b643-ea158d3dd5e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509058, "uuid": "5f69bdcb-509f-4eb1-bd87-e2ec1c0f3dcf", "value": "PO-16065.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8797344d-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482737, "uuid": "c577be6c-921d-4c72-b940-1f06a4055db7", "comment": "Malware payload", "value": "edacf7731f4ac7087ae42eb9e5a98919", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482737, "uuid": "308cbc5f-8e90-447f-9f76-859c757eac34", "comment": "Malware payload", "value": "13b27fe50d1a3dfaccc45fc80c4eaa4e1ec4ba16486266be1470b35d85ccd905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482737, "uuid": "12c2954b-7ac3-4f15-b372-2e8b9cc8e3dd", "comment": "Malware payload", "value": "13d8cd236b3605d0d09fae69a73740c046890a2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482737, "uuid": "5e163e89-9d16-4088-abbf-0df09d86c612", "comment": "Malware payload", "value": "e0a640091417ccf6e427b758d9cc7100d309457f43efca7ad43cb7eba00b5a101ab70c7ac2a162148e4d9fd839c6bfc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482737, "uuid": "e9a89bc8-de32-45df-b948-75668a9252fe", "value": "T16A262312374544AFE4A3367D993F811464EF6D25AD30D36D3382BE399BF2212604BF6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482737, "uuid": "bbd17b82-6f6a-478a-8eb8-322baf133dcd", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482737, "uuid": "00c48e39-391f-4a58-b44d-72066a25338e", "value": "98304:55CLICb/EyjUlrj55nh2lnmdjnDXV3a2W5w1nTYMgAhMkn9xeZFZgN+1nz1/Eyjf:5CMyYV55nh2lnmdjnDha2nTYMgAhMkni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482737, "uuid": "de5c9038-8db4-4c9f-be6d-e24f5ee12387", "value": 4726000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482737, "uuid": "ea847993-6708-428a-b94d-dd812c29d815", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482737, "uuid": "70c52c20-4e18-40d8-8953-3e1905d9fbe7", "value": "13b27fe50d1a3dfaccc45fc80c4eaa4e1ec4ba16486266be1470b35d85ccd905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2a22e8-0b0e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630491949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491949, "uuid": "b1c9d431-45ad-4afc-aa2d-0af8d95b469b", "comment": "Malware payload (RaccoonStealer)", "value": "06a1911568a01e0d107a3b12c177948d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491949, "uuid": "4c7fda6f-b0dc-4fb7-891d-0f8d2cb5d942", "comment": "Malware payload (RaccoonStealer)", "value": "14a0212c393bf55f873eca41cafc64ebe116e0327b78fc699a1fc8e4b9da9f9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491949, "uuid": "74683347-780a-4d8c-8893-97d33e2ccc70", "comment": "Malware payload (RaccoonStealer)", "value": "acd0800f916d6d16e4b6e3bd2de848571bba2bf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491949, "uuid": "4b38685c-af96-4dc7-a484-5cbbe3e6cc73", "comment": "Malware payload (RaccoonStealer)", "value": "5e20bb5b2d6ea7b6335d618d5a97e773c8cd9f9c38cd726a3f970dc3be9040125a0699aa69591ad2941382f0919d38bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491949, "uuid": "296264cf-29d3-4d3f-a29e-15f612ab8364", "value": "T101C4F12731B1D837C550C6B18C7993F54A26BCA91D22C68B77CD661F2EF13D2AB26312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491949, "uuid": "17eb7603-5e65-42a1-8f17-396e7bf1fbc6", "value": "4dfee2d5d789a471aa176a087571f5a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491949, "uuid": "93afac32-3bbd-4f2c-9984-408b6a2a9881", "value": "12288:aPkaT0r0vz5dZbWcKuKtJ2fvZYJkHziiq1ybpkkaX59Y:aK0vz7ZbDKuKtJBi2iq1ylv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630491949, "uuid": "71f60889-c599-4569-bfec-feca5876c89c", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630491949, "uuid": "70831db2-e530-431f-86c5-a08fb7397943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491949, "uuid": "36f2c0b6-8f78-4b6d-adfc-bc879f1ea8ac", "value": "14a0212c393bf55f873eca41cafc64ebe116e0327b78f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0179b449-0aea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630476070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476070, "uuid": "6afa82d1-37b0-4db7-8b96-1fcbf9000000", "comment": "Malware payload (AgentTesla)", "value": "b9fa9fee75d0c5d2631a2f14e19adcb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476070, "uuid": "cd1841d5-6b32-4782-8822-b059611ea156", "comment": "Malware payload (AgentTesla)", "value": "153b42776cc381b3e5e8e7850458b76b94682a533de0dedfa20e36f59ea462f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476070, "uuid": "a735d227-a151-45ee-9766-b71b4914b749", "comment": "Malware payload (AgentTesla)", "value": "e87b7192cd2e2aa4b67f4c1acaf2cab0a8346d21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476070, "uuid": "945ad9c0-9bb1-4d6a-93b3-f8d64a8415bc", "comment": "Malware payload (AgentTesla)", "value": "b46485e54e8350f9621ee0541461fe83321e86d24e87d2cb9c89e478a94b8cd6872cabbf3d63059d234a49756f9369dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476070, "uuid": "753b7516-530d-4fd4-a1a1-3ddc3629fa9a", "value": "T183B4D09C7690B19FC55BC936C9A81C60E760B477530BE307A45326EDAE0E69BCF025F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476070, "uuid": "9e209b3a-4daa-431b-ae52-852c3d390e7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476070, "uuid": "987d94c1-64d9-499c-89d8-ee6baa856373", "value": "12288:FZk/A/bfHSLuRwe3NBZwn51gJHI39wxbF:FZiA/rSL/4BZ8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476070, "uuid": "13924b3c-4188-4670-abc5-d195cbb6f3b0", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476070, "uuid": "7b89ed9a-6354-4a10-b25b-477a6aeccb1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476070, "uuid": "3391d377-f385-40c9-84c0-f3406c9ba882", "value": "swift_copy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a9298a-0b43-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630514301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514301, "uuid": "de739771-4349-4429-b370-efab3745dca7", "comment": "Malware payload (Formbook)", "value": "8d5b808f4b0eb2f0c6e0e08d47e00ba6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514301, "uuid": "eaa5ec1f-0851-47fd-b6a3-6b954e07b876", "comment": "Malware payload (Formbook)", "value": "15500244e3dc1de0b63b0b8342380ae569510f3b932ae3c3ce8096bc7c1161ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514301, "uuid": "556bbeb7-e24c-4e34-829c-8fb9e5dfa972", "comment": "Malware payload (Formbook)", "value": "90e929f443070d1edcda0cbec60039f263908398", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514301, "uuid": "b5930b89-2d93-4359-a244-27e975247d76", "comment": "Malware payload (Formbook)", "value": "1c9bd7551f9ea03a7afcc7401faaa468031ef9d4cd9a1b911d5fbe3a9baaf3178447177e6a0f179769996558babc16b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514301, "uuid": "655ea212-8122-4837-ac10-7b856676b2d1", "value": "T173E42B3E19FE23279176C7D5CBE08823F2D099AF3233A96467D743664316A4675C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514301, "uuid": "392c1ac2-71e4-4b87-a255-561c27082320", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514301, "uuid": "47eb8949-9129-431e-a9c1-a50f3dce0be0", "value": "6144:A1BDD37EQblRS1FJLgGH2S3K3m7CHAWeWhwwLwjKt/Oke42W9qZ2a0rrpwdPaQDu:A1BDDL5XS3KdLL3tbu7/Cyy3cz3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630514301, "uuid": "5d51a94d-e61e-45b0-8c16-24435306dc32", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630514301, "uuid": "1c822210-3bf5-4799-a3c3-3a6275883183", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514301, "uuid": "ebdc8ce8-0a66-4730-ad00-db51910d03fa", "value": "8d5b808f4b0eb2f0c6e0e08d47e00ba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdec888-0af5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630480839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480839, "uuid": "7bcd7a2a-210e-4428-83cc-75fa3f58e8c3", "comment": "Malware payload (Loki)", "value": "559255eb113e74eb8a67de1848e3adc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480839, "uuid": "b06cd4e0-e56a-4c0a-b24f-d85bd9f5112c", "comment": "Malware payload (Loki)", "value": "1675fb76302c10aa0fe1f2f538357e39aeaba6c7162921c3e6c9a4cd3ebedd60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480839, "uuid": "8ccba68b-2f36-47e0-8bcb-56d81f4e1215", "comment": "Malware payload (Loki)", "value": "aeb75859ff39d6ffa63545c66d8fc074dd28293c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480839, "uuid": "6ea11bf3-7f94-42f8-80e7-e80ac6811530", "comment": "Malware payload (Loki)", "value": "5ee08ace5b17bd5bad9750a2023ef8658e1602d53b9a57852a2138725ba36d59852e86a946e6f8663ec0078427c27536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480839, "uuid": "a017dc44-9b52-4206-bf55-1bf69aec7756", "value": "T165D423114CC48CB1EB16B331E0E3CF951879B5238D8A276C9359E66DF4B0343E563AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480839, "uuid": "31d0b99d-392a-4571-ba9a-3ab9acbe6754", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480839, "uuid": "dfbebb39-b3f0-4b1d-a26e-4f989e64832a", "value": "12288:3Xe9PPlowWX0t6mOQwg1Qd15CcYk0We1zukNT5r1z9KpYd8P:ehloDX0XOf4v5rt9KpYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630480839, "uuid": "4c582b9a-e35a-4b29-a711-77490a73a6d8", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630480839, "uuid": "41383a39-2654-4a7b-b895-f340c98f827f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480839, "uuid": "f1512444-d75f-482e-9f0f-0eac6c269a9e", "value": "559255eb113e74eb8a67de1848e3adc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67424cac-0b48-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630516613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516613, "uuid": "cc6124e8-1d89-4a16-9de0-c708967cd9a9", "comment": "Malware payload (Formbook)", "value": "b5042e0df60ad4d8efe848b3227ed9e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516613, "uuid": "2844f26e-c4e3-4039-b93e-f280c4e10615", "comment": "Malware payload (Formbook)", "value": "169a316f9557b3a154c1cbc1ab4aae2b690d71fd197ff39ac77e58c7e7db4196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516613, "uuid": "6f964b3a-f198-4773-8775-c95e2d6c51c5", "comment": "Malware payload (Formbook)", "value": "ec40a3c552a361e303c5e4eb1450cd1c51c9c22c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516613, "uuid": "1c151ed5-b39c-4b41-a61e-5965c87e90ea", "comment": "Malware payload (Formbook)", "value": "48bae6331086ad86b8713c1402b67208e2c141a824c6bf01ca8b7c52b9598d1200478bf2049f873276d287457d956fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516613, "uuid": "29b63eab-0d4a-4aa9-92c8-8b27be5e8009", "value": "T1A8F42C3E18FE23279176C6D5CBE18823F2D098AF3233A96567D747264316A4675C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516613, "uuid": "6a2c03e8-7f62-4406-b3e0-196056c594a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516613, "uuid": "b6912f35-9362-4724-b5c1-b6ac5d4ff54f", "value": "12288:KTBD+1uPgBa2Rspe6rOEhk/0mg8fJq/pPMv/8:d8sRsg6tH9PMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516613, "uuid": "24a4b183-06d7-482c-9440-b92ca9ab7878", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516613, "uuid": "0aed517f-8712-44c3-9a32-1267cd923538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516613, "uuid": "a838977c-1e5c-4e9e-9297-a99e95314056", "value": "Quotation#QO210421A87356.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee532ed-0b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630504547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504547, "uuid": "5e461d3b-0abb-4e6d-a490-8559177a170e", "comment": "Malware payload (Formbook)", "value": "a0ff38a209b89f1ec079e16847b696d4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504547, "uuid": "98a3ee35-530a-49e2-a415-d4318e940391", "comment": "Malware payload (Formbook)", "value": "181c155d803dc8a7e16b622b143276419d8433d55fefae673e6bb2149eb4e081", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504547, "uuid": "07c098c2-734f-4236-b9bd-68023617b08e", "comment": "Malware payload (Formbook)", "value": "2a1891664c07117975622dbc04617cc0298d93ea", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504547, "uuid": "71bd35b1-1a99-4e92-ae18-ee4be1f1a731", "comment": "Malware payload (Formbook)", "value": "c950efa0d4101cefed5f14724c947a72bca0014aad43e08fba8c3d49b6897c77b23c506394cbc61045a2eaeb2ad9fe36", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504547, "uuid": "33f6ba02-c37a-4b4d-a981-c6a038d09b9d", "value": "T1D1A2509CC5974A988F86ABF86B0B2F45124C766EF7889932317C977527D6C3B601383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504547, "uuid": "66ba2e44-832b-49cc-9efc-7b6597837580", "value": "192:gAE6IZeoe82UGr7tHbzpmwFM0WNwGCOhnmsi3TbZvmr/gvC9rkNjWrJ+wYTknQ2:jENFYdbkEcwGVM3T1mLvGO+wYCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504547, "uuid": "a0b57bd1-3e34-4b02-9dfe-9db4b2b0e96b", "value": 22256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504547, "uuid": "aac100dd-7e61-416d-8ea1-556cb773e666", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504547, "uuid": "d2d22f73-d740-436b-b285-6b2a54f6e671", "value": "RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54546f8-0acb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630463138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630463138, "uuid": "6b40c760-c670-42b6-95ba-b637474d643b", "comment": "Malware payload (Loki)", "value": "4992f84319970e733d168e6ad773a004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630463138, "uuid": "56fed721-10ba-48d8-824f-f839d0b4472e", "comment": "Malware payload (Loki)", "value": "18a0f81301bf191cb94219522948580bb2036c5025e3a723fdd6fe353d840b01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630463138, "uuid": "528080ac-6762-4601-8686-7d99d61cd1f3", "comment": "Malware payload (Loki)", "value": "6f98bab8bb0e510c4b7ab7d197de7aff0810473e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630463138, "uuid": "1b07a9d1-feeb-4887-82be-54b5c38ff40b", "comment": "Malware payload (Loki)", "value": "a0ad8bcdfc9bb4cc7ca4851240ee975c97e43c7ecdeaadc2a3b5eb05b137f89ec1ef541158edd10ab464cec4208c8279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630463138, "uuid": "bff3bea7-c0be-453a-b62e-a8277a0a07aa", "value": "T140C46A49FB89BA3ED4BD4BF885BDDB922D301DF06B9197F52787368908B2102690F471", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630463138, "uuid": "a515e6a9-c8be-4531-9f63-3d802b6ecd4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630463138, "uuid": "dab4cee4-3a93-4a1e-85e9-095cee4a3e86", "value": "6144:hP9Pl/UAnYMY1d+ynpg40W6O9FsfHxRgH+KS23VLb5O0Vlc9jJnBQKV9xi36:TppYMY6ynpDbInMlLU0/SdnBhno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630463138, "uuid": "fac25dd7-54be-4be7-813f-1a83107705df", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630463138, "uuid": "63165e29-85ae-4184-a85b-a2be8572503c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630463138, "uuid": "a9aaed00-52c4-413a-816a-05fbd4904fac", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0ad41b-0afc-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630483958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483958, "uuid": "aa90c03f-f6ee-4106-a6dc-4bfbbb6ec5e7", "comment": "Malware payload", "value": "14abd57e8eb06191f12c0d84f9c1470b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483958, "uuid": "d45fff02-8eca-4b9d-9159-9f1e7595a6fc", "comment": "Malware payload", "value": "190e0ce36c1a63ec976f7e80618c620f75f853a370ea3e602253a98781f4e5c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483958, "uuid": "f99fb262-f779-4ee8-bca7-5c7feae62f1d", "comment": "Malware payload", "value": "8a2677c671504aa9e7b400778819a92fc9317979", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483958, "uuid": "b4f86ff9-6a10-4739-837b-d3e58769dd7d", "comment": "Malware payload", "value": "456717d5b983772bd60e95ccd8fa7b69ea1cf3f11205f1e69bdaaa11b13da1193de18918e05abf6c9d993647a3331347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483958, "uuid": "df39d834-e66b-4857-860a-948b0a71748f", "value": "T11C964D1AFC9244EAC9BFE130979657227E3134AA833177A35F9099A51727FE4793E300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483958, "uuid": "e69c6dc6-dd1d-4ab5-886a-3e12f517f3f7", "value": "98304:IOA9aObWseFf/760dDwkn0VcluvX4+/W3veqGlrM2neX+A:pRObWseFfD60dDwkn0Dv4+/WYlne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630483958, "uuid": "2f306557-f412-469f-b04d-91ff526c2ac7", "value": 9158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630483958, "uuid": "caee585c-bdb2-42e1-9da0-7f3343e5f911", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483958, "uuid": "c8412459-bbfa-46f2-aeeb-067838195109", "value": "190e0ce36c1a63ec976f7e80618c620f75f853a370ea3e602253a98781f4e5c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb57f916-0b2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630505158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505158, "uuid": "6b05860b-e536-4b6e-818f-bce75d5b6741", "comment": "Malware payload", "value": "e9a161572984eaf317cdaa938a443efd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505158, "uuid": "3c5ebe33-d0bd-4ad2-8298-b09ab6db0aa8", "comment": "Malware payload", "value": "1b0679b55c6ea0727ac51fdd25fb5ae629af959a902bc6a94e431662bf8d9cd0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505158, "uuid": "c48bddce-ccc1-49ca-bf76-ef8b938f8db3", "comment": "Malware payload", "value": "c4a8d3c2047ec95b4b2b072fc0d536bbcab11efb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505158, "uuid": "d4e6bbc9-38b9-408e-93f2-d7709bf934e0", "comment": "Malware payload", "value": "3991ddcfcc0a2e67c6abc1e7875cd690884bfa666649c710813511c6161c80d4cc8ee02c17ed9a390ea3ccd861b96c06", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505158, "uuid": "02cc0dcc-c6da-4437-81bb-2b0d17e24080", "value": "T16E258D2076DAC536E57E05B02A2CD75E406D7EB00BB998EB63C85E6F09F09C24635F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505158, "uuid": "7977fbe9-fd7c-4c57-916f-59952c671443", "value": "24576:D2aBqnGIQ5M6DLrVVdWG859GCHrSoUzLyaVtFUl:D28lrXVVdWX59GUrSLzeaVtFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630505158, "uuid": "787d4152-7ce6-4c47-b454-306957f2c495", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630505158, "uuid": "7540619c-fa8f-4f79-93f6-07b0174a2c09", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505158, "uuid": "c1a8503a-3311-4e63-8837-a93481e8d604", "value": "e9a161572984eaf317cdaa938a443efd.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5599a91-0b41-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630513845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513845, "uuid": "fa7a3b1b-9d1b-485b-afc8-ed6092a838c4", "comment": "Malware payload (RedLineStealer)", "value": "9181675e26ed81c4a5ccc3138bad79e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513845, "uuid": "ed428c00-176d-44f1-9ad3-80a8177c7c47", "comment": "Malware payload (RedLineStealer)", "value": "1b1b77a66ad95903616f7b8b6652980518a447d01c17312279a434b9935ef4e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513845, "uuid": "29010bd9-1ded-4ef5-a5ba-eeec0d1437a1", "comment": "Malware payload (RedLineStealer)", "value": "b287748e8b40b456949a876cbb48410fc7d6d2de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513845, "uuid": "88709e0e-10b6-433d-b127-7be7df86a23d", "comment": "Malware payload (RedLineStealer)", "value": "0b8f8e2a0bdc82dd54c16537449f1624193bdf4f001779d041446ae910c86df28785198df27199712faa240b9ab1b5a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513845, "uuid": "b5df03f3-516f-4ab2-b2ed-10be8e2dacb7", "value": "T15284D00B32E0CC3BE7A506317C6697B95536BCE95C22D28B7BC1276E5EF0291DB12316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513845, "uuid": "2060fc7d-bada-4696-9827-6d9c9c1d96f2", "value": "7449bb1bd2f7cf11b31b665cb048bd37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513845, "uuid": "1e6ccbda-598d-47fc-b7af-75d00f59bfe2", "value": "6144:FNH2LL1STUl4hPJ4ZNaz3VuH9qjbzyfCQFsIanX59EPCmK:jH2H1Shx4ZM3VuHAjbzytaX59Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630513845, "uuid": "895a61d9-a347-44ac-9a86-7ded8da7770e", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630513845, "uuid": "edc70a9f-6e2d-483b-96a8-9b76e4381409", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513845, "uuid": "d39c972a-cd08-47cd-a500-87a0782976b9", "value": "9181675e26ed81c4a5ccc3138bad79e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad91cb33-0b3a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630510718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510718, "uuid": "66efe22e-f747-4170-8d25-966e2c845850", "comment": "Malware payload (AveMariaRAT)", "value": "286e00e6d76848bcb0c0eac7b87ea847", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510718, "uuid": "ecc61bee-2307-42de-90e9-4da340418f99", "comment": "Malware payload (AveMariaRAT)", "value": "1b1eb8f42b0b48cf428e19c9c8b21676c41faca886e392c6d6f05de3120297c9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510718, "uuid": "99e1aa1c-1e15-4dbc-af36-73b88546f44b", "comment": "Malware payload (AveMariaRAT)", "value": "17de947c036244b1242ecde54faa543ccaae9f0c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510718, "uuid": "6d5513a3-1d00-40f0-a92a-228437988db6", "comment": "Malware payload (AveMariaRAT)", "value": "9836409759b577c6808ecb665f162bfba63890bf1c5efd71141a52e24fee36bd973a5092aacdc7f515687681ec3da25d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510718, "uuid": "de3b626c-3411-4192-8548-f989306421b8", "value": "T1AED47E46D28489BFD573283EDC2662D879A5BEE41F780CC67AC65988FF3878131A5343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510718, "uuid": "0aa97019-4168-4cb0-ac1d-d8adf56b7c87", "value": "b22795c7c5933bf88ce6268fbff58dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510718, "uuid": "f4f0a77a-a17a-4aab-841d-d764e7f955b6", "value": "12288:ddKKG7bKBAsmMmkTPO+6xbeinq25zff/m/nPsilqj5:dLyshiW4xEgzff/6nJm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630510718, "uuid": "9b123339-397b-4708-a7c3-b4eb97738261", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630510718, "uuid": "2db3c0ab-4d04-4afd-b18b-3b5d9eb2f99a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510718, "uuid": "d731230f-dc04-4538-9ced-90ec240d3870", "value": "pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a84582d-0b0a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630489829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489829, "uuid": "7d4ae4d7-919e-4ddb-8421-818052f9dcc7", "comment": "Malware payload", "value": "509a7863c5dfc6a185ac061725ae78b2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489829, "uuid": "c0e0c19c-47c9-48e3-b5c1-2f67c8deff52", "comment": "Malware payload", "value": "1b989b05234ac05b5f641331013912f577c53e142f8cf6f7bcc291000b46f882", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489829, "uuid": "3d91aa82-8e53-4c8e-a3c2-983a5dbd66a0", "comment": "Malware payload", "value": "7bc8282a7537566b915d2abaf49eb8d31fa36641", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489829, "uuid": "b07ad105-00cd-4329-b3ab-8969a68f8f3b", "comment": "Malware payload", "value": "cb8a7932407650793493c95c1d2c94b00b59ca61984c230d44e014b42f5127198842cc1d708141e5a9b056df800e73e5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630489829, "uuid": "d86853b7-e388-47c5-97db-f1bc96fe52ec", "value": "T1FA258D2076DAC536E57E05B02A2CD75E406D7EB00BB998EB63C85E6F09F09C24635F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630489829, "uuid": "789dff7c-b621-4c66-a4a7-d1009a32bdab", "value": "24576:1saBqnGIQ5M6DLrVVdWG859GCHrSoUzLyaVtFUl:1s8lrXVVdWX59GUrSLzeaVtFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630489829, "uuid": "d35dbee1-0e43-439d-8cbd-5fccb968f767", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630489829, "uuid": "27a24a14-c585-4da9-a98c-00b384ab60ea", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630489829, "uuid": "217c8877-2ed8-424c-b9db-ff60376fbd18", "value": "509a7863c5dfc6a185ac061725ae78b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e541c0-0b41-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630513573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513573, "uuid": "4dfd7fe6-bb77-449d-96a3-ea8f9860deef", "comment": "Malware payload (RaccoonStealer)", "value": "a1ab525d10c7e6d542741ffe6da38400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513573, "uuid": "d390af94-8efb-46bf-9755-d05aa90bba62", "comment": "Malware payload (RaccoonStealer)", "value": "1bd2c06b86beae248116a504e6536faa78a0e38c4b4d08808a12fab0be52f50a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513573, "uuid": "99e6f700-7385-43c1-b2c0-c48b931dabb9", "comment": "Malware payload (RaccoonStealer)", "value": "d2664d82bcc745af0b69a693b1259aba366b371b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513573, "uuid": "a5f85e13-8a4c-4f92-a574-614c2a019f32", "comment": "Malware payload (RaccoonStealer)", "value": "c2a00efc489e7aa7f074e8508f46fe633c6221c8a2faada3234fd6414e5404bf15e2d8e279dc2b7fb4e0bfeabd73d948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513573, "uuid": "b0a681f4-76d8-466d-9263-73ae17e5ec86", "value": "T19A65DFC09E4BB91EC22AB370704080FD83A73D2255DCA7E76ACBFDCA976343556906D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513573, "uuid": "afcbcf3f-33e9-4b4b-9963-21187a1bee58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513573, "uuid": "bde3fa5e-6097-4494-990e-88380a2e9558", "value": "24576:CykI6jw9Ipym5WBMtKLRAv9BPdy0uBwydSwysF3AzJILCfLci:/BStWBM0LRgohbcR4OmiLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630513573, "uuid": "3e3e68e8-7507-4cc2-a0c3-0c8548e7f6ad", "value": 1484800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630513573, "uuid": "c26473b7-dce9-425d-a2b3-af6d1e68413d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513573, "uuid": "40e797d2-81a4-43e1-b8aa-bcfea5ff1903", "value": "1BD2C06B86BEAE248116A504E6536FAA78A0E38C4B4D0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b872e8a-0b77-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630536726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536726, "uuid": "85f6f0e8-dfbe-4e74-b8c6-93e26bbd027b", "comment": "Malware payload", "value": "551034ce6f4665cebccbb79b2898f89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536726, "uuid": "700e6c01-8a7d-4bf7-b5c4-a4811458f7bf", "comment": "Malware payload", "value": "1cd9ef92c56b7fe1324c0df4a3597e1b935cca3c0b1ab85dc23e316165a2c0c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536726, "uuid": "ef3a541e-0f04-464b-ab7f-1c58df3969b5", "comment": "Malware payload", "value": "8c5c2c74a8396b3ab8091579b3d9c279b87144a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536726, "uuid": "8769cc41-7e86-434d-86f9-8e02d53d3d99", "comment": "Malware payload", "value": "52256ea399e0e0a488d8b63b1e95caf790e6f7c16b4c0a5365c5e791143efdbd25ff267a1f76859ef6878b70b1a00994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536726, "uuid": "3f93cfe4-5d0c-4934-8d78-695bbe4e6198", "value": "T16494D418B228ED0EDD2987F40EB9CF981A90BE101DD1E99F37963F0F5E32152552E287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536726, "uuid": "4566f81c-139f-4d2c-8ffb-d2c0136f4dcb", "value": "1536:CD5TjiRYF8jkBjWwyj+/cF9RwEBQUPkgb:CFTjiRYFAkG+0F9RwEqU8gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630536726, "uuid": "2a5b8ecc-a01b-465c-9acd-e325074551a2", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630536726, "uuid": "3205645d-7051-459e-9d59-c5a334dcda52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536726, "uuid": "c784925f-df77-461d-ad92-59725c4f1453", "value": "551034ce6f4665cebccbb79b2898f89a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b55459-0add-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hancitor)", "timestamp": 1630470903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630470903, "uuid": "c4ae91e5-92d0-4332-a834-b3a33df91719", "comment": "Malware payload (Hancitor)", "value": "01b4c1b05cda2b5f8683735cfd3169d6", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630470903, "uuid": "9c96821b-550a-4237-869a-9b97a4191478", "comment": "Malware payload (Hancitor)", "value": "1daf0bbe815341fd6e81fcf7685c519e25a70f29bab084d7f9e5cdb335622081", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630470903, "uuid": "5721c19c-0819-41ec-b948-6d8485d12bb4", "comment": "Malware payload (Hancitor)", "value": "1fd8b0546820602d93b2f66abd6214ebe6b1dd17", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630470903, "uuid": "188879c1-5bb9-461a-afbf-e33430410bb8", "comment": "Malware payload (Hancitor)", "value": "4d946a25b5b530ed5de76ddccffcc9ecb9c302a67a3bdbbe1a70cd660dfa265242aa3a1408ca3b777994c0c4f9aa6c28", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630470903, "uuid": "f6e3e5fe-4f3d-484a-90cb-596b84b89066", "value": "T17694E007FA55CE57E18AC7787FA2EAA92B69FC048E08B3C731653B1E6F752508C03615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630470903, "uuid": "2c296758-d9a6-4a9f-9bfb-6c40f6d4011b", "value": "12288:4V9iQsDr8NnClDfKTFi1w06/vbOes1AOrk4P:4VXkr8NCNfKB30AOesoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630470903, "uuid": "b1fb1308-cb0a-4961-b3b9-8cd056c096bd", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630470903, "uuid": "69fe39c8-9c78-4ac2-9fed-ec79bcd60c6b", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630470903, "uuid": "6b9388bc-d271-47d8-b6e4-abc2a9205518", "value": "0831_6714166058.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21172135-0b38-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630509624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509624, "uuid": "102d5800-7ed8-4210-864f-4f312395b3d5", "comment": "Malware payload (AgentTesla)", "value": "e0451d892c3bdeaf0c7477fff6f2f529", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509624, "uuid": "4743f865-a364-4f6b-9725-e6dc0f9de5b2", "comment": "Malware payload (AgentTesla)", "value": "1dd9b2ee10e6a2b338d8e743d22226f7895e754b0ca2dd66ff5c8461fb376eec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509624, "uuid": "23b76bce-ed0d-44d3-a853-86f7ffb34d8e", "comment": "Malware payload (AgentTesla)", "value": "b48771f4d0a2868a8249353b4820404f128b2056", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509624, "uuid": "aaca75c1-bd97-4679-b281-7084880b19d3", "comment": "Malware payload (AgentTesla)", "value": "b1fc00b0d9d0fa9f2f8c6abf4d4bfa943b24f544cb94cfaaa82824dad6860ed9ac3f82950e083ee7e44a225b603460c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509624, "uuid": "924d9cb8-8f22-4854-80a5-af4408069a2d", "value": "T14815DF3DAD2626336FA9B17CD4D6194EE79414EB23714DE9C1E2B38C200B917B6DA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509624, "uuid": "a11c9bc6-c6ab-4365-8055-8e8ff45758b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509624, "uuid": "e1d1e849-6934-4f3d-b3dc-c34b0191bbb2", "value": "12288:Zm/F84DtPASSVdYiO5GpS4u6C5oWpf0y3k0Vb/AElj8iDxLBYR1p2Z3+Xf6Mei0W:ZmIYtnpwUTvF9Rih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630509624, "uuid": "469356ba-3dcc-4f9f-8069-6a7631b3af80", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630509624, "uuid": "ba82f0dc-3aa9-450d-8d0b-fb10f0cded44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509624, "uuid": "3f34b429-9345-4129-a740-18c374163862", "value": "PO-NX-LI-15-0001..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd64ffb-0b51-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630520574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520574, "uuid": "49384011-a44d-441f-bfcc-d15bca7126da", "comment": "Malware payload", "value": "91b08896fbda9edb8b6f93a6bc811ec6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PRIVATELOG", "colour": "#EDDDAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520574, "uuid": "d4b6a4fc-3156-4e0e-a038-7f82d1daa64a", "comment": "Malware payload", "value": "1e53559e6be1f941df1a1508bba5bb9763aedba23f946294ce5d92646877b40c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PRIVATELOG", "colour": "#EDDDAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520574, "uuid": "b48797ad-6360-4f86-a793-03ae4101dde5", "comment": "Malware payload", "value": "2946dce2f77bccc21b782a9d9efeb2018d953564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PRIVATELOG", "colour": "#EDDDAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520574, "uuid": "e8487d82-ae31-40fc-a238-984becfdef1c", "comment": "Malware payload", "value": "0ca7ee4e4abbb2cc1361d9fc881eb28a6c420e0c4e1f786b6de9c103f8007d74317509e211b6d26a96a23e43ff6ff875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PRIVATELOG", "colour": "#EDDDAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520574, "uuid": "4ed5d59f-87da-46f3-83fb-32366c64fced", "value": "T1CFE3170BB3A140B7E57681B68A239A06B7B2F41107209B9F0769066D1F537B19E3DF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520574, "uuid": "0438f565-c36f-42d6-8b81-70b39f78e632", "value": "207e4c5010e9cb8c1e3d7cd6712ce362", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520574, "uuid": "fa7f2fc1-ab19-4edd-a5ed-9db9e92533ab", "value": "3072:fUGSLoZ6HyD0B8TXUGcMHPT2HLMsmFBZupaxr2UYs9uLb:fUzL20MXUGVLYMsmFBZu1Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630520574, "uuid": "48f5edad-72d0-4641-910c-8ad25eee3ae1", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630520574, "uuid": "7018ad93-dede-4554-a6f2-8be806e2e006", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520574, "uuid": "cdeb094e-19ba-42a0-bf39-258a34c055a8", "value": "#PRIVATELOG.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0a8b79-0b63-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630528134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528134, "uuid": "881cac22-7bb1-411b-84d6-487a6a15274a", "comment": "Malware payload (Glupteba)", "value": "15225c230c9c4d014af18e73cb9e6194", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528134, "uuid": "40952ccb-bba6-4608-b85d-b57b6e25c36f", "comment": "Malware payload (Glupteba)", "value": "20586a2f58155f672c3a5356ede6d6eb515246da481d92c724971c1536ced8d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528134, "uuid": "20924773-a74f-4f6f-b099-ca0db2ffccbc", "comment": "Malware payload (Glupteba)", "value": "afe9bf269a8ac598eece3e0f36591a59a04913aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528134, "uuid": "1a4c7d34-e7dd-4cab-bc6e-f218e50e0deb", "comment": "Malware payload (Glupteba)", "value": "01077ad0a4969d088cdc03711a40b54c100fde8f636db48d6e1ac040939143e0eff4a146bcc2ae410e71a93f86ae8db1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528134, "uuid": "de5647f1-7242-40f0-af81-5823e091ae83", "value": "T1C726332F2791D0B7D8DC073449C54FF996667E599C04E81B2F811B6EEAA93A2C706333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528134, "uuid": "5236ed55-ac48-468b-bfd0-0c2e608f19e0", "value": "2617ed69d5fa8c0972283727d551e89d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528134, "uuid": "0d10f592-7779-4c4a-a07a-145b072bd2f0", "value": "98304:hv1Ien0lEuPLzWdMA0ZHlBWxO9ujyb1U6h3M:34kMAYl8xO9cwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630528134, "uuid": "e120a5ed-cf18-4e4e-aae4-187e2122779c", "value": 4628008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630528134, "uuid": "12916949-e326-4d68-8668-fd30a156bf5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528134, "uuid": "b9d9cbfa-59f2-4d56-8a29-40b902251f23", "value": "15225c230c9c4d014af18e73cb9e6194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ef4691-0b38-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630509929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509929, "uuid": "973075ba-565e-464b-844b-81b364a75e8f", "comment": "Malware payload (Formbook)", "value": "caee75efc8bd1904d750d941d6a760b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509929, "uuid": "95e3795a-f1fd-43d8-ba3c-142148c38369", "comment": "Malware payload (Formbook)", "value": "205b063d9085337a5339cb50abc7cadf48a0ccefc6fd4e5c923751339cade6af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509929, "uuid": "b3a52f19-1f0a-44d2-b98e-9c0c35aeb9f7", "comment": "Malware payload (Formbook)", "value": "60471785ea81572b965da4dfcac752a5e9415f89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509929, "uuid": "7b53a8bd-e64d-49e2-804a-acdf5dcc75fd", "comment": "Malware payload (Formbook)", "value": "0e1319485d50e1a0870e50aaf8c4a39867f7e4e4858b6fab55232d94da53a68627e5f5378ff521fb992fe7673051d348", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509929, "uuid": "ad06549e-1ce7-414c-ae58-23d63767302e", "value": "T1D3B4E09D3240759FC927C97699A41C64EB2174BB534FE303A86325AD8E0E6ABCF111F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509929, "uuid": "2a2038ae-417f-4a67-b730-a52277768b8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509929, "uuid": "b2c016da-299c-46e7-b429-45f42e35fa26", "value": "12288:tEeK+R+PuZp5JvqeXaEw0eYLcXiF13SYA0:tEH0JiqaYwI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630509929, "uuid": "82265665-f3f3-47e6-bdc3-1a7b23f72d00", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630509929, "uuid": "10aaaf30-47df-423f-9abc-5af0a1c1edee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509929, "uuid": "b899bbef-fe9c-4516-88b3-c3fbae7765fd", "value": "caee75efc8bd1904d750d941d6a760b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60de3708-0b34-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630508013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508013, "uuid": "da63e579-ca61-4ee9-8cde-0f0897f4a081", "comment": "Malware payload (RedLineStealer)", "value": "e176a4035f884e7e54f732a4b728e9fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508013, "uuid": "c75919cd-4213-4f98-964d-ca9beb9f8fad", "comment": "Malware payload (RedLineStealer)", "value": "20f97a2c26e52d4e886ebb616a8e9cfc727b348b89d13253255c15b2466c9fb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508013, "uuid": "4be98e00-ac88-4037-97f4-0ea3b9d9bff4", "comment": "Malware payload (RedLineStealer)", "value": "ef99ac5d90e06c38950acb0d9db7f396c86d079d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508013, "uuid": "50947816-4f00-43d8-ae8b-e2d4f96e48fb", "comment": "Malware payload (RedLineStealer)", "value": "28445ed6018874aed03506603f9263ac38ccb042a2cfce8c394d7b8f465ce4c0fb00dda14b36db3acb58aef3720d6681", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508013, "uuid": "e6097aa4-de68-4788-880c-dcbbb99dbbdb", "value": "T15FD4CB28657FC019C0E7EEB62DDCA4BAD99A94E3640D763311B4633B8B11B84DE0F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508013, "uuid": "6ee5f7d8-9e3e-475d-a9f2-af3ad37a0153", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508013, "uuid": "d8c19df7-4b80-4e89-bcfb-307a9be833ec", "value": "12288:5XgPC7b94xV/sJI7nD68b618g6ggEfzDehxTjUZW2H82hY:+csRnDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630508013, "uuid": "20f7924b-2456-4406-8689-991e27085a87", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630508013, "uuid": "f064aa7c-aa52-47f2-92af-907e693ae37e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508013, "uuid": "b4821db3-38ce-4d57-9e53-d3e7c200493e", "value": "e176a4035f884e7e54f732a4b728e9fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2567323a-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630482573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482573, "uuid": "d2bf236a-640c-436e-ad98-8a39bbd8627f", "comment": "Malware payload (CobaltStrike)", "value": "be8869147cba2aa0f5dac51e87257224", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482573, "uuid": "16460d6d-a35c-425f-9a16-ddda7f1f5eeb", "comment": "Malware payload (CobaltStrike)", "value": "22c034ac5a7ac3b628cbb37b575ac528030c961490e41bbe9435319fde8db07b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482573, "uuid": "681b384c-6dbe-4717-88e1-04c14d844dcf", "comment": "Malware payload (CobaltStrike)", "value": "52bb07d6d1ceb72d66affc4b77f5ef75627bba21", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482573, "uuid": "ed803c38-43b4-4a7d-8253-5e8220de4a33", "comment": "Malware payload (CobaltStrike)", "value": "c26d9debc30c86b72b5848ed4135d332f7074e7f3dd23712ce47111afb6202c512e6e75f0142a777428dfa07a001815a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482573, "uuid": "ac7f6005-b427-4f6c-aea3-f48a4340c0ab", "value": "T150059D05F3E443B5E06FE139C992465AE7B1386067B183CB8291DB2E6F772E15D3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482573, "uuid": "0c0a24b3-7f30-49d6-8b7a-9e36f201aa86", "value": "96983fda4c49886ce5e114f80abacf33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482573, "uuid": "1a832c97-bdf3-404b-bf51-b9f0787c6289", "value": "12288:7k9s+gHyrgAGYJNf8uIXL9eL2ISZSQ4Yfd7p:7kmyrTt8uIXJeLHUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482573, "uuid": "05445e63-aa72-46ab-97ac-b82a146295b0", "value": 849888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482573, "uuid": "0146d3e4-2e47-4de3-b756-720668301f79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482573, "uuid": "88478679-256e-4ad2-8012-b57cf948189b", "value": "22c034ac5a7ac3b628cbb37b575ac528030c961490e41bbe9435319fde8db07b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1512b55d-0af3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630479968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479968, "uuid": "36a41049-404b-42f1-abfb-c78a881ebea0", "comment": "Malware payload (RedLineStealer)", "value": "9d114fa7018602284d3fff4ff9d918b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479968, "uuid": "826a2033-b27a-4da4-81e0-94d423d32f3e", "comment": "Malware payload (RedLineStealer)", "value": "23560e3e786a9b44cd1d613451898d496cbe13a0bbb80d516a7125871b5aa48e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479968, "uuid": "b0a84799-da8a-40e2-a163-a5d498ae6b4a", "comment": "Malware payload (RedLineStealer)", "value": "e3ba7bde804250c6c6c571a720c0b63ae79d90d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479968, "uuid": "661026f4-da06-4c50-a66a-1a0e305c8476", "comment": "Malware payload (RedLineStealer)", "value": "9cc4ce0cdbd1a212766b3c03af0baeb4b4b78a16743aed3b2f74dea1b3e20d444f0285b8d5b8889e57482b9d770fa870", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479968, "uuid": "ba054012-8a4a-4780-9215-0150368de01f", "value": "T1E984D007F290C8BBF59506318CE5A7B9453EBCA96D27C18B7BC0265F5EF12919B1230E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479968, "uuid": "1080c654-1b20-4701-b807-3799b8054e10", "value": "66f6132807e59bfb21d701cc690ae848", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479968, "uuid": "db1d1a8c-1b56-4a9f-906e-e08e62b27514", "value": "6144:EhXlMLL8TM+HucXwsXC3NlAJSHHe3BhwhoW7mT4YIanX59EPCmK:gXlMB+HuRsXCNlBHe3obaX59Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630479968, "uuid": "56ef9bc6-b8d9-4ee1-abc4-d4c054e4eb45", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630479968, "uuid": "2912fe4b-6f09-4a46-a743-e1bf42e49d24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479968, "uuid": "97aa3204-cf26-492c-8a35-a3742e737cd7", "value": "9d114fa7018602284d3fff4ff9d918b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5aa5db-0b16-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630495015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630495015, "uuid": "678bef05-fa6c-4132-af35-604618599f51", "comment": "Malware payload (Formbook)", "value": "d474153820da6229bb8443151372eedb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630495015, "uuid": "4b30187b-be72-4cb4-b691-5dd94a6eb720", "comment": "Malware payload (Formbook)", "value": "235ba381590281e939399f0b33cb4a95fcf2d0d60f8fb13a179c4aea788812e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630495015, "uuid": "393ec627-9150-46c5-bdc5-4e8715bbb646", "comment": "Malware payload (Formbook)", "value": "10fda3ae42c1b8aac7be30b5e77c7e6a7bb20c70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630495015, "uuid": "bfa3dbc1-7df4-417f-8a07-531df8ae412b", "comment": "Malware payload (Formbook)", "value": "de768ab51105d6582b410f1ca5ec332737dc3e6af0d944ac8b855e1562729aae880db4d573016e0d2187876ecd0b8300", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630495015, "uuid": "39f58106-9cb3-4f48-94c7-941d84ff05ba", "value": "T1EBB4E08C725471EFC527C9728A642C24EBA1A5B7970BE303A45355ED9E0E29BCF160F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630495015, "uuid": "a636d1ef-ef43-4a0e-9f5e-56fc6e50f9b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630495015, "uuid": "8199e547-3b43-4a79-a4b8-a4d2ec3bc552", "value": "12288:m4HuVZsCSHYN61eML9aoXQhnQ/8iIXpcSyzau4xZqNIORlJ:m4SsoHsvAhnQUvGSyza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630495015, "uuid": "1abf789c-e3c9-4077-8849-f4ec3b9bc93f", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630495015, "uuid": "001aba11-43ec-416e-9b9a-7a9e58ae0a6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630495015, "uuid": "3598b88b-f776-4c0d-86ec-744fc624ef44", "value": "Purchase Oder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810d7e82-0b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630504631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504631, "uuid": "6bc94f8c-6ab8-4010-a79b-26a082998b49", "comment": "Malware payload (AgentTesla)", "value": "5251db9fcbb027411c6662cf510ba398", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504631, "uuid": "61d6f87a-7d83-4e81-b66f-6c66bef43993", "comment": "Malware payload (AgentTesla)", "value": "23706cbc8c49dbec025d2ed284bffa50c4af727ef34ec2a734507394fc8f367c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504631, "uuid": "a61a5ab9-e6eb-4ccf-b158-f8aca28ab837", "comment": "Malware payload (AgentTesla)", "value": "e05d14a4a1431206186b002700cbe0a70c6c9c3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504631, "uuid": "ce66b400-41f0-4fe3-bbf3-8cf7b1a08435", "comment": "Malware payload (AgentTesla)", "value": "100772fdb76eda6d8ce78e5b9910e99cd88f854e38cae99fbc8590355279014b93b6a1da0ba65b3760fb3737e84618bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504631, "uuid": "7d44add3-c7d8-4fb6-94c9-2934bd01086e", "value": "T182C4F09D7290B2EFC457C9768AA41C64DA21B4B7670BE307944325EDAD0EA9BCF110F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504631, "uuid": "71e92f90-ca9c-4e44-96bd-cceec3686ace", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504631, "uuid": "2bdeaca6-ebf6-449e-a89a-e07a86a0eef3", "value": "12288:3GjAgpilKRmfRKyD4x6fo4ChuJTfi4yrQngS8ViLE:3GMgpilKofRKa4Af0huJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504631, "uuid": "502e0a37-6d3b-43f1-b675-805dc734f3d8", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504631, "uuid": "d78035a8-4d85-4b9c-b745-ae0d845a3c2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504631, "uuid": "5ec73985-8c07-4e69-ad63-407a208fd38f", "value": "Alibaba.com-PO0092ETD-RFQ_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f293fe1-0b77-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1630536733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536733, "uuid": "10778208-8432-4b31-b290-affac0b97459", "comment": "Malware payload (Dridex)", "value": "63eaaa557edc5ec612450e2c439634cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536733, "uuid": "f4989de2-242b-47ef-87d5-485136a1adee", "comment": "Malware payload (Dridex)", "value": "243672073e7b4d98679f050543e7d5325f39b576a882d2429debb1226ec0942c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536733, "uuid": "ae7b184d-28a0-4f52-b9c9-76e76cf86394", "comment": "Malware payload (Dridex)", "value": "ac51ea814985d9c31c108855797dabf021b2fdda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536733, "uuid": "8b3b6fbe-8d84-4a3a-ad02-59683e8e7ea7", "comment": "Malware payload (Dridex)", "value": "96b8656b7ef724b0fcdd1c27aefba354a4802aa971c2b95eb2e7e0a79aafb074bf2de91f929157c2012e2e97940fb0fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536733, "uuid": "b20aa8e4-948d-419a-9300-2443e9123d61", "value": "T1DD14D067EE8704D9D2D704B0619A283FF75A1A17C538CE2EC5CAC70E8DB652250FE2D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536733, "uuid": "d339e7a7-2b2b-497c-aca7-d87be3a2a1c4", "value": "186f1499d3d5ae3e8092b83cefdeeba0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536733, "uuid": "6800e09b-e254-442a-8034-518f25db4873", "value": "3072:GteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz/9qM:uq7fYIHBZkTB6DWruUCOwjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630536733, "uuid": "93520322-5470-4ea9-9d69-fb7448982a38", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630536733, "uuid": "3c14c8e8-fe92-4e52-b437-2b86c17b7315", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536733, "uuid": "a598ded5-32ae-4e73-bccc-129e71520fcf", "value": "63eaaa557edc5ec612450e2c439634cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b41068-0ae9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630475725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475725, "uuid": "720a5c96-5e76-40a0-8a0d-6452fa99c35e", "comment": "Malware payload (Loki)", "value": "f740927dd70b9818939d1d19f3860b0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475725, "uuid": "25408a29-9bb5-4064-8427-3666be901f96", "comment": "Malware payload (Loki)", "value": "2466b0d75b3a043f2b0f341e7eb9a67612b230228543473dfd7a663338f0688e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475725, "uuid": "268ae9e5-87b0-4893-8f01-b2565c45b886", "comment": "Malware payload (Loki)", "value": "12ced3422c532a16822511219afd630335dd4e99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475725, "uuid": "d08c0887-c240-4edb-b88d-5a43132168a1", "comment": "Malware payload (Loki)", "value": "b4900902fe2366a18f37190f1ffd93883cb8ae5cfc784524797dfbbb84f62bc5248a5cd639342eebffe4355b3b2f81e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475725, "uuid": "5f8c730b-0d8b-43d3-9920-e8ba2e408f9f", "value": "T106D4128648C5CCB6FB16B3358076CF981D5A7433CC815B6C8399EA1E78706439DD2AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475725, "uuid": "d8b00747-f26e-48fa-86e6-65f593738a84", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475725, "uuid": "ce43d2ec-381a-4cc1-a4fb-04d76a6ba700", "value": "12288:bXe9PPlowWX0t6mOQwg1Qd15CcYk0We1trlfi6HA7nu9Ffd4:ihloDX0XOf4JfieA6V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630475725, "uuid": "3e0b7b8a-22f8-4248-afed-c34e32251ee2", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630475725, "uuid": "1916ab99-7b23-49dc-b442-8a61f57a2598", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475725, "uuid": "93b120c9-aef7-40df-98e0-517469ab992e", "value": "VSLMV PINTO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29813090-0b0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630491170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491170, "uuid": "03ec21ab-b439-4706-a8b0-1d1d35dd3846", "comment": "Malware payload (Formbook)", "value": "1f9db0137245508d4ad475170c4811f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491170, "uuid": "2a4d34c9-9e41-40d6-8829-e888824d70f9", "comment": "Malware payload (Formbook)", "value": "24d79b2f4a2aba518237343b7b94b817f51de0afc1e40236a4c267657b113849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491170, "uuid": "dfa642de-cc81-4d2b-b76a-494dcc1a3acf", "comment": "Malware payload (Formbook)", "value": "7f8f0bbd941bc101a114220e4f296bd58a96a494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491170, "uuid": "f52bf2cc-33c5-4fef-a104-fe53f806e910", "comment": "Malware payload (Formbook)", "value": "48e385aa3b334ad0d46f7708a43f975603dd226a6ecd885c03502afb493abeb74787ca6dda88432d0faebe768e7dcff7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491170, "uuid": "8d540af3-c081-4b05-b326-a90009a97e1c", "value": "T115C42325BDED0CD9F5FA90F79EC84F79241D76D70C210BACB098DD686D95A132CA08E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491170, "uuid": "c5bd2210-0fe6-45e8-bc47-855207c579c1", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491170, "uuid": "481d3acf-56df-45ab-a97f-988c0d59a717", "value": "12288:mXe9PPlowWX0t6mOQwg1Qd15CcYk0We1k/IPlFQ7HqOq4RfjQtjgZSFyG11:7hloDX0XOf4uwtFjKRfjcgZSFB11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630491170, "uuid": "cb6ca9a1-50a9-4a08-ae74-2f66209185bd", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630491170, "uuid": "a49c6b6d-a837-4d8c-a3b7-8dc850e992a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491170, "uuid": "db36cf27-deab-4879-9b2c-bb3737d4026d", "value": "SKMCTB_\u62a5\u4ef7\u8bf7\u6c42 37746746363463434783647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd27a8bf-0b7c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1630539118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630539118, "uuid": "d9ad6383-9fb4-4f8e-bed2-504aa2cb4d5f", "comment": "Malware payload (Vjw0rm)", "value": "53d9dc9fa9cc34f33fe03b7c5f5fce6b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630539118, "uuid": "95a18b79-ec2b-4a6e-84c7-7b6b8a77831e", "comment": "Malware payload (Vjw0rm)", "value": "2501e01c4f196967e005c2969f1d692ca8adcb24a23c5d6fb13f9a0b71f2d8c8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630539118, "uuid": "bf06efd4-56c5-4848-8fea-33d89d2cbff3", "comment": "Malware payload (Vjw0rm)", "value": "8d906ed4bfd58c0220765721298ce2e75256b568", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630539118, "uuid": "a4f3cbde-9825-4e1d-a901-b68370d3be0e", "comment": "Malware payload (Vjw0rm)", "value": "01e8bd675664c1faaffedf3ae27b098514e1f14b93db310bfa45fa69cc53c591a3ea6dc2f824794391f2afee29278fc8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630539118, "uuid": "896fff50-075f-4da4-803b-7b708ca69438", "value": "T1A835E0215BC06B99DE9C490BD0BE160E53F1234AD552A6CDB7273F07AFAFD04462BD88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630539118, "uuid": "28ef5156-406d-4bfd-8d46-bb0b672420c5", "value": "24576:VnnSnOBVKSjE0WomnrAXLjEYwbsC6fwC1prbsHn0NO2IOU:lcnraeWHrAg0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630539118, "uuid": "c3be3927-df1d-472d-9b0e-07ae62fc3b4f", "value": 1157171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630539118, "uuid": "7dc7dab4-2358-439b-bb5e-4367b8338d7a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630539118, "uuid": "2eab850e-ecfb-46c0-8df0-e30b52c5d1af", "value": "uVIuZhBZxlNEW COPY DOCSCANNED ORDERAUGIMG6210.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ace8819-0b6a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630531115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630531115, "uuid": "fab41d1a-2a35-4d7a-8820-703086d5e909", "comment": "Malware payload", "value": "a445cf765b601d2a815968b623823088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630531115, "uuid": "0062c9f7-92c1-443c-9e05-0e77d65ab563", "comment": "Malware payload", "value": "26af39550affc09be4ddb80a2b7a0ff2888227e9993751bd9ac8460656b56e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630531115, "uuid": "6cef2fd8-2667-420f-b35e-0764fdaad481", "comment": "Malware payload", "value": "0f2050b73cb1456e926ba4717d9518bc81eef0ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630531115, "uuid": "ca1505a8-2788-4e42-91ce-5320e3106a99", "comment": "Malware payload", "value": "20616a4114773a47fac47f429b55ccc5ad6d01b95b76a6fce29933c4b6c3f20f14cdef1e76288504f7657de77379d3a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630531115, "uuid": "8e48af12-45c3-4982-93e3-ddd524d96dca", "value": "T1F4A5337848587E73DC5657BDA0C89236B9BE7981CBD3801B084CD8B58ABE7F5708709B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630531115, "uuid": "d04fdae2-ef64-499b-a286-6bbca6a91a5f", "value": "089dfe3c8f6fb17df254dd8a884e1420", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630531115, "uuid": "e01d0cdd-1178-4642-9a5c-987a958dd59d", "value": "49152:ipHfJrUWHOGEm5B/1iBcXGxlIzrLxMLy//tUcgtzGRC1GbR0MNUO6KUjFHd4uY:ipHfJrfuGEmb1iBcIlSLeO/7mzGRC19O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630531115, "uuid": "f524b1a8-b05d-49eb-b7b4-c427f9e38658", "value": 2206552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630531115, "uuid": "fb34d2fb-1a34-4cf8-84f1-7f8d334afa60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630531115, "uuid": "3fe59712-5a0a-49bc-9c7b-c17208936643", "value": "a445cf765b601d2a815968b623823088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec33e5b-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482749, "uuid": "90a23b68-b692-4b09-8dc2-27ae46fb9922", "comment": "Malware payload", "value": "0c400fff45d715a6dbe2d21a8531423c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482749, "uuid": "357898f5-deae-49a0-bbae-52b5d5996ccc", "comment": "Malware payload", "value": "274a1df26f7cc09917dfcc151e26d20778a81408f959e7ff36823727e248f015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482749, "uuid": "4b9a7314-868c-49df-8078-2878c835be2a", "comment": "Malware payload", "value": "2516f6fb9c69c3c8de2724aa29c3313f31b19b15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482749, "uuid": "bf61c1ae-d174-46a7-8fba-45578bbfe87b", "comment": "Malware payload", "value": "aa52c12a1e371a4cdc748b55d21f1010f60ab7263b241e06f6e90e415efdc665ac388ba00cc9775637278fe1cbf4869d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482749, "uuid": "92a63e6d-bac0-47e7-8ecd-ce705080f752", "value": "T16205522656D8B979E3F69B307FF252D3BA69BC523834CC0E11D5030D0969A42FDA076E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482749, "uuid": "619d98c9-b657-4109-8b75-29033eb89d94", "value": "81fd276d49dcfb5944ab1253641f139e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482749, "uuid": "a1092521-7a74-4a7b-b6e8-849aa403691b", "value": "12288:oDuWNvtS/PHV4c1JwX2afK+ixeCzXeMb01JQntLOCr6UeM10b:oDlvEPTJmix5zXemr6EA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482749, "uuid": "c8aaa541-a041-4526-a805-4d540f16d53f", "value": 798480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482749, "uuid": "096a1b85-0d8a-4d0e-a767-ea63cf34b8e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482749, "uuid": "5a56e554-1b79-4c7c-96ca-dc3bc1026b38", "value": "274a1df26f7cc09917dfcc151e26d20778a81408f959e7ff36823727e248f015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6cee9c-0b47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630516332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516332, "uuid": "ced204e0-960b-47dd-ad07-0effc78a9428", "comment": "Malware payload (Gafgyt)", "value": "a870824c9c71dcc22ed520566368af71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516332, "uuid": "0cd6aa58-4414-48f3-a05e-1d93e973e785", "comment": "Malware payload (Gafgyt)", "value": "2992a5892894ef151bba5fc307f9a4f150b1d7d070c71259ec068135c5a348e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516332, "uuid": "03b5077c-d977-43d4-b86a-5f6ebd106651", "comment": "Malware payload (Gafgyt)", "value": "ccddcfa53a7bdcb135fcd75da3bfab8ae689403d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516332, "uuid": "78931c8c-40a2-4484-be8d-f8dc0d1b46a5", "comment": "Malware payload (Gafgyt)", "value": "f1c2a62458fd844edcef1c560c87642c68207507919d80f3355e287fa038e0f5967291005f6376984796d415e6d6e7a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516332, "uuid": "34e8b64f-00fe-44d2-8962-65f1bb81564c", "value": "T1CB14857E7E21AB7EE26883320BF76FB0C75521D326A19352E16CD7085E7125D184FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516332, "uuid": "ce3f136e-4aa8-4bb2-8efc-ee3e02ee204c", "value": "6144:mfiq2bfzWZAUIMn/YxlIEXDyDz5hUYPzEymKW6FhdzHrsKO:iiXA5hUYPzEymKW6FhdzHrsKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516332, "uuid": "0bb9cef1-b25c-4668-93dd-4a94dc6eed0d", "value": 200211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516332, "uuid": "f42e190f-8ee8-4e92-a350-a9f8fdca64a3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516332, "uuid": "e47bb894-1d99-46a4-aaa7-bde8520b8e5f", "value": "a870824c9c71dcc22ed520566368af71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babec70a-0b26-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630502151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502151, "uuid": "b6efadf9-95ff-426e-9890-f1a9417fde1c", "comment": "Malware payload (RaccoonStealer)", "value": "503584dba4b32b430fb74ff186f97238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502151, "uuid": "1a9c81d2-0469-400c-819f-5599f10f09a4", "comment": "Malware payload (RaccoonStealer)", "value": "2a2965df35cc748ebcff313e0a4806d5cfe4e8c7e04a3bd70c351157ee228ac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502151, "uuid": "6cac1f75-bf29-436e-9ac3-8fa7853f2c66", "comment": "Malware payload (RaccoonStealer)", "value": "1b102c7606636e4cf6b088441a947b54fbe34078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502151, "uuid": "40e5772c-03e5-4635-9cde-0c73af4046b3", "comment": "Malware payload (RaccoonStealer)", "value": "f1309730678c7b286c6875028311184c0e05772c77c801557be1720147c669daf6b4f98055dde522afb5735a8783a1ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502151, "uuid": "32a2288c-6ca4-4df2-806a-e7e6a0213f7f", "value": "T12FC4F11732A1F83BD19146714CA6D3F97A27FC695D21C5CB32C4266F2EF1382AB22356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502151, "uuid": "2baf1bd4-f027-44e1-a4b4-52217a46efbf", "value": "7449bb1bd2f7cf11b31b665cb048bd37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502151, "uuid": "077cd99d-5d55-4b91-8262-aa5c7eeac9ee", "value": "12288:Sfdi+xpNOUI9xd0I2lB15zgj+OlWraX59Y:Sf8d0RMjhl41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630502151, "uuid": "3c39bc68-76a5-47ff-936a-843bf0c7774a", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630502151, "uuid": "e5647318-def4-4400-b819-3a0277588442", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502151, "uuid": "b0d65589-8210-4c67-927b-73cf74183b8b", "value": "503584dba4b32b430fb74ff186f97238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8569bf7-0b47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630516347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516347, "uuid": "e7b9295e-9a7c-4461-b0b5-fe2a7b6b2701", "comment": "Malware payload (Gafgyt)", "value": "b07be7a721cd10c033a99d23c8ef24b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516347, "uuid": "07ad8b6f-263d-447f-9cd3-fbb6ebb9838a", "comment": "Malware payload (Gafgyt)", "value": "2b3b091914b1906bcf62ef697be3d6b6d65df22636f957f5221237faf46e9afa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516347, "uuid": "a88a4c50-8851-4d59-80fb-07522210e483", "comment": "Malware payload (Gafgyt)", "value": "f7db31cc6f972c44384846d9fea7fbff4d0af88d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516347, "uuid": "6a8d6dea-f0d5-4ba1-9173-673e89e479dc", "comment": "Malware payload (Gafgyt)", "value": "4178e97b7615e95a7f0c1a6897c661a60ba5b61a8a790afb4275fe856d234a12c9f87ee95023660987143fbe2274e06a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516347, "uuid": "90d81aa8-3960-477c-89d2-0bb9a21ee6dd", "value": "T145E31A5BA62C0783C4DB59F13D6B37F08B5CA9E112D352C5A90AFE805733AF52126F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516347, "uuid": "c94057cd-2599-4776-aeba-ebd2093b5116", "value": "3072:i2O6MBINBvumPblyP0I5hU5pe72fwuuDmUlVybfdWr6wO:i2O6MqNFuqlyZ5hUaDuuDmUlVybfdWrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516347, "uuid": "7c3bb1a5-e98b-4bf3-9c73-52b9bb39422d", "value": 147915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516347, "uuid": "ad8e2173-ed11-4df1-8666-804b3696da02", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516347, "uuid": "312cc779-8efa-499b-bdc5-8aaaefe72f39", "value": "b07be7a721cd10c033a99d23c8ef24b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e934675-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630482561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482561, "uuid": "ad3c9f34-0fde-4d44-83da-2c9f34376f97", "comment": "Malware payload (CobaltStrike)", "value": "7ea7a4d10b0166df165f94a71a481bc8", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482561, "uuid": "509a3743-782f-49ac-ab82-82bbdc34f6af", "comment": "Malware payload (CobaltStrike)", "value": "2d50d998dad3ab33912af2b6c05e254fc781a9a10daf75a5e85dcbf71fc5bfdf", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482561, "uuid": "2235b51b-848c-4d02-b015-c6824d60dded", "comment": "Malware payload (CobaltStrike)", "value": "2e206e749d3a1f5647e05b2a09b30aed421ea4a0", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482561, "uuid": "c56d4b54-83dd-4b3f-98ac-865c3bc7db3f", "comment": "Malware payload (CobaltStrike)", "value": "9c91b5e46cd88baf926990e1073df37513008135a49def9bfd9e170fbefbb91627462e21235a0c71c17eefbc4c0af49a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482561, "uuid": "68a9873a-231f-4549-9258-85b2a5b48f0c", "value": "T190E28D9B42580C29E817C939DF81D82BEEB0F8415AB4835F132995A94F63372B4FE334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482561, "uuid": "bc2a0c11-0e65-44ca-9632-d06dd9d9af7a", "value": "d8f109ce84cd972c08805582eb9f5af4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482561, "uuid": "3d4b543d-bfb2-4445-b0c9-8e61cb64bf02", "value": "768:FcfnvkobbVEHyeITKn27NWx8h/xUh55Yimm2oF:FSxbbGtIsAE8a7mmjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482561, "uuid": "1489783d-d693-433d-9021-b78309e708a8", "value": 33760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482561, "uuid": "bc87cc99-1df2-4be6-9937-03465fca3908", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482561, "uuid": "d2ddfd00-c8c8-47b0-b0c8-b84583546f9e", "value": "206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42010c0b-0b26-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630501948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501948, "uuid": "a601a341-9d24-457b-87ce-8b6a423c91b0", "comment": "Malware payload", "value": "b3382f2b23dc05717cb2d0653198321c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501948, "uuid": "0d275a92-1aef-4839-906e-6f89735b5ab7", "comment": "Malware payload", "value": "2d8a50f7a128ac2e60eb2ac0da086aa6997226d115430ad2af56c0cb15ff9587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501948, "uuid": "ec647ca3-9c2a-42b7-a688-5599e4e39825", "comment": "Malware payload", "value": "b90cc9b0e016263f9320f2e33ae48cdb764319f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501948, "uuid": "4afa82b0-7c25-45f1-9b49-5806e4e890de", "comment": "Malware payload", "value": "c3c15efc75f3393ffd24303da02dd362a1e3b544032b8f9f3918ac015cf4be43f7f64fc07701a3ea9bb174bfb458c8e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501948, "uuid": "7d815b6f-1903-4c6d-9684-b2ae0b6aabf2", "value": "T11852A61A7017E8AFC1CAC3F4A49A97F1E071F800D7AA1719335CCE192D9D9E9375A788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501948, "uuid": "d1185835-7df9-4bd1-8fe5-65fa5fb5c61b", "value": "192:MfmG0IR5716fmlqbCgaB0zPxziZmdXWJW0CbNBWw:pf45ZGmkPw+PwZHLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630501948, "uuid": "6a760cd5-f479-4a45-83d2-c7b7b4771752", "value": 13496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630501948, "uuid": "d3c9a786-9389-4080-816b-31d629a6359c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501948, "uuid": "b371b8d7-6bce-4b0b-8433-af639cc728a8", "value": "lnk-decoded-3.exe_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df7fa20-0b2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630505082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505082, "uuid": "6a33f038-9fda-45f7-863b-f0f38b5a7761", "comment": "Malware payload (Formbook)", "value": "145643726a52eb059ff7f943bb2b005c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505082, "uuid": "8a8003cf-ff00-41ec-8f8e-5008ada37905", "comment": "Malware payload (Formbook)", "value": "2e368a4169d8a0264fc83bb864b78e12e9a1784f99bc2f89c8619b8a0e3fd46b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505082, "uuid": "1badb2a2-235c-4cb3-a05a-6bba50277f82", "comment": "Malware payload (Formbook)", "value": "c7ef15f0c0f4d312987334e011b158db94996f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505082, "uuid": "be06f10d-606c-4ae9-b66d-b9baf0b31adf", "comment": "Malware payload (Formbook)", "value": "0d24c637ffa07ef7a17a27c840d49067a9571f01085666af46bddc1d0497d97a71315cf61a6ae6e5c25beed4ce9a66ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505082, "uuid": "c4552b2b-86a0-450d-8767-d7364dcbf1d9", "value": "T197D48DB368BE1C04E6560EF44195B330D1752D5A3ACE9CC3D98CBA1ED0337E6B09A56B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505082, "uuid": "742fbe44-4c0d-4dc2-a5e5-747f907c4f67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505082, "uuid": "4fa524ff-07b3-4bbf-80f0-0ae5e6df3103", "value": "12288:KG2+vNx53dGOdKCxWYcnXM4a5w98ZdHIac6CnFfm:z7vNxmOdKucn84gN2nB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630505082, "uuid": "8b825707-01b5-4bd2-bd73-e2adbf4f1998", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630505082, "uuid": "6337a395-9050-4b2e-80b8-cfe3de8f7b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505082, "uuid": "b7c25d5c-daee-4328-bdc7-1aacc45c2e0c", "value": "RTL_0075106330785202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772508be-0b4a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630517499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517499, "uuid": "99f27178-df52-46e6-bfd5-fe4c86b83488", "comment": "Malware payload (AgentTesla)", "value": "91ecce63f8695a722ad819450f9e0151", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517499, "uuid": "ac5ec561-c172-4593-880d-26bfe41363bd", "comment": "Malware payload (AgentTesla)", "value": "2e3771458d1cb347833dd9042d04ed03eb805b62ab388bf641d9f07b651e48b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517499, "uuid": "ef2756c8-6923-470e-a4fe-b7fa2a618df9", "comment": "Malware payload (AgentTesla)", "value": "862a43745661713e49e63cbe6aea99df20820b41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517499, "uuid": "9d40f883-4140-4ebf-8187-e9c939b0107c", "comment": "Malware payload (AgentTesla)", "value": "45539051aa349711bfe33d0c84cf78052fba1f6fe06e26c15db0080b78422a29f1cd39b5584212389a334a6a15b4740c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630517499, "uuid": "9a28033e-e6de-45f5-a0d2-df810681a8f3", "value": "T10725513E58FE2327D565C7F5CBE18823B1909CAF3132A92857D67B261776A4234C312E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630517499, "uuid": "b44c9d8b-63f7-4e0a-ba1c-cbce4d98a418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630517499, "uuid": "41502a7e-c104-4467-88da-505dc3c3695b", "value": "12288:2HBD5qJNRjfLshp8owiKuuehcuJidSPpyy/P7r9r/+pppppppppppppppppppppr:ayNRjfLKp8btnehcuYSRD/1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630517499, "uuid": "2c09f3a8-96fe-40a3-a9e4-672aab7ea38a", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630517499, "uuid": "c8b20d76-d4f1-4a8a-a510-c6bd4a8092f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630517499, "uuid": "21bbdf23-4fb7-41d7-ada4-371bc4005f25", "value": "TT Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6b688f-0b30-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630506180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506180, "uuid": "7144de2a-58e8-4621-b534-6521f56daf8b", "comment": "Malware payload (AgentTesla)", "value": "3c5fad513f50e2c0ef32eb3c886795c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506180, "uuid": "5d100af8-4fc8-4b86-ab3f-c2c626653669", "comment": "Malware payload (AgentTesla)", "value": "303946db98b2bb32e60ff8bf5d7c894783825d9e38826102f2c998c58749b84a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506180, "uuid": "d0b7859a-8d2e-42ba-82f8-0773c06b69d1", "comment": "Malware payload (AgentTesla)", "value": "7475cf81c4f706dc7aa814cc033e23c81014401f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506180, "uuid": "d385d6a1-3eca-4c96-ae6c-f14d29cec950", "comment": "Malware payload (AgentTesla)", "value": "16d7aada5dab7fba51df20bcee53aa0471f2a43d6d19808aae08d111d18d7dbb65a733faabf7d8051a18c59c9e0c6d80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506180, "uuid": "b685f7cd-6e65-47c8-a44f-43a319049d4c", "value": "T1E5D4F148612C6550EAEC7A779F60FAB21322AEC86C21967A74F87DCB37FF0131441769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506180, "uuid": "90d17570-cbc7-4391-80c6-55069c82dcfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506180, "uuid": "aae55a17-cb55-45e3-bb83-26a1d0ba7332", "value": "12288:9W5Kh0XQWusDK49qFQ/6RudLIDIdOfm5U:Jh0AWu4j96QyRudLAI+m5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630506180, "uuid": "26c599cd-8cd6-425a-8ce4-726174c03f4a", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630506180, "uuid": "8637fcf0-4b9a-4cf2-9f1f-fc3d92eed866", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506180, "uuid": "e25fb68d-f212-40fa-a57a-b302e4bafa80", "value": "Richiesta offerta 20210109 099384885000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2135b0d7-0b23-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630500605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500605, "uuid": "03ffcdc1-9131-465e-9568-245c24faa1c8", "comment": "Malware payload (Mirai)", "value": "d17e130895545f79d92b7155ed72e5d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500605, "uuid": "ccdf6fcc-77b8-4a8d-9485-43944432de6b", "comment": "Malware payload (Mirai)", "value": "30a69c153d9edaad862f7fda6605e4617855789d73589f491e39912581781809", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500605, "uuid": "35c3091a-02e2-4baf-892c-9e758edc1a9b", "comment": "Malware payload (Mirai)", "value": "e7ded5927e756554f29806f8dac7a2f8315ea6ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500605, "uuid": "6c5539ab-be26-4599-8dbc-899f6ef44c0b", "comment": "Malware payload (Mirai)", "value": "28ae98d5f5e1381c21d3d1606e91f021a052228dd4a55841b16560dae69a9ff5752ded6e21c5f559bdc7b51c04414fe0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500605, "uuid": "8af8095d-ae75-4ada-b5df-e24e203f128e", "value": "T155435CC595A3E9FCDC1015393077FF7256B6E93E1028EBC7D7A8AD32A941A02D80729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500605, "uuid": "ebd04f62-4970-41aa-95e6-f72a3c6afaf4", "value": "768:CoXHT2eWvOW4b3E/yzDLbrCP8kTJwXHU/HYonyWt1XfWA+i+tOfRc3aK:CojhW4b3uyzDvrCP8ywXyMWTF+7t+Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630500605, "uuid": "655ae433-38f7-46a4-af8a-06aa23482e60", "value": 55872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630500605, "uuid": "ef7cde31-e674-41dc-bd57-055665e85ebb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500605, "uuid": "11608817-b2c4-40d0-af5b-13a2785cd586", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4b7504-0b48-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630516625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516625, "uuid": "ac951379-aeb1-4b4c-9d55-fb91e756bc69", "comment": "Malware payload (Gafgyt)", "value": "a14fd4c1809b471aca7eaf97217b8e8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516625, "uuid": "1412eca5-ad50-4485-a04f-2afb8a761e7e", "comment": "Malware payload (Gafgyt)", "value": "30bee0e28f2820945b1f05b187ad8ae145ccc7e933cf21f53a6780747fe93d50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516625, "uuid": "831773d8-981c-4338-93a3-43db03f1a82c", "comment": "Malware payload (Gafgyt)", "value": "6e3977d1ff9501542ee9354dd8b480780867a09f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516625, "uuid": "057f661f-b39a-4731-9b12-cf47c3138e4b", "comment": "Malware payload (Gafgyt)", "value": "8f7478e1337f8a5d804331138bc3738e5fe3e757c67b768f0619355ac77e224ab05e858e74e91ef6b0b41a5c23c008e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516625, "uuid": "1354ac80-8608-48ea-afe3-b30f1114b501", "value": "T104C34B867640C1B3D14316F212D79F164532F6FE1A9BDA4BE7A82CB4DF19181B221FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516625, "uuid": "bf4799c4-1178-4a92-94ab-808c8a15a020", "value": "3072:Czi1FR4UjUMURQoUvVrVz9lgLTxd4VO+Wc5hzp9y5jsFHRm4EVduymGUrFoY:94y3QQoUN70z+O+Wc5hryYRm4EVduyVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516625, "uuid": "a37d3649-3319-48ae-8cf4-a82e62b9a1a3", "value": 122810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516625, "uuid": "34730e0d-eea3-44e1-a51d-83bdea3d1b42", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516625, "uuid": "1c10560a-1805-4da9-bbbe-4d198f1f0178", "value": "a14fd4c1809b471aca7eaf97217b8e8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904bbf47-0aea-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630476310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476310, "uuid": "d04fcb17-8264-4195-9437-003d7bb8c399", "comment": "Malware payload", "value": "4f9fbfd1d338cbb8262bdf1b00160acb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476310, "uuid": "a185cc6e-200d-422b-972a-2e526424a34e", "comment": "Malware payload", "value": "30f1c43b3ad72c723f600e50ae9efc764b7070def2b3434f401d0809b0a7c5a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476310, "uuid": "08b1d88a-9e91-4be0-b84a-f345d5823813", "comment": "Malware payload", "value": "8acaf992e5a3955e0aae38316429f19f484e1298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476310, "uuid": "f9c14335-bc8b-4c57-8fa2-e11749dac234", "comment": "Malware payload", "value": "2b766baf0559054ef28587e2eefe8962c40b7b356cf79a80ce15b78ec29a86dbe08aac941b477c5683865b71d9048266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476310, "uuid": "7230f511-d5a1-4e47-a4f2-35e03017b3b6", "value": "T1FA35493DED256737E7BA81E8C4860D4EE69410CBA23B5EDF41D2A389200751776FAB1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476310, "uuid": "4245fe3d-2147-411d-a016-9c880b70a616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476310, "uuid": "1269fc65-bfda-4250-b798-bf735d5dfd65", "value": "12288:tq7lbK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmox:o70VvuvEWr8m5mSzIEeOfmTm8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476310, "uuid": "8f14ece6-38c9-4084-a67e-d9b09c8a13e4", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476310, "uuid": "aac80dc8-5b2c-4f14-9f55-9168d8f408b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476310, "uuid": "20ff878a-bb33-4857-972b-d6ffb24bb0c4", "value": "d96ac044430f12195afa57da25a5e398.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4789b223-0b3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630511406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511406, "uuid": "37f8a5cd-2fb7-4b6b-be3e-ed5e85ff6209", "comment": "Malware payload (Mirai)", "value": "9ccf38f369109b6d4f5137f62d5fea13", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511406, "uuid": "0ee22d26-335d-40d8-9b8a-7300a7ffe1c2", "comment": "Malware payload (Mirai)", "value": "31085c31af148840a088e66f8c39423747e831044c295b284b2b034cb74ae83e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511406, "uuid": "12b19703-5a7e-41ba-a9c9-100a1f0e4fc8", "comment": "Malware payload (Mirai)", "value": "e0d90db2937eb2a1a73c4da17c41fb2af5e2906b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511406, "uuid": "ea16368a-5fcd-4d94-8bc3-c19eb17e2166", "comment": "Malware payload (Mirai)", "value": "bccae3ad3b2969cf17bb92ec759ce17cb826ab54b150dd6f7ef973b134b9869ba811ff24793b37d93dc62719ef643fc8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511406, "uuid": "9bd55d9e-1a6c-488d-9419-9be5e5d7edaf", "value": "T13A63F782BC80E626C7C01677FA6F518E3315A7D8E1DA3242DD255FA07A8FC1B0D6B746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511406, "uuid": "23c3f96a-e3b6-4f5c-bb00-a61a324eaafc", "value": "1536:bZ4ZLO7YQ010oQJ6sZad7jL1B8t46eTmL1Jun:bZ4k7L0l7nn84JT41Ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630511406, "uuid": "d81b5a85-be20-4a96-b3ba-d5b4898caac0", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630511406, "uuid": "33168f41-1a60-42be-b280-1da21ce10a20", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511406, "uuid": "b477ac91-eaf7-4b44-973d-b642e73c9746", "value": "Anon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ea2f97-0b53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630521170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521170, "uuid": "a00bb5b6-30d8-43b8-afbb-38eecb507412", "comment": "Malware payload (AgentTesla)", "value": "bc64c0e5dbadedb56360ea6f56ba96f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521170, "uuid": "cd66ef8a-1c83-479b-a0c5-f25f1e6c9515", "comment": "Malware payload (AgentTesla)", "value": "318ca24fe3ce059c1fdd9dccfc9b9c2ef7266966894f4f24d1af549bc4107886", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521170, "uuid": "be51d00c-caf2-4c0f-ae02-3216a7f00d5d", "comment": "Malware payload (AgentTesla)", "value": "99b31d89626c455a18532e4759c78bedbaa1ca17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521170, "uuid": "0ee282ba-c572-4f66-9ca3-bf8b9e6d30dd", "comment": "Malware payload (AgentTesla)", "value": "ca966fe63e01b105e24b30dbd415686ac2a0214571ef056cc5a06b0f5125962fadbe32dcf4f0c52093f86045a12fcaa9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521170, "uuid": "cfd9c4c2-aa77-4e89-91ad-5cf16bc7d4ab", "value": "T178B4BF39F7908D32D17B2A388CEAD1644975E7912D35F9473EE8494C4A27BC2BD1838B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521170, "uuid": "99ec5b7a-18be-4d9f-8883-c2c30d4c981a", "value": "b462095fea3219e285e54ac0547eead6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521170, "uuid": "9469b368-9029-4998-b64f-fb5f31338db6", "value": "12288:H4iy1MJz7bLg0EKsWmAhndfnZs8svfozjC:6yeQsWmAhBIvfozjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630521170, "uuid": "1da62930-5aee-4a78-b2f2-516446b50c9e", "value": 532424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630521170, "uuid": "2af4fc9f-001a-4ac9-9811-c64bec6a2f18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521170, "uuid": "29b3d173-f6d9-4604-9bf0-cac3a6fcb2d3", "value": "bc64c0e5dbadedb56360ea6f56ba96f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2796974-0aed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630477736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477736, "uuid": "1027e5e8-cd39-461c-8c65-1a7f188d01d5", "comment": "Malware payload (RedLineStealer)", "value": "5b4214fc265338a586eff675d1788501", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477736, "uuid": "0c7dbb57-9ee7-4f96-92e0-71ee5dca9c9a", "comment": "Malware payload (RedLineStealer)", "value": "326f7ee9fda4f77be13c17bd65d619d46685b6fa5e54b412f4ba3571766bb7f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477736, "uuid": "4c511f07-6fe6-47a4-968a-13372260fd86", "comment": "Malware payload (RedLineStealer)", "value": "c67992c5e94b93f26d35f66962b041b07773ad88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477736, "uuid": "8e652da9-b6ad-41b7-b10f-871c53383b2c", "comment": "Malware payload (RedLineStealer)", "value": "326a552c0dead7e0a67d6f121d156a354b53e0009f952f4099d0f1ea7b4ffaf9fa694513ce171bc88c2855e83f469bfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477736, "uuid": "9d016695-a18a-4a06-b32e-6d17f79eace1", "value": "T1B0E51201B3A25378EDA6BA35ACB708750E6639E844E1D369ACF3D70E1FFA6414473721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477736, "uuid": "0318f8c0-b797-4657-bf36-02600955a5b9", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477736, "uuid": "62df86ea-7c00-498a-b649-5b07b37aa4d5", "value": "49152:0y8Yw8d5/5FS0ppO/BVsMw2w46+jLhbdQ301NHi8TBICJJOPMYfY0WY9st2Vin+A:0mwMFS/LcD+j5d4ii8Ta2JOPVfY0p97y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630477736, "uuid": "e2de11e1-82f2-494f-a9f1-ab2814582392", "value": 3086088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630477736, "uuid": "ef43a2f0-0e62-4241-bce6-3cc0f01baf48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477736, "uuid": "8e2f440f-463a-429e-beec-ce7f062b06c8", "value": "5b4214fc265338a586eff675d1788501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef02b19-0b51-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630520546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520546, "uuid": "60cf7573-391a-4cbf-871a-8cd1308d97ae", "comment": "Malware payload (CobaltStrike)", "value": "9fc331785c2fb5b82c657c2fed719515", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520546, "uuid": "1a2dc9a2-839c-47fd-a5ad-5ebff4a44ce3", "comment": "Malware payload (CobaltStrike)", "value": "32c5cffcd7432c4122fb0aeca0379bb354dfff9c17dc10f20e992cd520c7f037", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520546, "uuid": "b82c291a-ab76-4e85-b85b-062ed964ae7e", "comment": "Malware payload (CobaltStrike)", "value": "d8857e54337308ef30d47e5b162c6b96e57cdba9", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520546, "uuid": "6da3aa2a-afbe-4df8-8f69-16fa20e826f9", "comment": "Malware payload (CobaltStrike)", "value": "82bf424d20d27f50165484e12312193927386f900a9208eb388746f1e8dfef7a522496acfe28fc687cf2a2b12b15474a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520546, "uuid": "7c0f838a-1c0f-477f-9957-cc8f94239f6a", "value": "T12624E07AD304E9E1C4B481BAC150FAB52F216107B8B7A9E2D4D864398FC47AF790FB45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520546, "uuid": "88c13769-200f-40ed-84f1-fa4e2db9d262", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520546, "uuid": "62b9819e-0857-47cb-b115-7000dc785a77", "value": "3072:l4sFCsPjwOO0CnKoMmEKIiF1l3lzGrqOXGgF1spyj91PGVQrriEvg8+zig+u:l4sUs7jOgmE1ixsT2OGpyJVvgHzz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630520546, "uuid": "8bd3abb6-3d0e-4400-ba7d-be2446b535f5", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630520546, "uuid": "b783176b-4b5c-4be2-a392-1c095434e17f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520546, "uuid": "6d0aa32b-9906-4316-978a-081bae8e8d1c", "value": "9fc331785c2fb5b82c657c2fed719515.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6495a300-0b02-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630486544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630486544, "uuid": "39878c4b-6e98-4942-b307-4bf4210c6c39", "comment": "Malware payload (RaccoonStealer)", "value": "ee70f01d13a439e1c1c989d4d9a098ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630486544, "uuid": "75ea053d-0f94-4eeb-ba0e-8ecebf12a4c1", "comment": "Malware payload (RaccoonStealer)", "value": "336b73345346ecc0c06d050402fba00e1301be6c4989b448e7cc11c967722d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630486544, "uuid": "8956b29c-3773-44b8-a835-d176ed81d8d7", "comment": "Malware payload (RaccoonStealer)", "value": "a0666179e5326c622663fbcd86c09f6c9154896a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630486544, "uuid": "d5b4af30-01a4-4b13-a05f-3b9703f87c5a", "comment": "Malware payload (RaccoonStealer)", "value": "0773bab0fccdb5cff0799f8b496bac47f26cc5664b3b4a3ed6d2963f9d680bb1d6bcdd617602dcce21c5425edfdd0bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630486544, "uuid": "041d75d3-1630-425a-b1fa-78d759c1d2b0", "value": "T1C1C4F10B31B1C43BD15546708CB6C7F85926BCA9AC21C28B37D3676E2FF0792AB26355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630486544, "uuid": "89833728-1bfc-453d-a1ab-2fbeafd8dfa3", "value": "451c17c19158849d8a13a33ee740b7fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630486544, "uuid": "ef3997a2-c565-4a14-ba4d-e4035a523c82", "value": "12288:753MF7bR595vaJjI0zkvdOxOD1udmCKRKxuaX59Y:76R595vaJI0zkvsOD14mZRX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630486544, "uuid": "d8f7324b-43ea-4a16-924a-ac1b262929d8", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630486544, "uuid": "42353ba6-8638-4325-ad21-12320e55c069", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630486544, "uuid": "fd8736b2-01c7-4724-abf1-6014a4e1be90", "value": "ee70f01d13a439e1c1c989d4d9a098ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f68f95-0b1e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630498631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498631, "uuid": "43025754-e369-4f31-8928-8cf45642ba67", "comment": "Malware payload (Formbook)", "value": "1963a4808a9d94fbc0e380707c150730", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498631, "uuid": "1cd57dd6-6cb9-4432-bfde-44c02b063c5a", "comment": "Malware payload (Formbook)", "value": "352767d770508167e0b3e35ff366d2ccb331ab7ab1bff8dedca0086086bc0f39", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498631, "uuid": "144be720-19e3-40a1-9095-23bec0250758", "comment": "Malware payload (Formbook)", "value": "bd7a3f1ecef2013b4b45187b728946abcca15567", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498631, "uuid": "22416126-6eae-4670-ba90-60770c812d70", "comment": "Malware payload (Formbook)", "value": "0c5069966fe565c62fcb953cd1a9452276074f08bdfc9412ecc3aebc1208f8a7bc06ecc8ac87193853a8850ea3d6725f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630498631, "uuid": "ce8ca0ec-bdd5-4120-a1c7-3c2ed9eef4d6", "value": "T164D3026CC379EC0FC13394BE45685A7884F760602AC569E987ACFC6E046FCB607E7294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630498631, "uuid": "b8153217-f02d-4179-a4fd-3859328681e9", "value": "3072:6bhM5LF0dBFIFtkmT+XK5ESRrOLhb7BLVYMiO5:eybXkmiGxOLhnBhY9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630498631, "uuid": "c22c502c-b045-4fe5-bb61-8a62c78b1ee3", "value": 131986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630498631, "uuid": "daa16dd2-8102-45aa-aa46-0f1dfad76455", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630498631, "uuid": "1e0abdb3-baa4-4ae8-852e-41ccfa50e81a", "value": "BHBW-P412536.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04bb80b-0b4a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630517702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517702, "uuid": "8e308009-7066-4fb6-bcf2-6cb17dfd964b", "comment": "Malware payload", "value": "514c53c0b7e7286d983bf75c5c751f07", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517702, "uuid": "dbe40a8b-757a-4724-b481-808af600348b", "comment": "Malware payload", "value": "3529493db869e38f4cc8d85f0b5e3964abb6b9aa9e053b6884b47ff610551239", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517702, "uuid": "6b2fede5-4e6b-4f10-b413-4c4a6de42c08", "comment": "Malware payload", "value": "845890372f9d0f7902b7490e6d25302fd5e7f131", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517702, "uuid": "b05697e1-322d-450f-8bb8-faec0e243cdb", "comment": "Malware payload", "value": "ef8fcf3639307fa188d5c2acf6aa56540d989026d7f4236dd8d7f5345ff1d90812c845a8a5de65215dbbf2733ec1b2d9", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630517702, "uuid": "c7f3eb0d-fbab-4504-9c40-82d9e7d53b2d", "value": "T143B59D1139C6C532E97E45306A6ADB3B14FE7EE00BB188DB63D45A2E0E745C24276F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630517702, "uuid": "bb370e14-ea01-4bea-acec-f08439065331", "value": "49152:obMQrz5io+HGGWxyzYlrXVVdWgAhmLQr+uclpUO3mDOSP9HnoA/s5tFsy3I1XF20:aSGGWDlDAhmLpUUEXF2DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630517702, "uuid": "b1bba5c8-0017-41b7-b962-6fccba85f5b4", "value": 2307584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630517702, "uuid": "d062b2a1-83a7-49bf-a572-f96af57c4ec0", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630517702, "uuid": "ef174523-baa0-4e97-bbdd-a31807d0ac60", "value": "GeruDanfe.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03e57ef-0b37-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630509408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509408, "uuid": "6295f40e-b4c7-433f-b287-0c50e2d5c157", "comment": "Malware payload (Formbook)", "value": "a9a4ef232a3238c20d7e392ca286c265", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509408, "uuid": "58610f7d-9889-4fda-837a-fe22a25bbfc9", "comment": "Malware payload (Formbook)", "value": "3613eae18cceb9fd6e149a66ef37260b6e57a471e8192aa1d40754399d143f9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509408, "uuid": "bdb52fd4-659b-4840-a20e-a8a774b6ea2a", "comment": "Malware payload (Formbook)", "value": "6c1b09327ab7c51938e501e1e12e5ebe392940be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509408, "uuid": "e308ec97-c28c-41e2-b912-4427abd52b5b", "comment": "Malware payload (Formbook)", "value": "9dccbc624503186c226fc334f5ee454c14ec03bafbe941118f8e0293fdffbd6c84469a3d72c4ddf2c5cda5ee74927a59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509408, "uuid": "196d6122-28bc-4fd0-a080-86013260f678", "value": "T152F4FB7F19BDA1279175C6E58BD38423F0018BAF71216924B6D747264323A7AB4F332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509408, "uuid": "7d4543a1-5fd4-4876-b4df-79a0f2241f86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509408, "uuid": "5c3501ba-5b72-4cc9-931a-133d97b5db95", "value": "12288:0AGJ4DdDkOuIHecYGCX/0vqbNAirNqRZ:dbk6HecYGc/CqhzBqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630509408, "uuid": "127a85fc-eeb6-4e23-be0b-10ef72e5826e", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630509408, "uuid": "c1d6c1c6-b9a4-4a89-9863-70ec46bb5546", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509408, "uuid": "c5f74419-0b7d-4ad8-a3c7-d264e4959ad6", "value": "a9a4ef232a3238c20d7e392ca286c265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd93c64-0ae3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630473138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473138, "uuid": "f4ff8946-12d5-4079-8b69-0cda790b5062", "comment": "Malware payload (Loki)", "value": "e341f35150717317469d40711fd65091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473138, "uuid": "31d0af5a-e1ed-4a3f-a620-d43aa366e774", "comment": "Malware payload (Loki)", "value": "364967724106095e686196d58607e759382e7fe0946eda9bb843f290b8f96b43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473138, "uuid": "929b4e5b-10b2-4ef3-86e8-87380d2564ee", "comment": "Malware payload (Loki)", "value": "c276f22202b42f78b42f940f10729af1d3f05648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473138, "uuid": "f7da9119-4ede-4662-91ff-fad04d42fe2b", "comment": "Malware payload (Loki)", "value": "49bf0d20967660ab60dabd6013d4a136be2174d6315cfdb0ee5ab314a6b2946f8ace774301370110093daab28829f2a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473138, "uuid": "24c94dca-502a-49c6-8330-d85b7aeabcfa", "value": "T1B6A4D0487290B29FC56BC936D9A41C70AA61B877530FE307A45351ECAE4E6ABCF114F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473138, "uuid": "e880a1e2-8ba8-435e-aabb-d55854b092cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473138, "uuid": "1fbeaf2d-23b7-4ab4-b714-b7c7ded3394c", "value": "12288:LlzDYdmflJL8sK3HipzrTV9cEQ9v0rGuQkVyvKFnu:LlfdlzxOF9v0rO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630473138, "uuid": "0dd75887-aaa8-4734-8649-c9a060bca073", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630473138, "uuid": "00859b32-a7c1-44df-b64d-06ee7c6fc582", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473138, "uuid": "651ac381-39b1-4bea-b27e-b6daf3176978", "value": "PO669201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4978b6-0b3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630511500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511500, "uuid": "e4d25476-811a-4764-bcbf-53aa82b8ff1a", "comment": "Malware payload (Formbook)", "value": "80f9288e60a62a35a327d77b7e86d830", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511500, "uuid": "52765764-8e86-4c28-919d-4f303de4fd5b", "comment": "Malware payload (Formbook)", "value": "36ca6fddd4f9eafd252fc3d6e2c8b567a117e40abe071d77830aa123f6bd3eff", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511500, "uuid": "514d92c3-6916-4d4f-87c6-cb3ed4906e79", "comment": "Malware payload (Formbook)", "value": "26e8d5969a9732cacfb2eafd883ae0bacdcea53b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511500, "uuid": "ecf012f9-d53b-4642-9e33-7ccfa4b12238", "comment": "Malware payload (Formbook)", "value": "b10ddc3c3f437e9805cb8ac7ee42024c9344995e52307f746c6feee7295190a3d41daabcb8bfedb9fcda247784671b0b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511500, "uuid": "7932c4ff-756e-4dbe-891b-1f03f03fa587", "value": "T132742291B2891B6BF8C7257749E0CC4F3340DC386A3BB65EBDA57125103339A56F2539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511500, "uuid": "15611be5-432c-46d6-8e9e-b3d754fcebd8", "value": "6144:MgOT+DC6Khvcz/LKZpW4dBbmqGMerFqCEkXgDIXBKtBFEShPN51q2eN8ixF45v:MUDChvIy44dBbFZecFRIXBXShPN/q3NU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630511500, "uuid": "ac53c3c2-8bb5-45c0-87db-31ce7e4545e8", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630511500, "uuid": "59aaf9e0-63cc-42c8-84fd-9ace7a300bd2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511500, "uuid": "604774a0-5f06-43d9-a45c-af68d29abf34", "value": "payment slip.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470bc842-0b79-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630537605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537605, "uuid": "d4fa7a77-2119-4016-8ff8-583dda19f92d", "comment": "Malware payload (Loki)", "value": "4878378986c2d358ff672331c7001ff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537605, "uuid": "26d2cbe8-bfe7-4dfb-be4c-3ccf7f1b466f", "comment": "Malware payload (Loki)", "value": "37c6f7ae98046003879372195ad25435d69c1e2915ed6d4bcefd488e77c9db60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537605, "uuid": "a72d63bf-b72d-4491-9163-820bdf59e3c0", "comment": "Malware payload (Loki)", "value": "d9cdef96cebc5a65041d5a1ae210cc62d496ad4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537605, "uuid": "3595c05c-4bb8-43a6-95fb-f38c4e39074f", "comment": "Malware payload (Loki)", "value": "7341977b8dcb8005f05c56db13b9f302266b17a175467146c08cc1eaf48422e9d0eed0266b157f9a86fdbb4918c36275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537605, "uuid": "01a835be-4597-4d68-94cd-abe5b2402986", "value": "T165753391FBDBA837D4272976C0C0911EB90C73E716B9C256E5F2F864B76305A063273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537605, "uuid": "8f3a602c-6614-4f38-8a64-0e8c28670278", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537605, "uuid": "2e276aeb-0e49-448a-b324-5b320eca0bf3", "value": "24576:1LfdQAt4oECOYb4S/d8mdwzVygHwRtIkHAokNiy/cCPGAHvG4Zzf96f/A2w1RhOa:AAWoEekS/Y8gQ/IkdkN9Z72weu1k/Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630537605, "uuid": "f26b4e37-2468-4807-bfdf-055a2aef4add", "value": 1655808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630537605, "uuid": "ec753135-560e-44f0-b2d0-34592fc689ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537605, "uuid": "e1e74ced-de47-4aa6-b5c0-87f2fe5a37e9", "value": "4878378986C2D358FF672331C7001FF9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac6dd56-0b25-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Ramnit)", "timestamp": 1630501668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501668, "uuid": "b7322882-1670-424a-a79e-c2c28a611ccb", "comment": "Malware payload (Ramnit)", "value": "fcbda965e4bb669ef5a7f4e33a5d0f68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pe32", "colour": "#9109BD", "exportable": true, "hide_tag": false }, { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501668, "uuid": "0b7d2e9f-7746-4c07-a0cb-7e87ca777b9e", "comment": "Malware payload (Ramnit)", "value": "38b1b7802b0fe3b47002dc3d6cf5e3c360433bee072e4653cac2bfa61906f293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pe32", "colour": "#9109BD", "exportable": true, "hide_tag": false }, { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501668, "uuid": "fb80d01e-77c9-4486-97c6-1a62f99fc312", "comment": "Malware payload (Ramnit)", "value": "123acab84ba6a9aefc75f3d3f1cf129fca3bbdf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pe32", "colour": "#9109BD", "exportable": true, "hide_tag": false }, { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501668, "uuid": "18b9bbd1-724e-4926-aa0e-82d49c8a5a4c", "comment": "Malware payload (Ramnit)", "value": "4261fb584fa47f1a868b1feb93e6ccd649a0bcda947d8990c9f8566b22e8476e25ba44be92abed044f74d55e37d5dec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pe32", "colour": "#9109BD", "exportable": true, "hide_tag": false }, { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501668, "uuid": "4cc8e6e2-f723-4da1-8e56-c953ff5aba56", "value": "T12E64C0D6363F10B3ED2DBCB300634D36F26F5EA319D2DA8A900485B47E62251CDA6753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501668, "uuid": "797991ca-23b4-4470-8f9e-7c8426417d9b", "value": "093a51e0b7dcb2466b7edfd78d191aa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501668, "uuid": "a2887fa5-4f28-454b-894b-0bd24a9d969e", "value": "1536:/wZZnAEjEIZvumULmj4wrraK5dZ4Ltta9Km/ec3DtAL6bmZ4bXSjrAE+fySPoqRI:InnAQVG/LytaKItS/fiLKS+f5Aq7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630501668, "uuid": "b1824449-94cc-4f40-85a8-5a2bad1aa085", "value": 326637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630501668, "uuid": "f1da2fea-7be5-41a9-9b45-38cbf58befc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501668, "uuid": "4e5a4155-2f35-47b5-afe7-7e2e7b46e02f", "value": "Anti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9caac124-0aec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630477189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477189, "uuid": "8cfbf695-4246-4293-9606-452d87b629fc", "comment": "Malware payload (RemcosRAT)", "value": "3fbac6f214dd086b515d64838ac0c4af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477189, "uuid": "26ad7bd8-3e37-4209-8c4e-7416b4e8c998", "comment": "Malware payload (RemcosRAT)", "value": "39de6e1f455747a1e878f070e5b62e306a60bd595d5a1840518cc07972a5c6d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477189, "uuid": "b3a49273-e9d9-44e5-b5fe-7e556ee7ba69", "comment": "Malware payload (RemcosRAT)", "value": "aba8e16e6a342dc15fdd94a4dd521c93ff471598", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477189, "uuid": "45f839cb-5242-49fd-a723-5ddf425844f9", "comment": "Malware payload (RemcosRAT)", "value": "75c0817df088c73300449eb72a0a10f88be64865282e4104c1e2c34c3ec15c5a0aec653b0e15e2f0fe4aa0c71de2fb1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477189, "uuid": "8b512885-73c0-4a13-af04-b7d1aad8b36d", "value": "T1DAA4A28E22484208F596FF71989DC1F903316C35ADB6C44E27D9B13A0FBAAF59B17847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477189, "uuid": "7036bec0-5386-4452-92e2-fc5c1386e5ee", "value": "c4b3ef5cd2bacd05c5793b6be4b1aeae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477189, "uuid": "35452594-a395-4584-b735-ec934be429d8", "value": "6144:IwV2nNBEat3ZjyPt7Z3oKzwH38Pt7cjqJWa:IbnUatJuP5Nh88P5cEWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630477189, "uuid": "31b83443-6e21-4c09-9dbb-408e9dc257ba", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630477189, "uuid": "71b39878-9279-4bf8-93e4-da8ea3506d8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477189, "uuid": "635a0527-b15f-493e-ac36-51453ea24f62", "value": "3fbac6f214dd086b515d64838ac0c4af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67441802-0b51-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630520479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520479, "uuid": "cd776fb4-27c0-426f-a7f0-152dcb0c7ce0", "comment": "Malware payload", "value": "1e42b1276a265b947a3df0569159989e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520479, "uuid": "970db8a0-22a8-4980-b2f6-38ee2ea7b8d8", "comment": "Malware payload", "value": "39ee8ef56fac6a820b73624f8c51f44f984d1f4737d9db9c7036462627b4f9a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520479, "uuid": "e2445fa7-3b93-45e1-9352-6ed1ef99d7b3", "comment": "Malware payload", "value": "3ee594ccd6aef9efc9776b9534f1f4478cd0e58c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520479, "uuid": "d935fffe-2d13-4588-b250-c235b4a07cbe", "comment": "Malware payload", "value": "0ec4408f31f3e050a0331eb5d74a380d3a9eba7842169acc7ebed66820073072979812f0aa11ba9271f0ba321fb0c71a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520479, "uuid": "c0b2ebf6-2da7-41b2-8c95-86ee2a274d24", "value": "T106457A3DED256637E7B981F8C4860D4EE69410CBA23B4EDF42D2A389600751776FAB1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520479, "uuid": "7d0d3f86-e226-42c3-91cd-839a347ede13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520479, "uuid": "73792d13-4e67-4795-8e16-eed48f09f1ce", "value": "12288:Fp0u7+bK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosW:PX78lQzMq7dXgxdBM6cLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630520479, "uuid": "6a84280e-79de-47c3-81c3-2fe26133b04e", "value": 1201152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630520479, "uuid": "e6f2851b-5cfd-4f9b-a99e-e6b5a1f068df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520479, "uuid": "1be18f69-ac40-4429-9f9d-5b193d4397cb", "value": "ONEYJKTA78412400_draft_20200816100108-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacd3092-0ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630472140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472140, "uuid": "19ba7e0b-0c0f-4850-94e1-04c71e2042b5", "comment": "Malware payload (AgentTesla)", "value": "7218953c879133dde41c7d525344fb38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472140, "uuid": "28f2ec0e-1b39-40ec-83d4-052a34eba748", "comment": "Malware payload (AgentTesla)", "value": "39f86d390ba0b020d206435ad1ef5043c524838c44b66fbf927fce24610a19a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472140, "uuid": "8653b16b-107d-4b35-955f-0671562e0159", "comment": "Malware payload (AgentTesla)", "value": "38226fb1dc381cae1ae075093fcb877cd73d0801", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472140, "uuid": "4466b916-fd23-45e1-8c9b-4053cc210fd3", "comment": "Malware payload (AgentTesla)", "value": "c727ba5d12168eade0d43b6255b00541f54157ea7484b4bab6df617a86d414098f1bf41985a0ab6bc1a3dbf61c74827e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472140, "uuid": "c44eb637-68a3-4682-8a6e-e33dd79aa6de", "value": "T1B5B4D09D764476DFC52BC976C9642C24EA60B477830BE307A06326ACAD4E59BCF160F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472140, "uuid": "7bdb0904-3e3f-4208-8fec-44ff47deb56b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472140, "uuid": "957a5abe-c522-4688-8172-425b2e13bdb7", "value": "12288:EpC3CwNagqwEqc/KQPp9AYefXtm0HD4Me4lDYbeXfCRUhO234m+O13zv2:BSipYPHtqtm0Mz4lEeXfCR8O23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630472140, "uuid": "5605c366-3194-4e75-b3bc-3b38901e23fa", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630472140, "uuid": "500cd203-ff3d-47e8-98f2-427cd6eeb085", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472140, "uuid": "d81621fe-7b82-42cb-ae22-9c4583db23d1", "value": "NBI Antiants Trading Pte ltd 09012021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e68fe38-0b53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630521377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521377, "uuid": "36cd08b9-7f06-45f3-9c7f-ba2fffde1e5b", "comment": "Malware payload (RaccoonStealer)", "value": "bae2fc6c5855ffa6e3b11462d30d04fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521377, "uuid": "2f606a63-d642-47c9-b924-2e7839b68c30", "comment": "Malware payload (RaccoonStealer)", "value": "3ae0a9d38c7e7ff2c785b1be78535afb96373367893fed9d64e294edcb00b597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521377, "uuid": "35be3d7b-f45a-40c5-bb25-e4d80c70a15c", "comment": "Malware payload (RaccoonStealer)", "value": "7e81073fb54b212d27e06564ac79ed1f3df51154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521377, "uuid": "a2a28c85-2038-4b05-85e2-f6f14bca9c69", "comment": "Malware payload (RaccoonStealer)", "value": "658651144cbac46f1417975a3a62ef49c27c480e6016e2a1f1098e575a4508c7af9324387b0778b2973cfe3848687e7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521377, "uuid": "6c58cc8d-d37b-4fbd-86af-3c2edea9665a", "value": "T1ACC4F20736A0D43BD191C6704CBED7B84A36BC691D26C28737D56E7E2DF2392AB16306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521377, "uuid": "2870be47-22bf-4a2c-94a5-abc08d3ac32f", "value": "6c24281dcaa86901b7166ae3ce878d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521377, "uuid": "f34faeb2-76a0-4d5a-960e-9917a47d435c", "value": "12288:yebpcE/dRfn6zfXpKJGz9i9Me5AnW1sTpuTIRGUdfaX59Y:wE/zf6zfZK+9+MlW1sVuTIIyf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630521377, "uuid": "3e3a34ed-8da4-43e9-aff8-6aec91be9aaa", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630521377, "uuid": "257a82e9-526f-44d2-996b-58b1e44e0ca2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521377, "uuid": "6c7c513c-ea59-45c8-bc03-dea5c95b9173", "value": "3ae0a9d38c7e7ff2c785b1be78535afb96373367893fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5a62c9-0b2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ModiLoader)", "timestamp": 1630503608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503608, "uuid": "4d05a5a9-af9d-447b-b9b0-00fd029aa7c2", "comment": "Malware payload (ModiLoader)", "value": "202f3713a360b2e2b5e5c196baf25c19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503608, "uuid": "7219f16c-7aa6-4b53-92a9-4c625044687e", "comment": "Malware payload (ModiLoader)", "value": "3b7b846373c9e626c33e2561a6ff5515a67f25dc089f6e62711e792572105a17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503608, "uuid": "64b33ff8-4c7e-41ea-952f-00712d6d9637", "comment": "Malware payload (ModiLoader)", "value": "225c938bb3993c15e5920c921b896d25adc12b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503608, "uuid": "a72233a0-f556-4f58-8205-b44425c68ee3", "comment": "Malware payload (ModiLoader)", "value": "337f23fc90173742f22626793050eaa94cd32869853a38a6534a6197debdcb6888060c119b82d2bb55a7bba1a982c32f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503608, "uuid": "f76ab74a-e103-431e-9adb-aee53a92f2b4", "value": "T12225BF6AA7A401F9D17BD038C9529613F7B2B459132097DF03A08BAA2F237E55E3F750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503608, "uuid": "16039623-5ba9-4206-80c2-855461e0c855", "value": "0bdc3f7085d1d436a2b4e6ce101453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503608, "uuid": "0d9cf8fc-7aa7-4e49-b56b-cd24e3c30646", "value": "24576:wNIz9BlPTEsgQx/wzMwQptMnxa39rCmgeKkWKhQEVcs:LJB2wJwwqnsNrngMzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630503608, "uuid": "a852e0e1-23ac-43a4-9331-f78e9082e395", "value": 1038336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630503608, "uuid": "ba6bd53c-1ed6-49c6-b3cf-a6c0cfc2db34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503608, "uuid": "dda6700f-3703-4025-bad8-e6c25bdfb4b6", "value": "202f3713a360b2e2b5e5c196baf25c19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f100feb8-0ae9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630476042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476042, "uuid": "8b167ab0-9229-481d-ba83-7133247cc673", "comment": "Malware payload (AgentTesla)", "value": "95a0ca270ac5d1e601e28d3a2c7a9f67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476042, "uuid": "e9a5b30a-9454-4590-b170-dfaf3f30cafe", "comment": "Malware payload (AgentTesla)", "value": "3b96e2efb3dc39986c3800ae1d490c149b3f2227867a03ed470c32f2ef14e39e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476042, "uuid": "ef711695-8c23-4a94-81d4-687a0a435b9e", "comment": "Malware payload (AgentTesla)", "value": "816d44e67b338f8234d8fa32be6b57ffaacc578f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476042, "uuid": "7715dffb-eec5-440f-a5c1-146fc5df65c5", "comment": "Malware payload (AgentTesla)", "value": "e9cb63ebee2bdce2af5e2bf3de2599a02ba20e882d308c31997eb06580433ad2549f5cd3219062f45f53aea74bafd3ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476042, "uuid": "0fc74cb7-7702-4611-89ce-49c5752ecc0b", "value": "T117B4CF897674B5AEC45BC9F389D41C209660AC66930FE207B47336ED993D59ACF023F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476042, "uuid": "2635ddbd-79c1-4d1a-9040-60a3e2254dba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476042, "uuid": "3ed3f777-c87b-4ec7-8ec8-4571157157b9", "value": "12288:hkwDJxj5/pnw+7tsxz0CQfRqixkAnmk3LAqOOkdbosVBO3t:CKxj5RfudXaRll2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476042, "uuid": "b15ea871-3179-4c54-9394-0378a884c680", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476042, "uuid": "d87e76f9-5c67-4353-b5df-cb7e0cd93ae4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476042, "uuid": "4ecf8ea1-11f5-49c1-824f-a4d770ff9529", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803f9e37-0b39-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630510213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510213, "uuid": "79627b90-8366-415a-a17e-129187d50dbb", "comment": "Malware payload (Formbook)", "value": "5d7a426f8569371c2bdfc6f005bfe951", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510213, "uuid": "fd941967-4d30-4439-af6b-61e06c0e9596", "comment": "Malware payload (Formbook)", "value": "3ce43811e2050c26ceb77421b8c2dba4f606bde9380baa6627d3c5512db7eca9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510213, "uuid": "897509c9-edfb-43d5-af86-53aef43a9971", "comment": "Malware payload (Formbook)", "value": "0cf2807b16c2cbf7d9a47854aaccc2653eb4df5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630510213, "uuid": "d1c64f57-da05-474b-9100-8bb3b6b295f6", "comment": "Malware payload (Formbook)", "value": "5ce87cde4fba3d43b94d54b10aa16ea6570c4a42fda18c6d8349b7a86cb82bb134f82880fd992f76c403bc3b5a5ba49a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510213, "uuid": "e28c2a64-16e1-480a-92ca-d1594065ac9c", "value": "T173B4EF9D7250B1DFC52BCD76C9A42C64AA20B47B430BE243949325ECAE0D69BCF164F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510213, "uuid": "3d9e32ec-d699-40b9-aa0c-5ed6bc565ae8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510213, "uuid": "84a59101-941b-4d43-9f02-74d3dec88b3c", "value": "12288:xRSBGEdwPKHlkGcalfJf/ErvmYzzHfla7peW7PvdL:xRS0Ed5HS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630510213, "uuid": "462a9f7a-ef1d-4491-b6f1-87cdec3edd5a", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630510213, "uuid": "6a538b10-5723-4e67-8e40-5c743f51dfde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630510213, "uuid": "dd888c42-e1ea-4fc9-bc8e-192c266efa65", "value": "5d7a426f8569371c2bdfc6f005bfe951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be830ea-0b28-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1630502931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502931, "uuid": "0eebfd09-15fa-4436-9c90-5bb90688720b", "comment": "Malware payload (a310Logger)", "value": "5dbd6684e5601b2f8e748e02fa898558", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502931, "uuid": "3210897d-db16-45cd-9d60-d9cbadd061e6", "comment": "Malware payload (a310Logger)", "value": "3d92d6a34be40684493e0cee2f5c772ec4a1f731cf8b371cad1eb9c492d9f63d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502931, "uuid": "dc1ca060-7762-4ffb-aeab-e38b4b86b286", "comment": "Malware payload (a310Logger)", "value": "9a83397decf87975576dbb4fced3d9b611846c39", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502931, "uuid": "1cd0e43e-712d-49a9-95ae-79af73ec8c88", "comment": "Malware payload (a310Logger)", "value": "c56d41448d4023c3c8e5d7e7e2cf324e010c55753a8d15f4e6cac660d0f99b6b019594c178872b330e5e91c7b2042efd", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502931, "uuid": "79914f2e-2344-488b-b3a9-2697317d0692", "value": "T1F615CFB358AA1C05E5520EF05091B67091752D6E3ACF9CC2E98C7B1EE0377E7B09E52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502931, "uuid": "c270f025-01fd-4137-9138-e41f18435b7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502931, "uuid": "7c9c36b9-1f37-453b-8268-3b0f7427f274", "value": "12288:1FYf861bQyPlY7a3q6GQShv8me5CZMg/ln1/7x8a0Ti+l:1i06xQta3qxapkFLo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630502931, "uuid": "6b01e2a1-6157-431a-b6d6-a5a2b3746470", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630502931, "uuid": "1710bebc-140d-4fde-b09f-cd5518e3b94a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502931, "uuid": "65468c4c-9630-4a50-93c1-68bfd393e373", "value": "EDL_0412000145200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176f57fb-0b77-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630536666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536666, "uuid": "d4a3fc2b-fdfa-4ba2-af80-3a267b529428", "comment": "Malware payload (RaccoonStealer)", "value": "413c5d341d881818315d626d2fec70d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536666, "uuid": "b0424f9a-69ce-4c92-b6db-2d005b29fd53", "comment": "Malware payload (RaccoonStealer)", "value": "3e4c7ea14c7244983b41edf75a23f40800771f02c0aba8afc0f087d6eee25d40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536666, "uuid": "66ae37cf-763f-4f28-b2e8-7c01ee6157d5", "comment": "Malware payload (RaccoonStealer)", "value": "d2ac41e5f2d9e8392f1c84a6d90f99676b3b12e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536666, "uuid": "1eac112c-6b8f-4cfc-be53-2ba6e3b7e1fe", "comment": "Malware payload (RaccoonStealer)", "value": "db7b8a71effead9801a1643581112cc0d002fcc8ed91cced53dcb46f9b01136f5b220e67be86bbc5ca034f0145776140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536666, "uuid": "71bf62f1-867b-4a0f-871a-37f2f58c2d89", "value": "T1CB65613DAD252633E7BE86F8D4960D4EE69450CB22335DDF46D6A3882007617B6FA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536666, "uuid": "e49f2281-3d59-442b-a2ae-281e745d2649", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536666, "uuid": "4bbe4e2e-cf12-4aa4-a530-8860ab5293bc", "value": "24576:SHnchKutbVuIarHwjvY1S6c0YEf8tML+b09Z4A:KnCKW8QjAhb+Keu4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630536666, "uuid": "c50e2a89-5210-4f8f-9cd6-eeb37ab20f25", "value": 1503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630536666, "uuid": "ec7f36f5-0c07-4357-b37e-8a355b142248", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536666, "uuid": "82d5b894-cbf3-4e31-a5e6-223e808167cf", "value": "413C5D341D881818315D626D2FEC70D6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e99220f-0ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630472361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472361, "uuid": "8f615a8a-5fe5-4997-bb98-b28891c03008", "comment": "Malware payload (Formbook)", "value": "78d655e5758c6a60e881b5725e551710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472361, "uuid": "a9371f08-2a57-4c83-b502-6dfd6e3a31ae", "comment": "Malware payload (Formbook)", "value": "3f3c53a643260b21d81b37581469b76fd19edc2740ee31aa983f81b2c65e74a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472361, "uuid": "a92bfabe-a60a-4347-bb46-998b681c69a3", "comment": "Malware payload (Formbook)", "value": "f7ae6915300313ac67c27e132ba9bdd329af21c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472361, "uuid": "ece2e93c-3f5c-4715-9a64-d7a439f0c73a", "comment": "Malware payload (Formbook)", "value": "4de7cac2109858cd44efc5c207c8e83321506c726bd2a9bf60b56388c0ba937db6ca6dde04747fbcb25f6284dfda9072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472361, "uuid": "7bd821de-9a08-4d77-bb3d-74ccd4c655ca", "value": "T14CC4E04D7254B29FC92BC972CAA42C24A721B47B530FE303945716AD9E0E69BCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472361, "uuid": "c9ebfb5d-f813-4155-a31b-015823880205", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472361, "uuid": "b2743adf-038c-4ba6-b181-73e2908af1fc", "value": "12288:CB+KUJQh2rueZoPpTN2gY2rO89WlUVF5knJ2ZiD+NJyk:KjMrPZGHY2h9WGFWsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630472361, "uuid": "83511c0a-c2c9-415c-95ba-f37f4aa839c4", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630472361, "uuid": "a6d82204-9930-4a48-a3c5-41ce3c4654eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472361, "uuid": "9322893e-de60-4f6d-afa6-a5093a88622a", "value": "payment order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e777bb-0b0a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630489932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489932, "uuid": "1ce0ca02-e4fe-4377-9c19-3dd87e602b3b", "comment": "Malware payload (AgentTesla)", "value": "340d2230f9f553899579f0eb02fd3067", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489932, "uuid": "b88e1343-df82-41c9-866b-03225def7254", "comment": "Malware payload (AgentTesla)", "value": "401dc40c9749ec6f9b6a7ec726d92dd9bb265a4b5c2f5ca6fe5eb940c2754585", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489932, "uuid": "62100f00-ce4c-48e3-9b8b-0e25ec1cd953", "comment": "Malware payload (AgentTesla)", "value": "b9e51745a354c477b93b1160fa75019def10529c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489932, "uuid": "2a02d3c8-c318-433a-94cd-6c98a74d873d", "comment": "Malware payload (AgentTesla)", "value": "16b59257f86f89dbdab04bbf39e9eefc64f8a4b2605e3ab7a09941ba8ef9e89b7ff8a32c9515ba471e5fda8d1090a7fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630489932, "uuid": "a910cefe-609d-41d5-a17e-941da2253742", "value": "T146A4F1583B54BA9EC93BCC37D9981C309B68A4631B07D317646325FE980EB9BCE250D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630489932, "uuid": "d885c97d-d3d2-474d-9162-f58cf66831fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630489932, "uuid": "2b9c5123-63aa-4c0b-91fe-7c10cb34ff30", "value": "6144:Ru5gJBpTGUJ/5fkzq0uYDKUSQwsYTF7APXG9pB2Vfp+jbUGO9AtT6d7QAxihD3NB:Ru5SBpffkzqy+V6u94bEbAEhD3vdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630489932, "uuid": "4b6494dc-e583-4f66-90f1-1db11c10dbf2", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630489932, "uuid": "304debb6-2678-4831-a1e6-2f73193f639f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630489932, "uuid": "668d227c-3fef-49a5-ab0a-e380745c05ff", "value": "Urgent Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a75e63-0af6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630481259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481259, "uuid": "616c5e73-ac51-49fc-8876-1b63fbb18e77", "comment": "Malware payload (AgentTesla)", "value": "97f262d1685c120aa614dba12354e30b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481259, "uuid": "66e7aed8-0955-4323-a6db-7d636a13b213", "comment": "Malware payload (AgentTesla)", "value": "411eea3f8763a985704ee15131e70490ebdba535cb10fb35999cf4412f827891", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481259, "uuid": "77cf526c-3f0a-4655-abe5-5f685ba1cbdf", "comment": "Malware payload (AgentTesla)", "value": "dc5644fde6445b94248e4db195217c996a34d996", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481259, "uuid": "f07a3b95-8411-4ce2-8089-2c59c219003e", "comment": "Malware payload (AgentTesla)", "value": "af4a2fc7fa1e7dea1e1e4706879f869771811d280f6a879b03940538588058cc2be90a667ccf71af1ea01fe4a91bfbb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481259, "uuid": "ff60d1fb-d259-46b0-bd00-19c023ed5d60", "value": "T158B4D05C3A50719FC427CA3A89A92C6096617C7B5B07D203959379EE9E3E69BCF010F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481259, "uuid": "03603b90-5a98-4d40-bf19-8dded8abe758", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481259, "uuid": "6f90713a-ddb4-469d-a607-0940d3f7bd8e", "value": "12288:EoJV8Jwlbiem2svxACUYdv8uSQuw0KRxq/Su0:Z8abvs2GSNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630481259, "uuid": "5cd771cd-6dbc-4982-ba47-28ad8276a692", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630481259, "uuid": "fa38dd47-0da2-419f-9832-0e5cbac69763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481259, "uuid": "78a81007-8553-42db-95a8-3316baf35129", "value": "Payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1f8cba-0b2e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630505505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505505, "uuid": "dcc9dc0c-8dbe-4b18-8e7a-31fbca5f3208", "comment": "Malware payload (Formbook)", "value": "6c0795e7a1460e3eb294d63e6961bd1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505505, "uuid": "b76eb348-ca24-4288-a4e3-ad8913c2b7b1", "comment": "Malware payload (Formbook)", "value": "41747df22b65966e54d0a78b87b8255fe0fbc5fe6f9bacbc4d523c38f006fea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505505, "uuid": "ddadd7a8-8940-427e-861d-21e28e1d9a49", "comment": "Malware payload (Formbook)", "value": "b22052c5c3d10f4296aac12c9d4fcc6a3bd828d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505505, "uuid": "466954e8-a681-447b-a9e2-36c9ba807c04", "comment": "Malware payload (Formbook)", "value": "ceffe4897b61f178cffd3f7d585e9dde276ecfbdbec8ee61209ba1d71f66fa6e7494bd6b0bc0f27b5232b46cebc2d0d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505505, "uuid": "5641ecbc-bd7a-48ce-abd0-117099dbbad8", "value": "T18635129C7654B19FC9A7C87686642C24A7A0B47B530BDB43A04365FC9D0EAABCF011F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505505, "uuid": "9a6bcafc-2d03-4f8f-92dc-cb672ed4e68d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505505, "uuid": "dca8b6d5-18f1-4f8a-b390-d9f70babe386", "value": "24576:ZcYOnMZe/oeLjLZ4A6DRxsc9KWrhgZdGR4:ZbOnM0AAjLZlCCRlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630505505, "uuid": "4f5cc5cb-2890-42da-9e56-aed459808f7d", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630505505, "uuid": "0066c092-c6ca-4ab4-95e0-7ac02fbe5793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505505, "uuid": "e084cae3-3bbe-4d82-89b2-22e0e47d133d", "value": "templefirstzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25b40ce-0aec-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630477199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477199, "uuid": "ec3299f8-5d27-42fd-b824-32f893f15b17", "comment": "Malware payload", "value": "0c6fec239a33864acdd558de506c1c3a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477199, "uuid": "cf9c3014-9cac-4da6-aee0-32bb9e79e970", "comment": "Malware payload", "value": "4174c59dd51eaf62caeb6a582517f14aa87d07eed564b54ded414b51753ec6db", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477199, "uuid": "3ecc55ff-6157-44aa-ad79-da8f26f42651", "comment": "Malware payload", "value": "99348e8a396e8ad8572c698e9305adeb2805e618", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477199, "uuid": "496bc0db-6082-45e3-bbb4-427c666cf9e2", "comment": "Malware payload", "value": "e602c2177a70d5d9b90f1e71e44a746e8f96eb465757396d2ba207d035fccfa62d676f24d37f726f871306fe2163ec62", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477199, "uuid": "acfaf840-c465-4b3f-abd8-abf12bf2cc6f", "value": "T1DFC2082752CEBDE6C9B90A743B3357C1C32DEE085413CA2E56E4751AD9BD2473A923C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477199, "uuid": "aa33c9e9-9748-4b47-b86e-c899f1428809", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477199, "uuid": "f83a1182-5548-4ae9-940a-a8c263c1005a", "value": "384:p+QOgip7cDiIfGNXSCi9CnMx1H/Ewu8q:p+QOgip7yVa5AEwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630477199, "uuid": "d7acc1f7-42d6-4dce-95a1-72da9dc04f83", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630477199, "uuid": "9c8aa46d-bc16-4bc1-9ee1-4843fafed324", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477199, "uuid": "c7d16a58-e5a5-47ed-b090-3181cfb57a3e", "value": "bytes.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739336bd-0b22-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630500313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500313, "uuid": "724061b9-3d87-4ac3-abf1-b26b15660afc", "comment": "Malware payload (Formbook)", "value": "53b8c0b31af3ba5de658c119e39f73bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500313, "uuid": "13364601-2a8f-48e2-8f27-656e246f6e3e", "comment": "Malware payload (Formbook)", "value": "4311e97e616734f94d1aa4d38f37679749ae84513d132aee134fbc364d25b6ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500313, "uuid": "896cd842-290d-454e-b215-5aa55cb0c691", "comment": "Malware payload (Formbook)", "value": "946d13ae1bcc275b3b1e3542b08f04803a93b50a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500313, "uuid": "83336e36-2e14-477d-9b3a-084a8a4b0ee1", "comment": "Malware payload (Formbook)", "value": "bf63ffa1b3a39a04e4ae01cf36c76cd627bd9155ea3d93a1568c8aedf765896b2c53f4a57615585e16b0e13288815cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500313, "uuid": "2acac721-4a1d-4e8b-b821-07f73dce77f7", "value": "T1B4D4231A44C1CCF2EB1B733580B2CF842A997532CCC91B5C8758EA6D7C71347A993A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500313, "uuid": "e8b49753-c0c3-43b3-a73e-5755adf26a25", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500313, "uuid": "b47228a8-9b21-4599-94dc-892abbd5e665", "value": "12288:WXe9PPlowWX0t6mOQwg1Qd15CcYk0We10dOi0I9xkhHnSumVWvc/dNNcEUKc:rhloDX0XOf4pI9mhHisENWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630500313, "uuid": "78b7e9cc-6aa5-41df-a4f7-1c6ad9812d36", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630500313, "uuid": "cefc7394-57b9-4e6d-a9c7-1bc69078964b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500313, "uuid": "3c93fc22-65c2-4988-966c-05dfd695e10a", "value": "TT COPY_003132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919510b3-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482754, "uuid": "bc39ce9f-6442-4579-a980-3239e80a6ebe", "comment": "Malware payload", "value": "408dbe2a1523060c6ade4c824b16e533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482754, "uuid": "1d471ca4-797f-487b-97a8-c9c6a0a52440", "comment": "Malware payload", "value": "437b415e9414e4df3df8296c52abbfdd02f00e908577474e2637f8c36c645b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482754, "uuid": "418bdadd-38b0-49a8-9a69-287f85d03669", "comment": "Malware payload", "value": "cd261a298a038eeb9e2f822ff12e48bd90659946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482754, "uuid": "6dc810c9-3d60-41db-8d3b-36e674becfba", "comment": "Malware payload", "value": "d1470dd04152c76aed43ca6696e0d35faf66841d2dc72dce1f3c8a3e52e370b562dc220f1c12c332731a2c77309f91e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482754, "uuid": "bd83536f-dc78-491b-82ab-7c9a4934fb27", "value": "T10AA42A178D088B83E46883B8BD530E9D2F151B0DE8913AFF706E1DD77B652625C9E42E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482754, "uuid": "d71b5350-958a-4e82-bb75-a20ce288cbe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482754, "uuid": "8300ed98-3d3c-48e7-8d10-fca4603de3d2", "value": "6144:HMfU7u69dOPZnkglxsZHqJ5M1wRkUp+rCzOzpdATkIDG3DRKw1brhqV1vmiBNLPB:i8+BnkgM9+f/peDzpdATkD1ANjzJLff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482754, "uuid": "14e5178d-adb3-47fd-84d9-2e7aa6c1c809", "value": 490904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482754, "uuid": "f7122016-b9f1-4952-a255-22aede3b4d5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482754, "uuid": "fefb046c-b490-4560-b42c-886576f29e45", "value": "437b415e9414e4df3df8296c52abbfdd02f00e908577474e2637f8c36c645b2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4905976-0ad6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1630467781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630467781, "uuid": "609cfd54-4238-42de-94bb-2f37a72da25a", "comment": "Malware payload (a310Logger)", "value": "7203a59e9c9cf2a81785a8b3fa0792f4", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "credentials.txt", "colour": "#497024", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vb6", "colour": "#8EB5CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630467781, "uuid": "5f0c4754-134e-4ff0-b202-81ce657f721d", "comment": "Malware payload (a310Logger)", "value": "438dd5ec50fa56055ec1061a116c6cb5a33093969d9396af232f94c4e04019b6", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "credentials.txt", "colour": "#497024", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vb6", "colour": "#8EB5CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630467781, "uuid": "bc226892-34e7-4fea-be63-6381cbde93ed", "comment": "Malware payload (a310Logger)", "value": "b30416e7b3d02cb8a2b2968ec244b94d4ed49669", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "credentials.txt", "colour": "#497024", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vb6", "colour": "#8EB5CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630467781, "uuid": "3c7857f8-effe-4558-8edf-d2015b248181", "comment": "Malware payload (a310Logger)", "value": "7a30beb7686855fcf68e690943ef6cadb96d9af4ef2a5ee38b889308e4cc4d23d791f2a5304bccc0924908c39e08ac15", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "credentials.txt", "colour": "#497024", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vb6", "colour": "#8EB5CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630467781, "uuid": "501c314a-c421-4152-8124-7220072fb8c3", "value": "T1A4B4DF0593E0F73AD06286F16B6A5799806AEE3460405E07F7C53B5ABBB5CE391B0337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630467781, "uuid": "b32f0280-f6ec-40cc-8770-462748898de0", "value": "64413b67f110af686f32f993323cf3e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630467781, "uuid": "659cb3ad-184c-4690-8807-438cea9a4ce0", "value": "12288:iM7aSdiKUsNpyxGH6EdEQvrRuQ9/mG031ign8bxxW0OLWmJ:iM7bdiKtA+/CYrRuQ9/l4Axc+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630467781, "uuid": "4fcbd361-07c4-43f6-a115-8b528204f569", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630467781, "uuid": "fadeb726-01ce-411d-a6af-0002de63d40d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630467781, "uuid": "0e8735bd-a6ab-4152-a259-3c3727a4b17a", "value": "Ghostmem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d168da6-0b51-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630520435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520435, "uuid": "b751450d-6256-43c9-8831-2e6a59b2de15", "comment": "Malware payload (RemcosRAT)", "value": "82ccaeb12a02d7525eb54bbc12615078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520435, "uuid": "a69fdd24-849a-4d70-af85-cae83f9da3ea", "comment": "Malware payload (RemcosRAT)", "value": "43cc420597e97eb969e5fdc74282358168629f1c6ed9ddb385e000d17ec64a5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520435, "uuid": "9538f9ab-9ec3-45ed-af72-01b6c7a3c825", "comment": "Malware payload (RemcosRAT)", "value": "9b3a4862ee021b35bf284640013b7679a0219946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520435, "uuid": "58e14fd0-89ec-4ea2-9639-23d3d9185e07", "comment": "Malware payload (RemcosRAT)", "value": "89199daf239e1c0246363e0d775ed7e08d2826e620111808a16cabb45b52c6d038bf2e40660c37a9ef294b0cf4474822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520435, "uuid": "9c7f8687-78a8-4e20-820d-edbbdeb482a2", "value": "T1FAF47C15E7D1CCBEE0A528B45C6F63688C3CBD923E28549A1EE43D6C9F3E6E11714227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520435, "uuid": "e2b96832-f579-4235-9ea6-9b7f29792b70", "value": "ee4f103a4bbb8328057c2211d7594d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520435, "uuid": "4bdf9f6f-dc80-4019-a9dd-ab370870a039", "value": "12288:uEkuPF5S618CS6qkVdQOHvDc9aGKqa/ykXKQcj2SKI:uE/HS61uyswGKqXkzcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630520435, "uuid": "7be3cf0a-a3eb-4e62-9279-534722161ea3", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630520435, "uuid": "6b15cc86-75db-4c3c-8552-58b5784eb028", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520435, "uuid": "256242eb-664d-4b7a-8c1c-377d8a451965", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8ae086-0b00-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630485563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630485563, "uuid": "cfe61fc5-a6a5-43ea-b81e-8b966e5ce05b", "comment": "Malware payload (Formbook)", "value": "d32b55acf96361e5c9c8da94c1b8a102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630485563, "uuid": "3c79fc4c-0a7e-4c4a-83c6-71e34c73fe65", "comment": "Malware payload (Formbook)", "value": "4474153b57e54b4c94dc0c4e063dde0a7f296bc8f20a7a5d41d99d91c4239cc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630485563, "uuid": "7bd475a1-166a-476f-867d-cb90dd635d15", "comment": "Malware payload (Formbook)", "value": "8e300c69acd17e35c31b87310fe1c5da7f3f3437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630485563, "uuid": "d39871dd-a6e5-4788-9c4f-ff80bfb17ee6", "comment": "Malware payload (Formbook)", "value": "62969addc0c67dafee5ec8886f6e153f3e8e76faae5ac30b3aaa40fc325ecec89775f2f8fb60c6939e49fbc561651562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630485563, "uuid": "c3d0c7bb-5f4d-4bf2-ab34-58c8fe4d9bce", "value": "T137B4E08C7654B69FC51BC976DA982C20EA60B57B530BE303A44356EDAD0D69BCF021F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630485563, "uuid": "f0dab620-e222-46a5-aaab-3cd345bd6a06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630485563, "uuid": "d004c33d-6b07-484c-bbee-ae9d58500193", "value": "12288:Gr1oGQ/IsfJMTIgR5uxQkIVmVjW4tO7G:8kfJyIg3pV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630485563, "uuid": "57b21131-6149-4f58-8c23-10b23ce595dd", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630485563, "uuid": "ec69db93-8b4d-42a9-889d-e09978f416cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630485563, "uuid": "c078c6b1-792c-4384-936a-142b1bc774a3", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.30627.31065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7a4e61-0b45-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630515443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515443, "uuid": "90f53a74-2260-4b7f-876f-b0fc2a5cfebf", "comment": "Malware payload (AgentTesla)", "value": "a7b96b7a2b66eba342c1652705e74714", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515443, "uuid": "e488e5c6-8183-4af9-aa13-cb48d70ac258", "comment": "Malware payload (AgentTesla)", "value": "45fa193e0f13ddba5166c52d137a02837913127ea98deda93d69b3e08550732a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515443, "uuid": "2e5e2abe-a15b-4aa5-b0f9-86628e690e8f", "comment": "Malware payload (AgentTesla)", "value": "d2bfe8b8895ae5224879e3854d0dfafda20fe174", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515443, "uuid": "8c1f4c6d-a1d2-484c-bb9c-a46d04935060", "comment": "Malware payload (AgentTesla)", "value": "e28829f7614c638cd320d5c51e114f306d4f82bb2ffcc00df63585a017ad03a5e8f903d87de611235ed03e59357fb032", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515443, "uuid": "669255d0-a912-4b50-8347-b5eae41ec6e5", "value": "T165D4AD9D3660B2DFC857C8768AA82C64EB6174BB530BC213A45326EDAD0D59BCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515443, "uuid": "c36ceb07-4cc1-4857-804e-4760fb2ed773", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515443, "uuid": "8b12d7b1-af62-48c7-9e21-b325b31a5194", "value": "12288:UD/1F34N0nqueUR8k2flf2VDsfAA3GlpxabMjFLOzkC+HW:GY0/eFORsIA3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630515443, "uuid": "04ec3040-152b-45cb-97eb-8de88b79c39f", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630515443, "uuid": "4ad8c00a-a179-4dac-8bc0-2125831ce7d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515443, "uuid": "ccb36ab9-7a8b-4cbc-bdcd-1c396bd6d6e5", "value": "comprobante.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52cb96c-0b26-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630502222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502222, "uuid": "c1368d78-f8bb-42d8-be2d-15e4ae4ee2b3", "comment": "Malware payload", "value": "6be902a57792f4d91f497295450d41d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502222, "uuid": "42675e44-4d33-4b50-af80-1cc2c20445cd", "comment": "Malware payload", "value": "474699f1d53cb527a062ae402f469e1c9ebdfce7b11c14e75a67dee881d1127e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502222, "uuid": "fc430bec-b69b-4de6-ac60-152d17f29bcc", "comment": "Malware payload", "value": "8a6ec023a4915c692a4a252171ef3160138d114e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502222, "uuid": "a6753613-9216-42db-894d-f1d5ca184a5e", "comment": "Malware payload", "value": "b5b81f6d6cc0ff5ad0789677a93c3494aac895e423723e868c0fdfbfbd1ced21b3c8f4ea250f4b0db7b8fd252a2f657d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502222, "uuid": "c3840c45-969f-4df5-9f3b-9c2fe789834c", "value": "T1B7846D26F6908433D1731A799C9793A49C3AFE502F2469463BF91E4C5F393823E262D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502222, "uuid": "34b2dcc5-acdb-4e1b-8a78-69fe3359178f", "value": "f6956890a7b47549857fb64c08de1388", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502222, "uuid": "1df5493f-361c-4bd5-b9e9-70c6b468a6c3", "value": "6144:dzGQf6FbaLCXP9yr368CLyaBlli8IZ9rCA+h/O+6VyG6Sss:dzGw60C9W68ik8ioOUG6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630502222, "uuid": "ec55fed2-7a84-454a-bd4e-ee55be04d816", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630502222, "uuid": "e05916e8-a97b-42e9-9db8-37cb1410f75b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502222, "uuid": "9e6949d7-17ac-4ec2-9728-fe0d2e13e127", "value": "MAILSND.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f2dfe1-0b42-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630514170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514170, "uuid": "2508f7d8-eaa5-4b07-9389-440380922491", "comment": "Malware payload (RaccoonStealer)", "value": "1d60970a71f2b146ce4fe99f0efc5a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514170, "uuid": "932f8479-4769-4be4-a0cd-cd61e87a8e49", "comment": "Malware payload (RaccoonStealer)", "value": "474b09dcecdc77683e89deb6a1a4466a033988d3b020bd79f2433aa9a028af99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514170, "uuid": "21903336-56a4-41de-be00-5341c7d68f3d", "comment": "Malware payload (RaccoonStealer)", "value": "eb5f679bbe721f5d2cd880e8111bfd6c6953141b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514170, "uuid": "05969048-38e2-4377-b4bf-57af5575ed0b", "comment": "Malware payload (RaccoonStealer)", "value": "a63b2292c4b0f3c7212544d9e54b01dc9f1bb340685a86258a191f2b10d1d8fa0983f92cc9f652780759230909a3fd32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514170, "uuid": "8867f309-00d8-4fb5-857f-52862711e96a", "value": "T1C794E00B3290C83BD19106314C61D7FA5A3ABC6D6D22D2877BC5276F6FF02A1EB12756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514170, "uuid": "616c3a29-769d-47b7-849d-4376b3d78ffb", "value": "7449bb1bd2f7cf11b31b665cb048bd37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514170, "uuid": "bff34d0d-489f-492e-b32a-98cc375fa769", "value": "6144:rq9rLbMMhBAxjIS2hnJ52YKnqt4e5NVlqPq2a27IanX59EPCmK:+9r3MVxjIS2hKYj5NH9laX59Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630514170, "uuid": "fb9e6983-5874-4a50-9ccd-95f727980083", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630514170, "uuid": "d09e6d79-acc0-4f9e-b8a6-2d1b4225d92a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514170, "uuid": "6f0694d3-8f02-40e8-8e88-36949400abe7", "value": "474b09dcecdc77683e89deb6a1a4466a033988d3b020b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc717e96-0b2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630506073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506073, "uuid": "8ee2ebcd-e2e3-4952-b30c-357027c4383b", "comment": "Malware payload (NanoCore)", "value": "41f8d15a55a34ca15ca2f692ff310482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506073, "uuid": "6f7e7cfd-2ef0-4e7b-921c-5ca37d8aed5c", "comment": "Malware payload (NanoCore)", "value": "47f4d62c59b9643f5dbb6d7447570ed98ccd77e0ef77e5ba870e3b978ae8fec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506073, "uuid": "f1350a74-3ec9-46a0-b584-b125829cbebf", "comment": "Malware payload (NanoCore)", "value": "5cf73381576dbf94f84fd257dd8fb81a6a42d802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506073, "uuid": "fcff5e14-a118-497e-81b4-e82a1d52750e", "comment": "Malware payload (NanoCore)", "value": "bc4c329c2106aeb46b7a0d02b196ff9019362f01e625a4182ea8a33944663a93d1dd137485867acec8ad2d635b70a58f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506073, "uuid": "c984d188-ccce-4b69-abb8-facab6cb9cdc", "value": "T1A3C42312D88488CDF428D271A4A2CB10252BBF4744618B9E797DFD79A9F714224F3DAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506073, "uuid": "c12dadfb-1df6-4479-bba8-4623acf27248", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506073, "uuid": "60d001ce-4288-4bd8-a5e3-20e3d3165c55", "value": "12288:CXe9PPlowWX0t6mOQwg1Qd15CcYk0We1kSXr5XqmuWaMCBKA7W1a9XJkPdRZumpS:XhloDX0XOf4uK5X9uWbgWGkPdRZ7pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630506073, "uuid": "934ace2a-4759-4f4b-9c4d-efb43066f1aa", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630506073, "uuid": "2e8fbe2c-4ac4-4db5-b10c-6997a785003f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506073, "uuid": "18695c07-1400-44a3-9b17-c06009634230", "value": "Purchase Inquiry_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951b021f-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482760, "uuid": "f0ffbcaf-55ec-4aff-8cb2-5d3fb3c28314", "comment": "Malware payload", "value": "1ea93e530926a952ca08296d03e60c92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482760, "uuid": "5aa249a4-358a-40f4-ba58-26ad35f9c574", "comment": "Malware payload", "value": "484b4245494ff1aa09d281689184858b2855c4115bb29bb1ab8e6b8c81108392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482760, "uuid": "91291116-5ae4-43b4-9232-fe7811d4f6fc", "comment": "Malware payload", "value": "310e7eb3913de9cf9b09353fe01f47e8e6944f83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482760, "uuid": "cbe97d08-03c8-4516-9d65-8146ce7810c9", "comment": "Malware payload", "value": "81419b92c1195b3ba3f9cc4fe366cfa0c4947ce026a3e709c71083a58e5a4e262030264dd9aadc21ab35a86c36e19b00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482760, "uuid": "843ecf42-b4ed-44b2-b6ef-32c8936b581c", "value": "T190D44B138D458F93D46847F8BE430EAD2F152B09E8413AEB305E1EDB7F212625C9E52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482760, "uuid": "bd769063-3831-470f-818e-073e3dc0c002", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482760, "uuid": "30d42805-f3c6-42fb-8f94-44a6d29c9f6e", "value": "12288:z8z29+WZLf0nvQUZ3xvKf+pllRLGvOI+Tm:c29+WZL8Y431Kmt/NTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482760, "uuid": "4d4c3ccc-17db-4518-a66f-e82883e19177", "value": 632216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482760, "uuid": "3c1c44b5-7047-4e58-9857-da241fbecd5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482760, "uuid": "96c7a079-8958-44ed-9e75-d2de33d7adfc", "value": "484b4245494ff1aa09d281689184858b2855c4115bb29bb1ab8e6b8c81108392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b90980-0b3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630511135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511135, "uuid": "69f84bab-a639-4b8b-8857-a498d679abba", "comment": "Malware payload (DanaBot)", "value": "a049e4d179686744b0e4e6472aadecb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511135, "uuid": "6003e35f-8431-464e-b718-48618df11455", "comment": "Malware payload (DanaBot)", "value": "4a05a54dfa70ecd26651badbc03975c7c896e0a2f17acb030acf8d12441276a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511135, "uuid": "20a80958-cd6b-4f49-a889-98a3d26a9365", "comment": "Malware payload (DanaBot)", "value": "2aedafb10302fe4121858e8233f826f8260d63ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511135, "uuid": "4e8690de-bd52-404c-833d-ca889a28a9a0", "comment": "Malware payload (DanaBot)", "value": "66682de8ef0be59d6e9bcc4a2036bfc61728a142681010b22d681184080f3dfb19086dbe331da4bc090857b33529a726", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511135, "uuid": "46b79b44-c42d-4729-9c2a-08c86cc175bf", "value": "T1F645122B7261C43FE56106314CA1F7B8A93BBC696A26D18B7BC0276F1FF16D09716312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511135, "uuid": "90d451c5-0867-4a88-986a-1633a548aab9", "value": "80892f18aacf6a3ec193623c3a9507f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511135, "uuid": "7c8e98dc-05bf-4cdf-80ec-9014bc0eda85", "value": "24576:aifXVeSyIuPNpoRP2BmhqNw1N/HWlRM2g/dI8/nJq1:aeeXPNp22BwoNk2g/dI8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630511135, "uuid": "e4c542df-2811-4f3b-8ffa-69cebe6e060e", "value": 1239552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630511135, "uuid": "d4c570cb-771e-4791-9342-96952567a235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511135, "uuid": "b5b5e535-b446-46d6-8398-2f58d5e111cb", "value": "a049e4d179686744b0e4e6472aadecb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9f20c8-0b35-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630508405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508405, "uuid": "803d6836-cf3b-48d8-b127-39d353d90ef7", "comment": "Malware payload (Mirai)", "value": "091f612c0d7e440f052a35a5596eaae4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508405, "uuid": "18210142-a103-4075-9999-d49867e68204", "comment": "Malware payload (Mirai)", "value": "4a7aa0a01769eae16271f1999596a607877cdd30c02ec29f8968710cb8f50631", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508405, "uuid": "a89f4706-b0a3-4799-b08b-84f308b2e34e", "comment": "Malware payload (Mirai)", "value": "8d611e294ef68a657e6b6d3ecf3d10960dc91208", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508405, "uuid": "64fe1ced-14bb-43bb-8507-6cd58fe6f73f", "comment": "Malware payload (Mirai)", "value": "7eb9bd100448532973b1c5627708559646a217a8cc96cceb7c18dab3a5db7188716c8245692c84645143e2fb7d630a01", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508405, "uuid": "6666b5f6-849f-4e49-afe9-1373711043c0", "value": "T11ED31A46E7808F07C0D62B7ABADF425533239B64D39723069528BFF43F837AA4E66505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508405, "uuid": "f17c56ad-e5e4-4c53-831d-7c97e64b5819", "value": "3072:tdPiTKTaXhJG0e3hCn2qaJYGmlasD2IZM/9GXYXCmjwzLjysuV:tMKTaXhJGL3Yn2qahpsD2mM/9GXYXCmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630508405, "uuid": "8362ba52-19d2-4cd0-b580-139378de7843", "value": 142679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630508405, "uuid": "a79fcb6e-2b7c-47d7-9d7a-d7db72c0e327", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508405, "uuid": "ccc11eca-9799-40a1-b49b-1644b60604f8", "value": "peach.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d69fda-0ac8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630461493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630461493, "uuid": "9407c6c1-a308-4333-b375-0983b0965977", "comment": "Malware payload", "value": "6574264abb6c0525878ed22dd15ea04e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630461493, "uuid": "29fd8d07-c533-4336-b5aa-62083bdf0017", "comment": "Malware payload", "value": "4d722ed2510391ddcfc520cdfff4d6bd8d4f1366aa50a82a925fc6d35db5f388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630461493, "uuid": "07a25c34-e339-4c0a-9313-f7848eb6fc48", "comment": "Malware payload", "value": "f445a990069781363f6ea7c088e0781b21438ac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630461493, "uuid": "9466429c-6922-4410-b2d1-35281e114421", "comment": "Malware payload", "value": "539b10f7c5b4b9ef545a00aeebc6f0f1ffd7912d10022cd883a13b28f7661fc96905e0fbd26ffede73f9e5d7b6c28cf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630461493, "uuid": "86de9e29-2051-45c8-aae9-47b8935c69bd", "value": "T1D235E057F3D7F6B4E6BE827A86B1C92C52B6745602B0938F774075892D22392493CB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630461493, "uuid": "50f194f4-4551-475e-b053-e64adaec251e", "value": "946c7b5f0ac6d3a47863eb46459f9075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630461493, "uuid": "eb6504f0-7dfd-4bd1-bb44-5e6c2cee3404", "value": "24576:fZRJHvkJX1acLgg7yqZmBl9y0/DUQIGI:ffJcBEgWqMM4UQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630461493, "uuid": "717c94a5-2703-499f-bb21-bcf7ce3b5544", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630461493, "uuid": "da19011a-16c9-419b-87d8-2eb0824e5dd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630461493, "uuid": "84c1637d-4c5c-4213-baef-33b1849b08f0", "value": "4d722ed2510391ddcfc520cdfff4d6bd8d4f1366aa50a82a925fc6d35db5f388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b37079-0b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630493146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493146, "uuid": "816919d8-07bf-4fa5-a4b6-316f4d8c8fd4", "comment": "Malware payload (RaccoonStealer)", "value": "c1677042cb0c0ffce61c6c5d680db952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493146, "uuid": "4ae75576-48cf-42f5-84b9-39417cea8480", "comment": "Malware payload (RaccoonStealer)", "value": "4d7e732c1981cc7d29cb21e30ab8d203ccd45ae3ad7b609bfd50449c987b6bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493146, "uuid": "fb7cda36-06fe-4720-9bc3-aee0f40f95fb", "comment": "Malware payload (RaccoonStealer)", "value": "ebf528a26ee09df07538bb2d06e9cc4a6053feea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493146, "uuid": "c154bce8-9699-468d-a68d-49bc767178a6", "comment": "Malware payload (RaccoonStealer)", "value": "6ba47f8779b0f94825bfdfed3c19956c4566a2f5c08e261148c0ffb14c27be313de5e8e1e397cbbfab90c785d48dbf25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630493146, "uuid": "30f5c43e-3deb-4590-9663-fcf9b29ffb50", "value": "T18B54AE0B3290C83BD19506394C61FBFC5A26FC695D62C28B37D1375F6EF12A29B12356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630493146, "uuid": "f5713336-4f79-44b1-acb6-dd4f2fdab37c", "value": "4dfee2d5d789a471aa176a087571f5a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630493146, "uuid": "1f11d5a4-2b0d-49ac-b9b9-9db1c4c5b329", "value": "6144:5Npti0LBmXpCO5grki5XEge1IanX59EPCmK:tti09mgO6rk+XTeSaX59Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630493146, "uuid": "91b53dbe-e9b7-4ec5-bcc6-7519f5f1b97a", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630493146, "uuid": "460a64c4-8836-4a7a-80bd-48c70faab671", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630493146, "uuid": "e8581f58-b1da-4878-9a20-bef8ecf24d26", "value": "c1677042cb0c0ffce61c6c5d680db952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdbf038-0b6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630532461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630532461, "uuid": "921a6528-1f52-458b-bae8-d5031fe71edf", "comment": "Malware payload (RaccoonStealer)", "value": "15eccd7e514a1ce1d9c0f6e69d594cc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630532461, "uuid": "738ffd26-9621-440b-87e6-edb34d8d78ac", "comment": "Malware payload (RaccoonStealer)", "value": "4e9d392e4c1e81ae66624cbc0b45deaf0e5226df7cb34e7e8e0beb245393d891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630532461, "uuid": "88893ae0-2cc2-4fe0-9775-16ff995fbdee", "comment": "Malware payload (RaccoonStealer)", "value": "6d6f135775ef5d2fe2d7b1f0598559f21acb02e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630532461, "uuid": "8672d505-ac8c-41e2-b719-783f433e5008", "comment": "Malware payload (RaccoonStealer)", "value": "aebcdd2bc08dffc2237a4541a105636c8014ad230b7ea0a6284c023d325c52d4d5fadad539433b45faf8b3207eb8ed5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630532461, "uuid": "2ed2e15c-c882-47b5-a0f9-6471895171d2", "value": "T1CDB401D5E770C972F4C249704C08C2B06217ACA1FA6061736A5B1B7FBD36E80596EA7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630532461, "uuid": "fb966bca-dd32-4a5f-8395-9ea57ab95b4e", "value": "afec05664b511fad431e988e2a228505", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630532461, "uuid": "d771c27e-6e0e-4b24-9e23-bce54852082a", "value": "12288:s6WcCLKJGCZyu577v1CP7QPyOtTzkMv1Hc9c:0tKJGSyA7cP7QPzkMvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630532461, "uuid": "442a73f9-625a-4e49-ba16-5b778900c67e", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630532461, "uuid": "43346d20-1d10-4546-843a-31056d7f2b95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630532461, "uuid": "ac6fc404-c91e-48a2-a107-392afb3af087", "value": "15ECCD7E514A1CE1D9C0F6E69D594CC9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47342ea0-0b7b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1630538464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538464, "uuid": "154acf80-dca0-4e3f-8cf1-e2436b83f866", "comment": "Malware payload (Adware.FileTour)", "value": "34e7000ea25d295d40b7e69b5ec73833", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538464, "uuid": "b2547617-16a2-4385-8ee0-09825eb5052d", "comment": "Malware payload (Adware.FileTour)", "value": "4f13e5d4c95d72c7c9ee927072c213776880b7aa30f02b0e4d45cbd4261ecab1", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538464, "uuid": "4c1f147d-0737-4e59-819a-21b217763699", "comment": "Malware payload (Adware.FileTour)", "value": "0afe7559d2719138cd9f8407aa63c42757cda736", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538464, "uuid": "6b2ceff3-9b9b-46d5-848f-4608de6a0799", "comment": "Malware payload (Adware.FileTour)", "value": "f2671febeff1f76cf3f7613764feb5190b89f90ecf9b1f22d2537d4057f07bc5e0c639de4939f35109600609388340e6", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538464, "uuid": "cf23f5a2-cf0c-4c5b-98ef-ccb4eda00880", "value": "T1B3F53371BDEDCD96E7DE0A744EB916983CB1A10D23E3523BF2B1351E985B1A43938243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538464, "uuid": "1734154c-5dde-4c17-87e2-63c96a3fc8ca", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538464, "uuid": "0f7a7d82-26c4-4130-9deb-fdeced8785b5", "value": "98304:yYo+ZG3lpBhvPtTwEpiACGF/oMZXWH/lp+iq1J0LT:yYo+03lpBhvRwIbC4ZXWfT+huLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630538464, "uuid": "89a8068b-ed44-4784-96a2-cb6bc34c65b0", "value": 3601429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630538464, "uuid": "16ea38e5-6a88-4a44-aca6-60b183e0428d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538464, "uuid": "984d3595-a4f2-4d96-aace-41ae4e1d1953", "value": "34E7000EA25D295D40B7E69B5EC73833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c2de13-0b1e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630498547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498547, "uuid": "ffa80760-85b3-4087-8745-08e04b508dff", "comment": "Malware payload (Glupteba)", "value": "ebad1b5684ac5d7ebdcfee3171aa274e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498547, "uuid": "888003e2-d9fb-4878-867a-4df2cd7109f4", "comment": "Malware payload (Glupteba)", "value": "4f71b2a4b8c2b49695b57ac172f6fc30e7f7816439c716d5f7b45ca7dcf0a182", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498547, "uuid": "a954f91f-3adb-4591-8409-69ee7d42628a", "comment": "Malware payload (Glupteba)", "value": "3b366a7086aee235c926616593a0bcfbaa45f086", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498547, "uuid": "2f6e7967-a43f-4b21-abd8-2c5d6fd811f2", "comment": "Malware payload (Glupteba)", "value": "fb2328f9c86ea67dfae8cf6a869a07a317330e183b6685691b7a2c5e95c5f2129b355ae85f1dd12d2cc6a4803d052b34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630498547, "uuid": "45322ec6-1c43-4f16-bbda-3a566a3c6d23", "value": "T1E826330A3782C0B7E25C29B88DA99FF91462BC0D0564D5DB77C4738A1FF13D6AB5E206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630498547, "uuid": "25161a62-c96c-4918-8fcf-65107affeefb", "value": "66f6132807e59bfb21d701cc690ae848", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630498547, "uuid": "72b5bea1-bc7f-4720-9da3-6b0ace224369", "value": "98304:IxurmtkdxqHUnOVk96IDLcwZ/lVK0aZk+XImVj17s8Fedv1XrCu90s:Ix7tmUrBicwZ/KZfIqRQ8FqdrC5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630498547, "uuid": "87ced753-e159-4eb1-a845-768427e02232", "value": 4706344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630498547, "uuid": "8667d1ee-62a4-493a-88ad-3c7a83526b9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630498547, "uuid": "fc207e14-644c-43f4-9b2b-e0ce19af34ac", "value": "ebad1b5684ac5d7ebdcfee3171aa274e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d6a04d-0b27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630502334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502334, "uuid": "a937d2a4-2e9d-4e51-bcb9-54e4f4171491", "comment": "Malware payload (Formbook)", "value": "49c64f09770377aeddfdd77d1dce0b37", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502334, "uuid": "b1f27a01-60ea-446d-8bdd-92f60157bb14", "comment": "Malware payload (Formbook)", "value": "4f8664caccd50d9f8ddc2860c2f3238aed695aca18f17efd934bbdc87c7d42c0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502334, "uuid": "32425509-ee6d-4ac6-84f7-72147c8cf04d", "comment": "Malware payload (Formbook)", "value": "6b76940d18e277337baa97726af2193895d6c07c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502334, "uuid": "28cdeb6b-0078-4b16-8bb8-096fdcc2b141", "comment": "Malware payload (Formbook)", "value": "616bf49fb7c92f72852ee14d04329e424e911fa55f5cce617184953bda37d0e37f948c1a0a57d32b390071189a72153d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502334, "uuid": "5a655487-f5a2-489c-91ff-0737743175a0", "value": "T18F92849CC46706D88F856BB42B2BAF4A11CC7A3DFB04A5327638577427E6E3A511387C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502334, "uuid": "7400fb74-474c-4103-823c-6725a5710048", "value": "192:m4oWQTt7zCrUjG3LfwCtDGfA5swFYDPmBljX0DZPuyoGQYN12/8PjI:qWQhnCrLwYDkAewGDPyhq9uhGQW2kP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630502334, "uuid": "627e5849-eac2-4220-91ca-ab8a44c077c0", "value": 19935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630502334, "uuid": "3c623efc-5bcf-4cb8-9026-4fbfb040ad7a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502334, "uuid": "15b4ce93-edd5-48bc-a3aa-ffa0671c56c5", "value": "Proforma invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95edc0a-0b06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630488458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488458, "uuid": "16c8b7e0-9f6d-4cfd-b45d-e8a5e250e0b8", "comment": "Malware payload (RemcosRAT)", "value": "98d926593ca28b2b418fb4208b374c9c", "object_relation": "md5", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488458, "uuid": "5dd5650f-5aaa-451a-ac82-f16c7470c9e9", "comment": "Malware payload (RemcosRAT)", "value": "5000f900d0d52fb1b6634d0437711ab10c9184d080c852f17b2fb114a35446a8", "object_relation": "sha256", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488458, "uuid": "274efdf8-176f-4569-a38f-6ca0b308c285", "comment": "Malware payload (RemcosRAT)", "value": "7bb0d46b6a36833178180c57b35c2b2bee02eb36", "object_relation": "sha1", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488458, "uuid": "d85db2ef-3bc2-451b-b4a0-60a296b022c0", "comment": "Malware payload (RemcosRAT)", "value": "62c81aae67c9ac6d5ab97d24610b9db141add74e6bc200ceaf7c124742799d15fe69e467567824968ddd055312a25f01", "object_relation": "sha3-384", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488458, "uuid": "0dad2986-8885-475b-aad6-a3d7bca9cffc", "value": "T1DF82D08DC196B839DB030D3E556C96E0E208384246B792BF5C18F3377982A87934F1CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488458, "uuid": "6fc8730b-7d56-4b32-a3dd-aa09eeeff1f0", "value": "384:AKlRn4Nq7lgTXSLPu/IasgZY2esqqABF3dI2IgHgR6fQITMaXIG:AKlFRlKCLPFaO27M7I6gRTIgKIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630488458, "uuid": "3e38f070-ac81-4d14-a790-adc7044aa77e", "value": 17815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630488458, "uuid": "bc5ceef5-a1f6-4a02-a85b-deb7f024d6c0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488458, "uuid": "30db5e9e-309b-4c17-86ae-911885650c95", "value": "etat_comp_du27082021.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2923b63-0ae9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630476018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476018, "uuid": "8e13d9bc-1ed0-4a74-8c8f-f75765eb8da6", "comment": "Malware payload", "value": "92ebf45b239e9c47b9ed9721732db3ed", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476018, "uuid": "e45733f9-9e41-4535-bb67-0e9ffe5a224f", "comment": "Malware payload", "value": "5069f36176df8b6e9582c8da04cc7f327e3f118a94c90db8406f8551864b7a33", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476018, "uuid": "28bbba70-2bde-43ca-8383-c546909703f3", "comment": "Malware payload", "value": "c501f359d18d901cfa1a2c32b4f80a4e3b935ccd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476018, "uuid": "626b0c98-d109-45ac-bcc6-f9cc0384279b", "comment": "Malware payload", "value": "e78be63ca2860a6032bb749910dc6d82c3b2101f1e453e3335888a58d3417b39c028abcfbdb5621933515ac2ce55efda", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476018, "uuid": "7ce20e97-8580-4c66-a61e-d0e53c6c71a1", "value": "T106C2D5ACC56742988F45ABB8672BAF01418E722DF385A633357C973827D1E7B511383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476018, "uuid": "d75030c5-5566-4555-a43d-c4c1b33b10d3", "value": "384:Iu6yOKg1jwJhVf+UYwzwaABzP/9HLB5ub26o8a39EbH7kTZR6+q3Ed:eHJwJh9hzwb9XMbkT6Ud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476018, "uuid": "150fc925-7a52-47d3-bd16-f295d1bbd461", "value": 27054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476018, "uuid": "2ecf923b-2f9a-4fa7-ba8b-88d215349082", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476018, "uuid": "340da31a-c4fd-436f-a4f7-1712a646a928", "value": "Swift Confirmation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e913b92b-0aed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630477747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477747, "uuid": "fcb5f023-28b1-4f57-9af0-9c0a28fee9e4", "comment": "Malware payload (Formbook)", "value": "01341338652ef2f8b81da86fb928c8a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477747, "uuid": "2db0aebc-4874-4bcb-b5e2-fbf1b30cfbc5", "comment": "Malware payload (Formbook)", "value": "5087ede548f089a3785b63560c4f4ee91162a220af293fc637491986bd812e25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477747, "uuid": "29e97d5c-88fc-4de9-86f0-da8411132d18", "comment": "Malware payload (Formbook)", "value": "37e4f85e7bd31068ad01f8a84c703dc163211e95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477747, "uuid": "300f10bc-ff48-4163-ad8f-fdc837a68a3b", "comment": "Malware payload (Formbook)", "value": "3ae0843f784fa5360d5c7e2a75525e03f7e9f924ab3d12d2848170ed14dc1d4b9aeabbdf75915994931f203cde55cc6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477747, "uuid": "e98fa7b8-0e08-49d5-bdcd-049f1f6a5514", "value": "T159B4DF5C769075DFC51BCD76DAA42C60AA21B5BB530BE343A45722EC9D0E69BCF020F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477747, "uuid": "2421e905-2133-47a6-8e82-7ec1d2c22377", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477747, "uuid": "14a8ae57-de1a-49b2-af15-81d1a1874183", "value": "12288:IFLbM/aikYIO8HCICeVnYSm9iDWETkioZAUSwe2NPvZQMsqxHgJGCaq:IFvzx5VnYbgrgiYGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630477747, "uuid": "87ba039a-4f37-4fb9-8c49-0fb44802c987", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630477747, "uuid": "9a5e4a02-6231-4813-9b0b-253a8cb50470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477747, "uuid": "704b7a32-ee34-4002-8fa4-7b5e93ba66a8", "value": "01341338652ef2f8b81da86fb928c8a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51604931-0af2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630479640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479640, "uuid": "e2872def-1254-4bca-9343-8b250264090b", "comment": "Malware payload (BitRAT)", "value": "063822ca7966327be6a3dadb06e16d6c", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479640, "uuid": "72b236a0-3524-4f64-b335-dc6bd7c73bde", "comment": "Malware payload (BitRAT)", "value": "515f555c06db60243a892bbdf57704792956569387482f6a7a001a782bb6bcd1", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479640, "uuid": "373c7cbe-2f70-4c45-a33c-51db6eccea3f", "comment": "Malware payload (BitRAT)", "value": "68f61f2bcf3c325adbb190b892297d78a4f75254", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479640, "uuid": "793904d4-3468-4014-9d66-096c623ffc74", "comment": "Malware payload (BitRAT)", "value": "a6af037d8b0ad8fe3b75cb3c0a628c70c9c48157b007546abb1bb4351871ad9f1400d5f03fb75e228ae42e3f077051d6", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479640, "uuid": "acb6a8ab-0ba8-4d03-999f-89d47d333047", "value": "T15046233763A50189E0F99839CA33FEC473F60A7B9A42687CF5E95DC126176D0F212993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479640, "uuid": "0e041f7b-e4b5-4f69-8207-5e72d4516ed1", "value": "9b002fa0ac6e2e121257be8c62180f42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479640, "uuid": "8f9bef89-2efb-4eb7-aef5-e59a15973dea", "value": "98304:rwitMnL27vkvY2eWS1kS7zLfSwtrNRbkT8+LuduAkmBJBi4/q0HTS9S:8i02o7eP1kS7zL6wXnXw4nHTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630479640, "uuid": "0c541171-08aa-465c-aa6a-e0bccfa0b6d2", "value": 5859328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630479640, "uuid": "6196f814-9d99-46c5-b098-1ddb7d846c15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479640, "uuid": "c9888360-fc3d-4121-8b69-36d0eb1e6aa1", "value": "063822CA7966327BE6A3DADB06E16D6C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1118d76c-0b40-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630513033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513033, "uuid": "ee1e0f7a-c59d-4213-a5f3-413db6dd6632", "comment": "Malware payload (AgentTesla)", "value": "69b8698742a71d727610ee01f3682d48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513033, "uuid": "16fad503-b2c3-4866-bc52-d1c9a1860653", "comment": "Malware payload (AgentTesla)", "value": "528fc6d3398f8379da836b5a3fa85da6dfd8aec284ce12a04abfa32d6d78da14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513033, "uuid": "ae6f1105-6f85-443d-b322-8e66d18f8606", "comment": "Malware payload (AgentTesla)", "value": "a9fabb342309dd6b0fd254c0cbbc877f469853a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513033, "uuid": "270efb6c-ee58-454e-84b3-108fdbbf65ea", "comment": "Malware payload (AgentTesla)", "value": "2137ea4f9dbf1810212cf6e98f803fa534c81ae88a91f8a749f7b871ac9f854be8623a5ef971af34bb346e11fed24d1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513033, "uuid": "2728ca5e-a756-48a2-b056-5577e6e28394", "value": "T1DA35203DAD162537EBAAB57CD4A6194EE39414EB23718DEDD2D2B34C204B61372DA30C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513033, "uuid": "b577edde-7d0f-42b3-b386-f52fcd151dab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513033, "uuid": "08aeeb8a-8bc9-4375-b14b-b215beb1f3f8", "value": "12288:ha/F84DtPASSVdYiO5GpS4u6C5oWpf0y3k0Vb/AElj8iDxLBYR1p2Z3+Xf6Mei0B:haNb017FV/8Hp6bU7d8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630513033, "uuid": "137a54ee-ca0f-4bd4-aaee-5bfdbf5d5f98", "value": 1140224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630513033, "uuid": "be8de953-11cf-426d-be9f-128788685a5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513033, "uuid": "3210e46a-d3d2-4892-9060-4c317230acf2", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a1df29-0aef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630478431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630478431, "uuid": "1ed8a1d5-1d2b-4070-870b-5e63665cd72f", "comment": "Malware payload (Loki)", "value": "ad806b1f4cf277ecffdb3c83c1bc7aa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630478431, "uuid": "e4299fa0-3556-4898-b54f-2ee278c7f7ea", "comment": "Malware payload (Loki)", "value": "533fd8da75df1b1ba32eb92e70fcc930920a8839736e50c043c5df11eed21dd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630478431, "uuid": "3591461b-c33c-486a-8539-66e9c6f5bfdf", "comment": "Malware payload (Loki)", "value": "df861ead314f860f640f9931c7c597603b571d0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630478431, "uuid": "36cf5ffd-1c17-481e-8a56-d81df36a580d", "comment": "Malware payload (Loki)", "value": "6543555065ad90f69d6d66bbcfae72c2e192077b936dcd18db86a5d7ce9a699d57102cb269c8c2f08f2a5e17e2f787ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630478431, "uuid": "ba3c88bb-7af1-4be1-84ef-7368d4384311", "value": "T1E1D4238088C9CCB5F515B37590B3CE9819A5B8338CCAABA98355F97D7835103EC535AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630478431, "uuid": "fd25b8b1-0828-475c-9748-129cca9a26de", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630478431, "uuid": "6f70ca0e-fe0d-40d2-8a3a-b354d2988358", "value": "12288:tzXe9PPlowWX0t6mOQwg1Qd15CcYk0We1rwLsjMi1d6PN54NsLs/ob2k:tahloDX0XOf4Zj11ONSmLs/o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630478431, "uuid": "e0bc1510-8c0c-4422-b5f2-4577038ae74c", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630478431, "uuid": "34d7e80a-a4be-4dda-a765-0ec3cb980cb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630478431, "uuid": "1993f936-1e02-4b84-9535-824b41c48814", "value": "ad806b1f4cf277ecffdb3c83c1bc7aa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f56105-0b10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630492553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492553, "uuid": "dfbfc474-375d-4629-8748-44b17a65d714", "comment": "Malware payload (AsyncRAT)", "value": "40a001f11b2711376e51c05bc2dcea13", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492553, "uuid": "f5690b7b-29c1-443a-8ff8-990500823bc8", "comment": "Malware payload (AsyncRAT)", "value": "53d8f435075a3f419aff2ea631201f02d682a2ed92fc3bbb265faac63c5cbbdc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492553, "uuid": "281cff16-281a-4e34-b613-b4ff108b50cf", "comment": "Malware payload (AsyncRAT)", "value": "a6d9a991b0cdf9542c8af47c825bf1028aeb5505", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492553, "uuid": "8ea369b0-4e7e-4af4-8941-aea4ff698436", "comment": "Malware payload (AsyncRAT)", "value": "d1f96f986585d6bff7d346c56ddb871e5d08ce3410537b33fa6eb08839d0d5ba7a87558145521f3f9a0701e5fcba6372", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630492553, "uuid": "ce482e88-0871-4d8f-b112-eda6a5223121", "value": "T1F2D3A40327958326D1690AF038A151DCC63AAD3EE5D3EB4D38C4FA9EDE336914A117DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630492553, "uuid": "bf8d777b-2d88-4511-822e-14cd40610a27", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630492553, "uuid": "849e06b4-450a-4f5a-b2cc-8a4a1355314d", "value": "3072:NBou0TTBnck23Ekq/zhn4bI8Q4RAy9mxRuXWNCR:vou0Bkc/zh4bdQ4RAyiKWNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630492553, "uuid": "87658f26-c66b-4948-9571-bb3fe3ca80eb", "value": 140800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630492553, "uuid": "fe549118-06e8-40bf-81f4-f5e62ebf67bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630492553, "uuid": "66055acc-6430-4017-9f4e-a60b06722670", "value": "40A001F11B2711376E51C05BC2DCEA13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e720aad3-0acb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630463141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630463141, "uuid": "73bc2d18-5c72-43d6-888c-fb71c267ab6b", "comment": "Malware payload (Loki)", "value": "91b958328ab872253cf8a3d26ce55cce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630463141, "uuid": "447838b3-a660-4d50-b91a-c5e87c3cddc1", "comment": "Malware payload (Loki)", "value": "54802aa4ca1557f67314a573e918be4157b838d1bd0aa30c23d8e1f312994dac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630463141, "uuid": "4e101872-bcbf-47a3-a0f6-fdf4cf6e1368", "comment": "Malware payload (Loki)", "value": "6fb34bef390f0edb160cf728afd6fc42c86d37ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630463141, "uuid": "d7ba17ca-86c9-45bd-9cad-255294d73aa0", "comment": "Malware payload (Loki)", "value": "d81b4c58731893da35555142338bb88d7973424cf70981bec348b0b855f587b940a0b044159cf686dbed470d8a585d77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630463141, "uuid": "c6de1689-5d28-4d2d-8aef-2b859be625bb", "value": "T1D1D4238B84C5CCAAE62A7374D073CD9816A278328C96376C8358D95DF5B1303BD53E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630463141, "uuid": "f1c22d59-eebd-433c-ac1a-87f6a803842c", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630463141, "uuid": "3b9eea90-f7d5-4e10-9d37-d8f028ca07e7", "value": "12288:XXe9PPlowWX0t6mOQwg1Qd15CcYk0We1EtNDxRZUTwhbna2d0zyJ:+hloDX0XOf4cfZjhmly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630463141, "uuid": "46c89350-ee46-4381-bdcc-a5c6acf521c2", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630463141, "uuid": "4aeda8f0-346b-4964-8192-3aed8e49f141", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630463141, "uuid": "5dd65032-2c77-4dab-9503-b9c16997f02a", "value": "RFQ0932165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59cfb95-0b59-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630524127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630524127, "uuid": "47bdfbf4-0e3c-49ef-9066-864df8d0ab10", "comment": "Malware payload", "value": "a34d4f165087b11d9e06781d52262868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630524127, "uuid": "1ae5cfee-1a8b-484e-97f5-cacfa39f2391", "comment": "Malware payload", "value": "55ad26c17f4aac71e6db6a6edee6ebf695510dc7e533e3fee64afc3eb06291e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630524127, "uuid": "c6e54097-c225-403e-ba0f-baa369e54d8a", "comment": "Malware payload", "value": "1b7b6a5bb53b7c12fb45325f261ad7a61b485ce1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630524127, "uuid": "1d401d1e-f295-48e3-ab63-e4418ab68200", "comment": "Malware payload", "value": "f47bd9491496d6929ccaf4d65d80be1af72cf37d0f2f85deca3f1e08a75a930e56a6993d69edaa6d1c81807be06cdf1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630524127, "uuid": "7066e596-04d6-44aa-8751-addfcf1893d7", "value": "T16B948D213AC2D032D5B311305E69D67A5A7EB9200F705DDBB3E41E2E5E31AD29632F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630524127, "uuid": "339b5e04-dabe-41d6-a35e-3c5d35679fb2", "value": "ac35c5d1a782e9d9206f3d7dce4e8cd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630524127, "uuid": "95587d4d-6095-405b-bab7-efe111186307", "value": "12288:i4HyzQyz5io+HEbdG7U674UdfE+jwbuTphIvQZy9q8oi9:iyyzQyz5io+HExGWUAyiqZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630524127, "uuid": "45f9191f-30a4-4a91-9582-e6b58e772024", "value": 413856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630524127, "uuid": "29ad35e5-f86d-4cca-8316-ffec38a6ba78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630524127, "uuid": "94ed9213-b695-4c72-82c5-c1dc939daefa", "value": "Binary.viewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36253c08-0b4d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630518679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630518679, "uuid": "6c938818-dea5-4b49-a0db-ac0ceadab82f", "comment": "Malware payload (RaccoonStealer)", "value": "5f7c52e58df2b80a99bbaf40d0cd70af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630518679, "uuid": "1c0d5f12-5377-4e8e-8596-93e8b23961f1", "comment": "Malware payload (RaccoonStealer)", "value": "55eebe9d7ba942dc7e308f277389bc5f4412fba5c828c2b1b154a1bc3b514dbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630518679, "uuid": "54aa5d29-fde9-4318-acc9-5180043e75da", "comment": "Malware payload (RaccoonStealer)", "value": "cbfa428959c51a8c156fe8f1569e33b3f13b724f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630518679, "uuid": "e04a74ec-1971-49da-b6b5-23457b630273", "comment": "Malware payload (RaccoonStealer)", "value": "c2400e5ef250046a85fe8b9b62534d205b3486b553cc55d03e5c0beb6f34d50f9371e35bde2d4b41f1f1c0e7790ce07e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630518679, "uuid": "4dffeaaf-1f0a-4d6f-b844-e8d82b50d3ea", "value": "T1DCC4F13B72B1E83BD195C2B08876D3F55A36BC596D22D5C737C0225F2EF1291AB22346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630518679, "uuid": "36278e7f-40c8-4e0d-91da-204818b93a45", "value": "6c24281dcaa86901b7166ae3ce878d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630518679, "uuid": "e3ddd42a-91b8-4025-9b93-c32564b6523d", "value": "12288:K3GpCRLmZ0g57KBmyP7Tgw3clOnh/+WaX59Y:Oe0uKZgLsBr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630518679, "uuid": "ee7b2836-b0cd-432d-9764-f827dc491298", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630518679, "uuid": "33c3b7e0-af24-4990-b4c8-e80f41e8eb86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630518679, "uuid": "0885a57f-a02d-4c1e-affd-0e1ca8eb673d", "value": "5f7c52e58df2b80a99bbaf40d0cd70af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08f6613-0b3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630511582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511582, "uuid": "586f38dd-0679-40d4-b277-36ed9c188c55", "comment": "Malware payload", "value": "69681ecba86d11ff32621e1589cf979a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511582, "uuid": "534b409b-6cbf-4f81-84e2-4927c65d1bc7", "comment": "Malware payload", "value": "5636d93d0c2347bdc5d42707051e8e5ef15f69b2e2de5f83c6471e4c45aa6acd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511582, "uuid": "1ed4d50e-719e-4478-874a-6402b7061c2c", "comment": "Malware payload", "value": "c35b744a8fed4d553f73474f790dcfcd12da8a44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511582, "uuid": "4c8a2c88-8097-4b88-a0c0-8c393cc2b129", "comment": "Malware payload", "value": "b8507241ad36a8527544bc59fb9f00753b500c46cbf07218ba8c713731a8c213a475840beab331ec2975630d42bb921e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511582, "uuid": "4e743013-47b1-4d44-9e74-8578b6edd091", "value": "T10981C65BB73A5593D2B12A301C6BC65823A7BC01ED20A41337D5732E0D7C688DFB65C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511582, "uuid": "12ea9ade-67c9-45b2-b5d9-2ee17a850e58", "value": "48:rb3lCMDtSMnk23l6WiQiOhXcj1dv9LnSu:Jo2l1zg1dFLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630511582, "uuid": "9726fb69-5e4b-4440-b467-2a9994575356", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630511582, "uuid": "87005d53-8e47-49d3-b09c-419d0f45fa7b", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511582, "uuid": "fc6812db-9f41-4065-bc6d-4f33fc0b87fc", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.3.24512.26002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0609fe2a-0af3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630479943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479943, "uuid": "cffac464-f97c-4d6c-9314-22e1041ca28b", "comment": "Malware payload (Loki)", "value": "22e13da13c4acb41c5b954bf7dedf79f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479943, "uuid": "2129d292-63eb-4945-8fed-67b9bf1abd89", "comment": "Malware payload (Loki)", "value": "563818872af4977ebccd2bc8f97e968edeb6cce444c7a380b3c69e53fd317c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479943, "uuid": "ef3c80af-fecb-4d9a-adf9-2097afdf322e", "comment": "Malware payload (Loki)", "value": "70c34a5e1442816c23d78454edc2c7505f43f82b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479943, "uuid": "b91b26c1-0e9b-4f80-94bc-3ec21667b3fb", "comment": "Malware payload (Loki)", "value": "e9f33adbb7d41ef5464b63471d7003307a4151cb74fbd2cfe4b005695bb8d37fc71fee457047dd01d7e192dee26000e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479943, "uuid": "a3060501-5480-4564-a7fc-a01c5d99668c", "value": "T135F41243E8848897D818473196A3CE3E3177FF722D766B4A774CBB7D1B3235269120A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479943, "uuid": "659ef4ce-cc0d-47b4-9e3d-ac9ce1663184", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479943, "uuid": "581f6512-d38a-4d50-831c-b418de708a1e", "value": "12288:OXe9PPlowWX0t6mOQwg1Qd15CcYk0We1CqT0IIiEdMcWA3t6my:jhloDX0XOf4bgSIM+91y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630479943, "uuid": "620cc0f2-10d2-4ed2-a0ae-68ee2d70c568", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630479943, "uuid": "62e0e361-7eb8-402b-96e8-ac105c29acc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479943, "uuid": "6d5768f1-56d4-4c26-8bcc-1037da209105", "value": "OR31-0821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddca4289-0b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630504786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504786, "uuid": "f7e1bd79-e3a2-47c5-939f-559a426fd98d", "comment": "Malware payload (AgentTesla)", "value": "b69ee418f4cd6e135754d11c497d3127", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504786, "uuid": "d006f4bf-a6c0-4bb3-9dc7-d1d282ff527e", "comment": "Malware payload (AgentTesla)", "value": "574013d909e0610f956065d80282b577881218d8294d223c74146e0391e9b11b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504786, "uuid": "38107ad7-f21a-4a07-81c0-fc95cefa43e7", "comment": "Malware payload (AgentTesla)", "value": "d1ccddffda7f93c4c09d19cc6f0722e83960b718", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504786, "uuid": "8632585a-2279-4c8f-945d-f03c5e581a6d", "comment": "Malware payload (AgentTesla)", "value": "2eee9732e276286ac648579638a86058d42edc940a55bf778421d45388d86d9c4b1726b4d84a08750353d5855584f988", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504786, "uuid": "b563172b-b0e2-426e-96d0-a2cdae51c982", "value": "T15DF4FB7F19BDA1279175C2F58BE78427F0018BAF31206925B6D643164323A7AB4F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504786, "uuid": "30da0acb-461e-4175-b969-546b8496f043", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504786, "uuid": "e2340816-c1ff-454b-bac0-24bc2b31f314", "value": "6144:bPKAyiIHVPOHBBeVDGP+azoVPYefG33Wig4FWiuOeI4hM/9JUY70V1pm5ZvQE:bPzm0hBeVDGhoVzG2ig4FruPhMsqGQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504786, "uuid": "78ef29a4-3174-4591-8bbd-23e2d0c19bad", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504786, "uuid": "a6d02089-9053-47fb-b745-dd06c5e4f9f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504786, "uuid": "2ee5556c-1742-4158-96ef-1adc2c6cfbd5", "value": "purchase order 397478384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0df9982-0b52-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630521086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521086, "uuid": "4d7a725b-acfe-499e-b4e1-fa1e5985ccd5", "comment": "Malware payload (RedLineStealer)", "value": "82847b456708d7b247a771b31ce45c29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521086, "uuid": "5206cb5b-4c53-4ed4-808f-759268eef0fc", "comment": "Malware payload (RedLineStealer)", "value": "5804fb4dbfd8366a6ebc62e26190835d4a6618851f23eec534305e43b7bade8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521086, "uuid": "c3446c2d-36e7-42dd-9a32-a106114c39a1", "comment": "Malware payload (RedLineStealer)", "value": "cd2ffdf128c4856ec81e17414bb5a44cdf592f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521086, "uuid": "044c8c28-5c83-4dc3-a52b-ffbcbc91df01", "comment": "Malware payload (RedLineStealer)", "value": "0bd918cb4bbc3102f8c88c3a5255f7a5b5b0f9a502c22910261a8d7652232df1c36311f37f18b885ec4c5375837c6623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521086, "uuid": "4573f4a2-7964-4af3-b75c-2d5febdbc2fe", "value": "T108D3F52342E34C52C1089734D952EB333B69CD141921F357A5C5BE6BBE3EA9D6EB42B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521086, "uuid": "4aa5fb04-7393-4dcd-92ea-d5bf2d90a235", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521086, "uuid": "1071d096-a83d-4d07-bf08-039491f0f28f", "value": "1536:x+3vn0KkjHqxqq0nrssMRJe/NsYKih1sW8F:03v0KkjHNq0JMbe1shAd8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630521086, "uuid": "f42a4e7e-d067-4eba-aefd-7027c9039a29", "value": 135680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630521086, "uuid": "771d0faf-1426-489b-8b7f-4fd0c55ad308", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521086, "uuid": "fb6178aa-d2f8-4851-9537-35ea5fd4f27e", "value": "82847b456708d7b247a771b31ce45c29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f8e81b-0b04-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1630487357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487357, "uuid": "eafce7ee-e29f-4e34-a819-784943b2a65d", "comment": "Malware payload (Amadey)", "value": "aba9db7852b8aa94b1caace4ae24650e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SANTIN SP Z O O", "colour": "#592436", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487357, "uuid": "eb1df2ab-02f0-43fa-a10e-07cbb585c856", "comment": "Malware payload (Amadey)", "value": "585ff16b69976f92d9d507b1b43c2ced804cf4fb30e822cf19f404a4f2245a96", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SANTIN SP Z O O", "colour": "#592436", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487357, "uuid": "81d1d4bb-0c57-483f-a974-9c36ec5126e6", "comment": "Malware payload (Amadey)", "value": "9c2123f2bd2c49f2d606c048e02c6966755a0335", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SANTIN SP Z O O", "colour": "#592436", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487357, "uuid": "8b752917-e243-4d5b-9cbb-d63688490e76", "comment": "Malware payload (Amadey)", "value": "3dc3340451b91c4096a3ec47e5e81376f4dc27c507dde657577c3e213b7bb3ade8776a3f2d72106aa13e73f00296c894", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SANTIN SP Z O O", "colour": "#592436", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630487357, "uuid": "78d08f16-bf8f-4084-b18f-042369d04dbb", "value": "T18664AE30A690C035E4F712F449BA82BCA529BEB0A77450CB63D53BEE56346E8ED31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630487357, "uuid": "eed50387-3473-4e27-833d-610c12ab1afa", "value": "8bccdad7743fdd57e0a7b3bec87ab2cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630487357, "uuid": "6b9eef10-c28b-41a4-9ac5-443ca2da62b9", "value": "6144:1m8jJFChS7MsziVD+JX3m7L8+KLEO010+KVUCjDflpP1gf3LQuhG/ib:7EhS7MzVQXW7LzgEOZ5vnflpSf38um6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630487357, "uuid": "99efd68d-990e-4981-9e0f-6fb7ba5a08dd", "value": 331160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630487357, "uuid": "ae3403d0-54cd-453e-bccf-9589f4aaa50e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630487357, "uuid": "e2cdc47d-a6f4-4d5a-a8f1-e23d75cca504", "value": "matasanos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9fe4da-0b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630504623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504623, "uuid": "5abc10a9-dd3f-4210-a778-c12734108c11", "comment": "Malware payload (AgentTesla)", "value": "86a0731126ac680170e6919b054e2772", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504623, "uuid": "8d420a99-d178-4fd5-8a4e-01a1ee52f223", "comment": "Malware payload (AgentTesla)", "value": "586595539f719ccda069de7f26eb2208f8522d7a8d1fe4a5fae0e2d93abf6633", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504623, "uuid": "3ffcff36-07cb-442c-a263-179d44ddb200", "comment": "Malware payload (AgentTesla)", "value": "44cc038246f047c427bc307942b6b88f9073b358", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504623, "uuid": "f35f07b7-5a17-473b-b33f-675b4079b6ba", "comment": "Malware payload (AgentTesla)", "value": "ae91d6337c87d060da137d89f82bdf4cff1ed8f3c04d4b3533790e4e999df6c4ac3679a3a0140f0beceb26b5d38cc021", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504623, "uuid": "480c2019-f618-4b40-9404-22b21ea97817", "value": "T1B3B4DF9D765072AFC527CD76CA582C20AA217077870FE243A4571AEC9E4D6ABCF061F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504623, "uuid": "e5627138-5f00-453e-bbf7-4141eb4aba67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504623, "uuid": "2655b28c-d4a0-4daa-b88e-802af9272b6d", "value": "12288:KqrF3On0sFkEqmUZ3rop0YpuFnB//x9CPp0gGS1+6euJpiUEZbNZ0:nlSFkqSrF9xM6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504623, "uuid": "4b0607c7-75ab-49f9-ba1d-54894c025b05", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504623, "uuid": "73a8837b-18ba-4153-91ac-045f0488c66d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504623, "uuid": "0e8454fa-27df-4e65-8e8d-1accd9bad591", "value": "Pokwitowanie transferu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93591887-0ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630471161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471161, "uuid": "1dd4ec18-0629-403a-a9dc-4c3bd50f405c", "comment": "Malware payload (RaccoonStealer)", "value": "420ccb6530d25bf9a73b88d149c5ec74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471161, "uuid": "c7b7e4a6-f92b-4392-858e-77b68941baf3", "comment": "Malware payload (RaccoonStealer)", "value": "5a596e7c0f64b2c7f19ff48ef15b1b916845a36100cf76c236a3448a85e3c3dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471161, "uuid": "62780dab-75da-46d6-8f75-77bf67e4177f", "comment": "Malware payload (RaccoonStealer)", "value": "7ee294f492ff17fbe997bcc3e6808c1bf78b682b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471161, "uuid": "9e6ad8e8-708e-4bc8-b2de-9f29a89d05b3", "comment": "Malware payload (RaccoonStealer)", "value": "ce167c0bd9736dab548fb96a1bc64b48f15ae157fbe895c3abad7cfa1ebd8c7aa4878ec9c0290c53302b4e66f0f87a0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471161, "uuid": "c689f315-4fbc-4972-80c2-3a165f9e06de", "value": "T152C4020BBD50D83BC59206306CBAABB49A25BC4DDB12D54776D5FA2F2EF0390671331A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471161, "uuid": "590611ce-feea-4a29-8778-2d75951f5ce4", "value": "643ebdf6c61886ec0dd55f3c7b737569", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471161, "uuid": "cfe0ec6e-bd37-46e6-8f7f-5f6ffe1ed35a", "value": "12288:Vup40j44UaTK8RToI694fs/zV+4G9KaX59Y:N0j4Yd6IC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630471161, "uuid": "7c73e36c-46a7-47fe-a38b-e07dff4438f5", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630471161, "uuid": "295cedf3-072b-4f16-91a0-2ddc9777ca3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471161, "uuid": "9355cb2c-c51b-4111-b4d7-e06c7b23895c", "value": "420ccb6530d25bf9a73b88d149c5ec74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2214f3aa-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630482567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482567, "uuid": "fe6b23d3-eef2-43f6-a67f-5942d6477b24", "comment": "Malware payload (CobaltStrike)", "value": "2a6aac08f29f10209082172127bed7d2", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482567, "uuid": "6d4b912f-d5fe-4562-8592-1971a8d387fa", "comment": "Malware payload (CobaltStrike)", "value": "5ab95684cb8a8355b3f2f334fce6f2a96333ce5b51ffb2e1030d8a36c85c43f0", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482567, "uuid": "35dcf7ce-a19f-4d56-b70c-3eb46d210c5c", "comment": "Malware payload (CobaltStrike)", "value": "2af2212558c3d28edc29b5d50e0590efd6f3c428", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482567, "uuid": "e441b5b7-404d-4e09-b274-0339ba59c038", "comment": "Malware payload (CobaltStrike)", "value": "02f93514b1919d11050ad4f3caceb2e0c3f7adf9229fbeae685fcf0c40532147fcb33a690f82d7e07e2bf402c2dbf63d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482567, "uuid": "4c9003db-4653-47ee-a829-9804a0f0ef3d", "value": "T110E4BE02FAE544B5E06FA13EC9A28646E7713CA8577183CB57A19B1A3F336E15D3D320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482567, "uuid": "12ebd5c9-7aeb-41ef-8235-a2ff6c952788", "value": "9114164a661eb32d2b69f8dfc4e3265d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482567, "uuid": "55bcf59a-95b6-4920-9e46-8d551f9124bc", "value": "12288:FB2HWlMZkfAm/v/0GKvJIWu2I1wlJy0lrF/n:FrMZkfAm/v/0XvNtIOlZdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482567, "uuid": "1c879679-195b-42dd-b388-10e8a3670b08", "value": 685024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482567, "uuid": "dfb1390f-941b-4d45-b251-c6b009a2839d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482567, "uuid": "07acd242-af01-4648-8bd2-3ff3b12ca66f", "value": "5ab95684cb8a8355b3f2f334fce6f2a96333ce5b51ffb2e1030d8a36c85c43f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77cd418-0aea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630476402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476402, "uuid": "e9082e72-7250-415d-82a7-da7f9f3a121c", "comment": "Malware payload (AveMariaRAT)", "value": "d6bc9cb3362a09dff11449527080e03f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476402, "uuid": "b2c8d7c7-e54d-4daf-b9aa-435061c8767e", "comment": "Malware payload (AveMariaRAT)", "value": "5b91df85affd5ae567a565e3dca83bc8a014acddcf7bd743782b7b6cb2f93754", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476402, "uuid": "961ae534-2d34-4145-b0e6-8e3a6be3475f", "comment": "Malware payload (AveMariaRAT)", "value": "32c8a7334444bf8844b0091255bbefee83ddad6b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476402, "uuid": "730d925a-af55-421d-826c-6c6adfc3dc8b", "comment": "Malware payload (AveMariaRAT)", "value": "79a93da361bb6ad5e047e1a6c9e7cc8a06fe0f3e71bdac3dc38aedb9b8e894715e973d3b119e2b6fcad21e7414418a66", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476402, "uuid": "fc07ac2b-ca23-466e-8c56-46d455c0a022", "value": "T1D5C4E163A187DCA6D649593D42A4FBAC423CCF524D1FA68570793223EA73D0B2F48CD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476402, "uuid": "462838e6-de88-4f2d-9784-c7868e093db5", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476402, "uuid": "821ede57-70f8-4d17-aec7-cb71a06d5b32", "value": "12288:+Xe9PPlowWX0t6mOQwg1Qd15CcYk0We1nNzfJoomJxRHHE6mRsc9gC8NLhPtDWl3:ThloDX0XOf4RNzfJhOa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476402, "uuid": "9a72ae88-0c1e-4337-8bdb-2364bd88dc39", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476402, "uuid": "e527a0c1-b7d1-40c9-b009-5977d364e802", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476402, "uuid": "d9cdf76c-2f53-400f-8a4f-04b6a0dae638", "value": "Bank Remittance copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a06bb0-0b72-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630534619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534619, "uuid": "297f77b7-b997-4789-8068-a6c285d811f3", "comment": "Malware payload", "value": "1a4dab5078618aa73e827fd62edec91f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534619, "uuid": "a478f444-5d1c-462d-a8f9-c77cb2be51cc", "comment": "Malware payload", "value": "5c7868a7b214c1173f586173731c145bf0d466e08c0ceb7a00d0957cc29c0f7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534619, "uuid": "4aad5266-eb88-46f9-8f6b-a84f214e050d", "comment": "Malware payload", "value": "7f9384aa3884615d11c471fd8421f689aa0f6d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534619, "uuid": "fe8afefc-3ca8-4c17-9490-f567281164fc", "comment": "Malware payload", "value": "e2bd7130229decbb29b7681cf9e779e5231812a877df7ba8407384b8283ad5ed2170f6c7682d5680304a1780363fe4c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534619, "uuid": "8e57173d-8b57-490a-8ea6-ded5f1391790", "value": "T1C1E42C3E18FE23279176C7D5CBE18823F6D098AF3233A96567D747264316A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534619, "uuid": "66ffefec-48c2-433d-88b4-7125017b6e95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534619, "uuid": "2c0c3bce-4749-46b6-8eeb-ff495a688984", "value": "12288:bbBD5VoWi8q/vdA+qHcEQFv8P/vC4/yqBM:X+W3q/vy+qHcEQFEP/zX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630534619, "uuid": "562f6c2e-feb7-449e-936d-f2aa49d3be11", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630534619, "uuid": "c6a30961-f49d-49a3-abc1-2eb6f6cfe964", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534619, "uuid": "6a3efb87-e141-46da-b4f0-a6caaa91d8a6", "value": "Quotation#QO210109A87356.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cefb47f-0b2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630505107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505107, "uuid": "91d2c7bb-9bd3-461e-9d39-3bd3500b20b5", "comment": "Malware payload (RemcosRAT)", "value": "04ce1985069a7555f99d8aaa3e8ce4b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505107, "uuid": "24db9334-53ce-4ee0-b797-9ad0a0e214e9", "comment": "Malware payload (RemcosRAT)", "value": "5ce84e35cdb6590c162cd421a8a281385bc9195fb4ce3e2e589280ca8903d3b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505107, "uuid": "5b6c6766-dad8-49b3-a2fa-93449232de3d", "comment": "Malware payload (RemcosRAT)", "value": "56408f6cb5358a97491db1e603dec7978b0a5d16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505107, "uuid": "97447e70-9d5c-4534-851a-155eb9484710", "comment": "Malware payload (RemcosRAT)", "value": "54e860e0856ca41968c5a3e9875447e1d6d269c3a1c5fd8e84cfbcba397518030b9c97b23569e32bbcd7a5b8c56ecf50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505107, "uuid": "524815be-c70e-4b7a-a427-87a519a2dd32", "value": "T17FD46C11FAD3547BF26A6F788F9666ACF82A3E911A39D1CA3D971C0C2F745C010277A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505107, "uuid": "ba9111c1-7ad1-4965-aab6-371456cf5254", "value": "b22795c7c5933bf88ce6268fbff58dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505107, "uuid": "87d2ae9e-ff06-4588-b23f-e8d76309b48a", "value": "12288:ddKKG7bKBAsmMmkTPO+1xbeinq25zff/m/nPsilqj5:dLyshiWzxEgzff/6nJm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630505107, "uuid": "4043dbb4-870c-49e2-8c31-da42a3bd3909", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630505107, "uuid": "32630515-1c6d-4d68-804c-efc2412df977", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505107, "uuid": "192905df-031d-42c6-8e86-cbd0dfe77e22", "value": "Nouvel Ordre - p31010_20200401_14_31,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f03c4f-0b47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630516081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516081, "uuid": "e3156dde-7436-47f4-9be9-d1061706c5af", "comment": "Malware payload (Gafgyt)", "value": "a761111d20fee2e0d1164bfd68c35f67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516081, "uuid": "48cef003-4265-429a-9936-2ed07a20473c", "comment": "Malware payload (Gafgyt)", "value": "5cf86bf8ed301d1e1268a7e84ecaa721b65e0eb38432074a49a7176bc2c285e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516081, "uuid": "b03dc2f7-bf63-42f2-ac27-017c576c048c", "comment": "Malware payload (Gafgyt)", "value": "81421f1ba16c72efc076d2224c59fede59f94336", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516081, "uuid": "b19e3387-764c-44d4-ac2f-fb9d41f10706", "comment": "Malware payload (Gafgyt)", "value": "4018d3159a73485932d505973197cbab876a831ff333c3ed53419e2985f4ea91955f6f5ef680487e32a55b13d621b420", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516081, "uuid": "4be396f6-a080-4283-a58c-553f09ae1f67", "value": "T16BE3E709FC04977BC2D367FBEB9A438E37361AA967DB33155A384DB12BC17982E25410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516081, "uuid": "ef36dae1-7a8e-46db-aa4d-33f7b4791b88", "value": "3072:dEjY/zgnkElj/wh/I5hU7pe/hl2GZ/0KRbm8KqQYbLcG7j43O:dXEnkElj/UQ5hUQhl2C1Rbm8KqQYbLPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516081, "uuid": "a1493e86-f30f-42dc-a49b-dcada3be915a", "value": 155140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516081, "uuid": "69f111c1-2fbd-4e14-834e-d77bcc959869", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516081, "uuid": "31b0f1e8-3392-4bfe-8b3e-621e8936bfd5", "value": "a761111d20fee2e0d1164bfd68c35f67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da656793-0b2e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630505640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505640, "uuid": "c0fe06ac-e563-4e0d-92a0-926a3d75572a", "comment": "Malware payload (Buran)", "value": "4ea74aa9632222bf537ceef823709c52", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505640, "uuid": "b04af4f4-a558-4139-9392-32792cd4e24e", "comment": "Malware payload (Buran)", "value": "5f8658abd490fdbcb8b9ee9a6b6544092b79c5ffff720ec066791287095b5b69", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505640, "uuid": "d9dd3c58-8539-421f-b729-6441268b8294", "comment": "Malware payload (Buran)", "value": "fbf07c2ed35b3fd1d142a79099e58cfe7414b988", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505640, "uuid": "8d90acdc-d4ae-4e2a-9f4c-bf814bc804f3", "comment": "Malware payload (Buran)", "value": "c37f6e8ea99d7eb957fa67caf0bc6fb45f2bc8d3e37402e009a242033b5f343683f079fca4c8ab327806ede504293d9d", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505640, "uuid": "1cdc11a5-218f-4d36-9e40-e50c34b22538", "value": "T123A4BF60EB4421961EC3639BED5311D2EA7DD00193402168D99E936C6B479ECC3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505640, "uuid": "e4c01a0b-658c-4ab8-8d9c-a181c7a5fd67", "value": "12288:hbQolWt8/cBiLFc06Si2gJ4Xt8DrdUB77k6I0:hbQoYWcEFdgyX2iBVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630505640, "uuid": "5e6564bf-aebf-4254-8c66-059a4f483f3a", "value": 455599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630505640, "uuid": "d6d44c00-ba41-4e04-b0f9-8ab1d28295f6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505640, "uuid": "6272ece1-24b9-4ca9-bd69-6f62cbac92ce", "value": "389.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c87397-0ac2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1630459008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459008, "uuid": "84ec8262-a87c-430d-888f-e9c6508d26e2", "comment": "Malware payload (OskiStealer)", "value": "2269f021d855a0d6a65e7167962a23b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459008, "uuid": "63e3b23b-d3b7-4d87-8f23-264ee6069eef", "comment": "Malware payload (OskiStealer)", "value": "5ffe71b977866248e55612e20cea0bf3ad51a50896443d791081f58b49cdc5df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459008, "uuid": "1e0c124d-a067-4809-b5de-cba955c66beb", "comment": "Malware payload (OskiStealer)", "value": "658e9df44920828b6bf73aad814f885efbb63cef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459008, "uuid": "ffe1792e-c7fe-4d68-9767-163d94c32598", "comment": "Malware payload (OskiStealer)", "value": "fca41ac3a376757db30982b26bc2a8582ece2b5c7c0857405f99720040c3fda3bc2fbf0d7b77394501f14d53fe29493f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459008, "uuid": "1fb3057d-a4bc-49f5-9e96-23dccaa64a5c", "value": "T1A7B4D0997740B1EFC52BCD7689A81C24A661B47B930FE347985316AC9D0E6ABCF110F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459008, "uuid": "2c2a773a-1bf0-40d4-80fa-ec31a0dce9fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459008, "uuid": "4c331561-de14-46c4-ab56-00a8f1f7d6dd", "value": "12288:tQjmz9MLzFgBMXViyUGQn7K+AdbNMFgxyj/9n37oNo8PTjZ9s:tR9Md2kQ7xABxypI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630459008, "uuid": "4087a798-f320-434d-85d9-3dd923fb4f3f", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630459008, "uuid": "310a797a-08ab-443e-a87c-a98ec781ad50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459008, "uuid": "0e4b4f4c-08ef-4fc1-91cf-e510f7c4aa4e", "value": "MT100098764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a1ba92-0ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hancitor)", "timestamp": 1630471915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471915, "uuid": "65b61207-81ab-4171-8866-f0e9a448512a", "comment": "Malware payload (Hancitor)", "value": "4302bf2881c2ede737ae438fb4427f01", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471915, "uuid": "d87049ce-4d2e-4210-ad07-6bc0a0730ac9", "comment": "Malware payload (Hancitor)", "value": "643aac263025e8b90c9458a56508d49624e504c0dbf20bdc06f7630cf89d9035", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471915, "uuid": "34394dd5-22db-4e99-8937-523a9c237e4d", "comment": "Malware payload (Hancitor)", "value": "a24199b5c55e2b8c35186d9d6189f36d15540bae", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471915, "uuid": "47055ce8-00b7-4851-80c5-eb7fa3700f45", "comment": "Malware payload (Hancitor)", "value": "946dde5db6fbc929739ef5a8816813ba142c0f845194a2235dc769e34de77029df59e0d38484e0e1176120d08b2680de", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471915, "uuid": "e635f39b-1519-410f-b5da-e78a5dc1c630", "value": "T1FA94E007FA15CE57E18AC7787FA2EAA92B69FC048E08B3C731653B1E6F752508C03615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471915, "uuid": "c1a3ac94-e66d-42fc-8b3a-2ab024b1768c", "value": "12288:ZV9iQsDr8NqClDfKTFi1w06/vbOes1AOrk4U:ZVXkr8NTNfKB30AOesoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630471915, "uuid": "7d5c1dd0-5695-496a-bda7-502be1f21298", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630471915, "uuid": "b97f9da1-5329-4e95-a915-0334a1c7a590", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471915, "uuid": "851adc77-401b-444b-bacd-d31711feb643", "value": "0831_7344750125.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db57e21b-0b05-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630488032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488032, "uuid": "cf7aa77e-ffda-4e50-b319-1c3300540299", "comment": "Malware payload (Formbook)", "value": "3e8d4e3c6a76baa15bd50d4de32ac0f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488032, "uuid": "dd33576f-f79c-4367-bb56-b84a863ee5e0", "comment": "Malware payload (Formbook)", "value": "647c043687621e012ac9c04a69fe8590198d8e8e369431723dc848436438939a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488032, "uuid": "e26c3ad9-3f37-4782-ba5c-d3e13295fad4", "comment": "Malware payload (Formbook)", "value": "e5d70ed0cdbd9041560b56e473277fd471a6a9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488032, "uuid": "6add1a81-8e05-48f9-b319-9bcf896872a3", "comment": "Malware payload (Formbook)", "value": "3967bb3991c8a1b7f74db0ddf888c83b260e4c7e771748f99dd4742510e9a65bf978b81515aa06add01844652a48df7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488032, "uuid": "46fddc26-ad32-4648-a46b-0e0721d06b23", "value": "T16FE4F1C6BFB05C56DE04D63DC26E9F1618272F349AE5A24AD141B873ABF36CD1C13922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488032, "uuid": "4b7cf6e2-bbe7-44ea-b617-f9903051cf4e", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488032, "uuid": "116bf33d-8e9c-4fe5-b82e-694b68a2decb", "value": "12288:DXe9PPlowWX0t6mOQwg1Qd15CcYk0We1OTmeeKAmdcNtnfRUCZFs+TVx3:qhloDX0XOf4BeezmdcNUC1TH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630488032, "uuid": "101de2ab-6a9e-4ea3-9119-71ebcadb50c7", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630488032, "uuid": "5f1a89f7-c53f-49e8-8b2d-403197a83098", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488032, "uuid": "84083a8f-84e6-4d39-b5e3-4486d708b3d8", "value": "RFQ_PO_009890_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ad38a4-0b1e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630498627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498627, "uuid": "98da8771-04e0-4a44-875a-b2a840109928", "comment": "Malware payload (Formbook)", "value": "531ac1b15a6c9fa4b119c7686637ddb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498627, "uuid": "55d58ce5-5687-41de-b627-aaba1766fb98", "comment": "Malware payload (Formbook)", "value": "64c961fa1b24bad0cedc4e69c95177414154a6f4ec05b4028169ff30b5a25234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498627, "uuid": "9ceadecb-3b06-4f19-9c90-0ce37ea5d44d", "comment": "Malware payload (Formbook)", "value": "542ac3c677f8de2710bbb884d095cb712db14870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630498627, "uuid": "21af3456-eda9-42dc-9676-df6381a5215c", "comment": "Malware payload (Formbook)", "value": "55296a801b77b1a4645896c5b467a14486bc0b3bc1f510847c5e015735680cbd0ad2d1d5c5564e34d342c3ce33e04893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630498627, "uuid": "b9ed2eb5-7a8a-44fb-8c22-f34bf3028f72", "value": "T16195E122F2D1947FC1335A3D8C5B6B649939BE512E29790B3BE61E4C4F3D2826D112E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630498627, "uuid": "9343ba4b-59df-4fc3-bbe1-9678f391ee8f", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630498627, "uuid": "039e1efb-a1a3-417f-84b8-c9bf9ddef02c", "value": "49152:ZnsHyjtk2MYC5GDjkj2x27KXN0mAkvu2COKv7lbn:Znsmtk2aSrz1AH2CO471", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630498627, "uuid": "eb0dcc02-8ced-4a86-880c-59c69e3d74a7", "value": 1887232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630498627, "uuid": "be64c08d-ce1f-421e-9b66-035609be7c16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630498627, "uuid": "d6491c29-8b71-4753-8098-de9cf9619f38", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95d1ba0-0b67-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630530066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530066, "uuid": "68bc3299-eecb-44e8-8a7c-2e6dfd2c0e34", "comment": "Malware payload (RaccoonStealer)", "value": "478599f5b86f0509fc245ac3dddc7aa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530066, "uuid": "267484c1-9555-42b5-b34e-bca957eba449", "comment": "Malware payload (RaccoonStealer)", "value": "653415abb991ccf45f4294f374bf2c499e3d9311342f9052763d096834765631", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530066, "uuid": "980de681-4c47-4c46-918a-bb77d3f847fa", "comment": "Malware payload (RaccoonStealer)", "value": "41df13858b87fdc1fa8a20fce23f31227e8b5e51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530066, "uuid": "412d5a8d-eb55-4750-acd9-05b9585a35a0", "comment": "Malware payload (RaccoonStealer)", "value": "8b81fbdc582ca239a9b14f1d9a62c39df17b55836b7b673d192e13293e38569597415290e59cbd485ff2cdfea5cf56b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530066, "uuid": "2fa8ace7-351d-4984-b443-7764cb6f53a9", "value": "T140A402AFB791D833D59246325539D3B05A3A7D6E6804C44BBB883F1F0DF2281AF6135A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530066, "uuid": "00a57f15-dc6a-49e8-8482-ed851729ceb8", "value": "2bb955c2e0013cafc5696a8a4b50b66d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530066, "uuid": "adf56f17-ef32-4553-824b-74be659ad419", "value": "12288:7VUQCcj7rBhR1TfjCoMv7JHkIp2JV7D632Z7:B8ogiO2D2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630530066, "uuid": "9a6f40c4-e52e-4ca0-9bc9-7580363326cc", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630530066, "uuid": "3cbe08de-876a-496c-847b-9b551d9810a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530066, "uuid": "d38f5fcb-e0a7-4e07-82a7-fec8a825b69c", "value": "478599f5b86f0509fc245ac3dddc7aa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd74859-0b67-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630530123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530123, "uuid": "19b5b2ed-df26-4254-b7b5-48c56fa45e73", "comment": "Malware payload", "value": "8da45d080c5badcb930d40689d1bb649", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530123, "uuid": "1218da98-2d45-4076-977d-36a05610a577", "comment": "Malware payload", "value": "669165e16acc40cdef5bd840101c41b2b58f531fcc3bc5169a3ce1bf932a8cab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530123, "uuid": "9113e489-b75b-4e89-9915-4a03bcf8eae6", "comment": "Malware payload", "value": "de38ee52f48b54e345e50b537291b24aef7bdc51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630530123, "uuid": "2cbd614e-5273-49fd-89dc-bae31723f499", "comment": "Malware payload", "value": "8a6e21bb083771d45eb6a80e150c4e713a2009ed3d5227cd72c2d7cc266074f4397111e4a45e09501c8ebdc8bcdde78f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530123, "uuid": "79533715-5e4f-422a-a26b-d59d96dae275", "value": "T13C4523127FD84933E1F50A325E360E0B1477F5350222D71BC7A4BA8EB97A843DB59A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530123, "uuid": "4d782b05-47eb-4915-a67d-d0e076431e7a", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530123, "uuid": "736b8bf2-c339-4334-a15b-fba617931c02", "value": "24576:zLgwC1ZutjczmoqCM5ZrI9BwPXYFd+jluILz+nVUcgMNrmbXmPPz4lb:PPC1Za6qCMPrI9igv+BuILzcVRgMgbXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630530123, "uuid": "12406e2e-cf1c-4bb9-ae29-ca4dde17ee71", "value": 1183976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630530123, "uuid": "45111539-d71e-4b08-a2a4-7afc89b772f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630530123, "uuid": "cedde5e8-c0c9-4b94-92f6-f841beb53e14", "value": "8da45d080c5badcb930d40689d1bb649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5776428-0b47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630516342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516342, "uuid": "4ca74f72-0e9d-42de-876d-fb35327c5163", "comment": "Malware payload (Gafgyt)", "value": "a07c564bfe1b5c9dc318a642e8cfe81d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516342, "uuid": "6152e602-48bd-48aa-bebc-6a946e5880e9", "comment": "Malware payload (Gafgyt)", "value": "66f015893c2ba49501e202b27afd0c421ce689c65af83ea14f645063c3e11ebe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516342, "uuid": "4e6471ea-30e6-4661-9bab-6ea7a4f10c03", "comment": "Malware payload (Gafgyt)", "value": "5291a190bf81948ddeb4c747ec1b9c35b02daed6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516342, "uuid": "98b28c22-0152-484f-8b34-ab867d279666", "comment": "Malware payload (Gafgyt)", "value": "186bc21fc656dc9f3a4b77bcdc265b7e310861db1f57f281e70b00d880e1fed2f1c3f904119f0fc54490982240712f69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516342, "uuid": "35a0f3c5-c974-48f6-b838-995e08553603", "value": "T101F3E605FC04A77BC2D367BBEB9A03CD37361AA967DB33159A345DB02BC17942A39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516342, "uuid": "92308963-a98e-498e-94d8-4cfd5d421616", "value": "3072:xjYlzgnYmF2/drWyn5hUqpe/l2tQ3Qz6m5trQMbLfW0juHO:mCnYmF2/dvn5hU7l2W86m5trQMbLO0jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516342, "uuid": "f8b10dbb-6242-4e92-95ed-497042a9308f", "value": 161718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516342, "uuid": "b3d7fb5b-2594-4ac4-8bc5-1e22479a8b8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516342, "uuid": "5faa0c7b-3e4c-4b81-a81d-c41a0b050aa4", "value": "a07c564bfe1b5c9dc318a642e8cfe81d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b12b94b-0b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630504540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504540, "uuid": "8bbde1f4-af7b-4866-b420-92492e810b28", "comment": "Malware payload (Formbook)", "value": "583d21008e654e5b6f4860adf74118c6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504540, "uuid": "01c88496-e567-4fd4-8c18-e348cc5d7f0d", "comment": "Malware payload (Formbook)", "value": "66f892880b4dd1f186df198c4e3fd45d87053628a544db9e24b57b89c40e1d3a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504540, "uuid": "dc614c7b-0e32-4221-ad71-84758c68fbd0", "comment": "Malware payload (Formbook)", "value": "387256acf4c3f16cd2f321bc54417b727623b433", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504540, "uuid": "340c083d-8187-4a34-8f36-32ea770a33c5", "comment": "Malware payload (Formbook)", "value": "640502eda5e7d6a1c1b91f0a4edac5ebf9eee7ff58db7386001895275aa461e13f514c50b9f613b500616d43698038b9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504540, "uuid": "f8b1d349-70e9-4ff6-94b5-dd5ccd34d1e8", "value": "T19B92516CC48B0298CF859B782B1F6F49015C7A5EF784E672727CA37527E6C3A440697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504540, "uuid": "88827b2b-1377-4903-9e2f-e4c8cc2d54c3", "value": "192:pjK1kclp5ScjX4g3LX5n8wvRiYJE1lOtID1HZb3Lkm+y9pYd4/x1+Ov:pxE7bXh8wvRih1lwq/bN+yfxEOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504540, "uuid": "d1f4e6c1-038b-48c9-bd0f-9e20c68ad998", "value": 19651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504540, "uuid": "12776ae7-f8cd-4fe1-bc2f-f6a489b0bfb8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504540, "uuid": "17d889c7-cfeb-491f-9c0d-816c9456e2e7", "value": "RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f9fa6b-0b04-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Osiris)", "timestamp": 1630487600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487600, "uuid": "6c5ebfd6-fef2-432f-b7ef-f5316988dc49", "comment": "Malware payload (Osiris)", "value": "63335742301b2a2119f78653baa74637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false }, { "name": "SANTIN SP Z O O", "colour": "#592436", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487600, "uuid": "2b89c66f-9b8f-4293-b661-15970d27b84f", "comment": "Malware payload (Osiris)", "value": "682b4509a0389207b6af79873f0b2c8b238b87ceacca3f44d2afe4f494dfe6e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false }, { "name": "SANTIN SP Z O O", "colour": "#592436", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487600, "uuid": "97823fd2-30db-47f1-b902-8b54911fff08", "comment": "Malware payload (Osiris)", "value": "560003b2d84c658eda8869e78a4426f5823e6cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false }, { "name": "SANTIN SP Z O O", "colour": "#592436", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487600, "uuid": "280073ae-e28c-4674-acfb-6b860b53dbe5", "comment": "Malware payload (Osiris)", "value": "a1d9088f0361b39d900e173af494bc7ccbd4c5e70e8a4a97c10d87c10cb1f9dbe00fed92e8d7910be707415172311a81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false }, { "name": "SANTIN SP Z O O", "colour": "#592436", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630487600, "uuid": "371b8dc7-55c5-44b9-b43c-07e52cf54967", "value": "T1EB74AE20B982D432D4A361308AF6E77B197CEC2507E14BEF93880FE54FB95C15A71B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630487600, "uuid": "49047749-3993-47ae-a021-62bd72fb091b", "value": "fdccb32d26b9f784e0cd742d927ca28f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630487600, "uuid": "25fe1f66-a04c-414e-b35c-3659dc9031f9", "value": "6144:acXR47kId5Wzm3PqAJ2g5YTp65H0K30PkkiqtESqOH0cI4ra3/fphr5kfnGYAO2D:acXR47kId5Wzm3PqAJ2g5YTp65UQlZpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630487600, "uuid": "85294011-5033-495f-9b29-fcfd0f257f9e", "value": 338840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630487600, "uuid": "8102ff21-3f3a-4f2a-afc7-2dd414e2e31f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630487600, "uuid": "0d468647-0661-4e23-9eda-8298d6974319", "value": "duck.lol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e53533-0b35-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630508286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508286, "uuid": "32aa1436-c5ac-4bff-80b2-9c9bab818786", "comment": "Malware payload (AgentTesla)", "value": "47c20adcb5dcc7092dacf8029ab988cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508286, "uuid": "ec60a405-c630-4fc2-8087-589d8cd9bad1", "comment": "Malware payload (AgentTesla)", "value": "68502a80bec0322e11e38a6e52cda66a56d649c386fa37dd8ee6729539c519ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508286, "uuid": "9f9c4a08-f9a6-40af-bc0b-9ede34f42a1e", "comment": "Malware payload (AgentTesla)", "value": "9607bcae3f0f35c0bb619eaa5b272e4a00f8f1f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508286, "uuid": "f7c3068f-e07c-4079-9fe4-480f30493c97", "comment": "Malware payload (AgentTesla)", "value": "84f9700f0f6e2816260b552b7557d24e095fa9763382d304924a8572f6b18c19d6b906da2b2496ac06dc16d99a07c927", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508286, "uuid": "9e0cbda8-abd1-4c8e-b33c-934b80208af6", "value": "T11E452DF5FE643ED80E5DB7C4123D3BE938199A47A904E10A7EE506A07436CB63FB5092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508286, "uuid": "848bd747-3365-4858-b8d1-b6c7617fe11a", "value": "12288:ZnostagrquJkTp8Xa8QeVIqI3EpmZxGEfyBp2SuMp+qTe2YSLDsr:hEo8843s0/6D3uM4q9Y2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630508286, "uuid": "26f5b224-b84a-441f-bad3-b46c3942dd38", "value": 1252551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630508286, "uuid": "5e03c0da-01f6-4960-b276-6bb9b2cd2fe7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508286, "uuid": "35188607-c089-4b77-81e9-6f466700f05d", "value": "OUR NEW ORDER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7720f56a-0b60-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630526948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630526948, "uuid": "67e2ab3e-0993-4164-ab27-1fb5d9636fa5", "comment": "Malware payload (Glupteba)", "value": "bf9449b1015153fe62837aad93d2eba8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630526948, "uuid": "7e874d82-1e70-4aef-b046-0a4072e0f95d", "comment": "Malware payload (Glupteba)", "value": "68d83afa2dc4272e54c4ebb1ab8981e7f00442dfe6e66c8b7299c30a230be997", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630526948, "uuid": "60df237a-e801-40c0-af32-6aa4b186c536", "comment": "Malware payload (Glupteba)", "value": "e1637f3aa2d78d91ffa7409ca0823c96d2eb8941", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630526948, "uuid": "d3f8bc47-5687-4cdc-8c00-8470541e15e9", "comment": "Malware payload (Glupteba)", "value": "a22edaa67e2aac79d7b16674de7691bbb9d8a93b6144bb0b24f2daac86c2983e536550bded113103fae535c537dda12f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630526948, "uuid": "c7f7699d-efaf-4417-b6a3-4d5ca651cdf8", "value": "T1C326332F2791D0B7D8DC073449C54FF996667E599C04E81B2F811B6EEAA93A2C706333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630526948, "uuid": "9de9e4f5-198c-4cad-8b75-19324b199368", "value": "2617ed69d5fa8c0972283727d551e89d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630526948, "uuid": "7b52451e-ce9c-484c-b3be-0315bdff550d", "value": "98304:hv1Ien0lEuPLzWdMA0ZHlBWxO9ujyb1U6h3Q:34kMAYl8xO9cwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630526948, "uuid": "23d311f1-c4d7-48a6-9327-a2b0958590b8", "value": 4628008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630526948, "uuid": "47cff601-76a4-4594-818b-713af7467d37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630526948, "uuid": "ea2f83ae-b15a-4ec9-a561-89c77b63b1e9", "value": "bf9449b1015153fe62837aad93d2eba8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab69fb16-0b3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630511144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511144, "uuid": "f42aad0a-55d8-457d-876d-d5dcc5844595", "comment": "Malware payload", "value": "3dc99168e6c3f1b7ba51cb69acd13cd1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511144, "uuid": "ee4e8240-debc-4133-8a67-33896061aee5", "comment": "Malware payload", "value": "69c3aa9651a8fbff9bb671965c487748da86334da51a2136b2d8cd23716c5177", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511144, "uuid": "3502b568-5cee-4bdf-a99a-15e3a2e001bc", "comment": "Malware payload", "value": "67037357c9a86a30c47cd41b375a02f43ec98ca5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511144, "uuid": "a53b98cd-6fa3-4e12-963c-fd437cd392ab", "comment": "Malware payload", "value": "7e31159fd2d60474ca01e55e783fa4d63d1e9f2c5f138083031d5a3a6a3f2adf9bdcaad053ffbad1aed56005235d8194", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511144, "uuid": "2046a95c-32dd-497b-b6e9-2a757aa07b33", "value": "T1D8763337B3810E92DDA80972D8A3817013D2EE97A2F5E6063FC476C65E617A44F1F798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511144, "uuid": "2e1b6c22-853d-44fe-8f87-95753bea5f61", "value": "196608:8YfDUnzxlAemrwFa2khlJKi2dXCtvJ4szPeV0W3cLC+T:8+DAzxlAe4wX0LX2dX6OsM3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630511144, "uuid": "e838616c-51d1-4f31-8fd9-770525d37855", "value": 7336448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630511144, "uuid": "64eb4b9f-1b66-42cf-bfae-f8ea3e3c09c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511144, "uuid": "5f174fd9-6676-4c49-8324-fb07a67e88d7", "value": "3dc99168e6c3f1b7ba51cb69acd13cd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa292887-0ae9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FormBook)", "timestamp": 1630476058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476058, "uuid": "ade846b6-4dd0-4f68-8661-04693e6437ff", "comment": "Malware payload (FormBook)", "value": "c02ba91105fee870115536efe9712ff0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476058, "uuid": "9fa63da7-f70a-4d83-b1ba-56759f767693", "comment": "Malware payload (FormBook)", "value": "6a5f7110b50de0f86b58913bf9de60cad623bbc16b7ae4208ab0d583f6066322", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476058, "uuid": "6034e283-7e19-4202-b85c-cc5c86c521b9", "comment": "Malware payload (FormBook)", "value": "da279b3ee3e4dce79e50ef2bfa6c0c9b3ed79c68", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476058, "uuid": "1c4ae76a-7a11-45cf-9b9a-ee72574f8150", "comment": "Malware payload (FormBook)", "value": "c6db5d7dd982e729976d0d045ec9a58b1728474f75f706207e0dd3aaf1b2399cd6fa4bb73d2dc0d5c621e7e4b8ba9160", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476058, "uuid": "a2c135cf-b6f8-4185-8171-3915e4bc135c", "value": "T132D4F2B637A02AD3F5168532D768D0788F10DD4F178250BD86E4BD36F0391AE289A5EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476058, "uuid": "b3d901b7-30f9-4c3c-8a74-c9790eef5b5a", "value": "12288:KXv+gIgWPYBMLOsyXIIFDUKSdNPhIYUv/coPChvFq90D:Kf2YBMLB06KSLhIt8fhvi0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476058, "uuid": "aeff693e-c404-460e-a135-5840bc94bb73", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476058, "uuid": "9e19e048-da8c-4cd6-9e7b-c0f7e73a1893", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476058, "uuid": "53ff3bac-a01c-41aa-9fb9-9a5bce6fcc13", "value": "31-8-21-PO-20210722064631568.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cdb5da-0b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630504449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504449, "uuid": "ecc34549-c77e-45ce-a715-0141b406d852", "comment": "Malware payload (Formbook)", "value": "df7c3db234fc1133486a64b284925889", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504449, "uuid": "7f888303-74bc-42ca-96a2-69b8b489c9b8", "comment": "Malware payload (Formbook)", "value": "6aef004bb95e4d3f362493cb06a6cbddd1b60bbf1b276865804bf55b90c47e24", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504449, "uuid": "e3920a9f-2371-4bce-8959-b3454dcb39f0", "comment": "Malware payload (Formbook)", "value": "0e54afa75062a29e4ecfe880d1fb841d188808c7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504449, "uuid": "8fc375c1-ef75-49ff-9ccd-3348b3a7b4d1", "comment": "Malware payload (Formbook)", "value": "a615fce24fef3d489de54ddbf29b8d314594bc9abffe7197f55f6756a0ca64b6955bbd2edf873c61be5589f7976fe703", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504449, "uuid": "80ecec21-4ef2-4b52-8446-456babf131c6", "value": "T1BBB271ACD49B05888F856BB86B2BAE05118C762DF789A533353C933927E5D7F901393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504449, "uuid": "fcb2efb7-ed9e-41c8-a3fe-b01e892066cf", "value": "384:5qHAZ/h7cbIW0rmj65TCiEDRWv8oPvZjtNHyzPkwEZaVlSvqGR8:n/HWSwiesvp32YanSvqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504449, "uuid": "cc12a59b-bd6a-470b-80ec-75cc1f2ff2a1", "value": 25021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504449, "uuid": "d5eed7ad-f0fb-49db-8d8c-d2df1eb20923", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504449, "uuid": "76842cde-bd2c-46ea-961e-372ef6b059fc", "value": "Payment Copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a337281-0afc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630483842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483842, "uuid": "b4437744-1a78-4840-a214-192254bc559e", "comment": "Malware payload (RedLineStealer)", "value": "1b3fbac9759e661c448577ac79872fe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483842, "uuid": "a44b7654-2805-4332-ace5-a42c27b86066", "comment": "Malware payload (RedLineStealer)", "value": "6c72d759129b828faa7ec1928b87e3f7b4379980eebd79ca3d0b3ed721198266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483842, "uuid": "aa19962e-80f7-471a-93ba-25626d9dd083", "comment": "Malware payload (RedLineStealer)", "value": "199266bab6a93ab0ab864409e23f19a27c563afb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483842, "uuid": "b1a27b10-39fe-4a9e-acc8-0fa270f1e1ff", "comment": "Malware payload (RedLineStealer)", "value": "a998b21bc0d1c67861e02986d4cd5450c858761b6d5309802352b2503c8dfe4a4cc90f2d30379b6c2f412830fa440f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483842, "uuid": "ed1b835d-d542-44fd-a138-04d31489f410", "value": "T181773303FC96B0F5E5662E368580AEC96E3EFD481710C47BCB44868EE7B15A2FE24547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483842, "uuid": "76f0a144-b303-4448-967a-1d19544ba8ca", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483842, "uuid": "88f2ef18-b8f7-4648-a614-d0aebc197bb9", "value": "786432:uuj8ORscAeAFd7mtoPb6+BkE8JO8NUEQkovKxozFgI+H5NET:hacad7kX/0hyRxo2I+Zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630483842, "uuid": "193b5ac6-558a-4692-8bcb-6968a3d9a7c1", "value": 35379012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630483842, "uuid": "f0dcbe22-0d66-4b01-8ef6-7a909bea84cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483842, "uuid": "8378bdef-e564-4f6c-9b65-f372984fad7c", "value": "1B3FBAC9759E661C448577AC79872FE8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b9ce45-0ac7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630461102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630461102, "uuid": "89343269-e4a9-41b1-a2c7-48f001ef4d52", "comment": "Malware payload (AgentTesla)", "value": "42ce135697b9b138c99d1bb9a298a412", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630461102, "uuid": "1cc98e3d-2d1f-4c18-8c54-f38b69f6cd98", "comment": "Malware payload (AgentTesla)", "value": "6ce6f3e5ed0decba840832247a7ce597eb367c8448ea16f82141781feddaf4be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630461102, "uuid": "c5a60d55-8f4b-462f-8e4d-78823e713857", "comment": "Malware payload (AgentTesla)", "value": "5ffa8f1e7888f4fdec00c0338bf0cb6671d23b12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630461102, "uuid": "09b44d1b-f9a5-43a7-88c8-a77696ccf399", "comment": "Malware payload (AgentTesla)", "value": "7df4ed34c6e4800f7eb9705576d4c10ed9c44ee9f0502eab48f5bb123c1a3cd6145ba39e4d859e5a284edcd3238cbd2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630461102, "uuid": "0b5aed58-3ba0-4b4b-ab86-9a1424bd1ea0", "value": "T1C3B4D0987354B59FC527C976C9A42C24AB31B47A430BE603A51315EDAE0EA9BCF160F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630461102, "uuid": "d356e6ee-a773-424b-a667-812018e9ec1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630461102, "uuid": "d9bb9ebe-6f9f-4522-8915-e3c166f817d6", "value": "12288:JTk9i6ZzWspKa6nchk4yr7IFJ9AH9aHzNbFiZER/3txbLp:JY9gMKVchktMP9maztFOEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630461102, "uuid": "52e58018-906f-43ab-aaa9-9058fdcbbd4b", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630461102, "uuid": "67c0d605-2ea5-4301-8b6f-c235bc050259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630461102, "uuid": "e4a595e0-ec7a-4e48-baf7-bc847e32cef2", "value": "CZAPMT_COMPLETE_210616132402545_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a720586-0b24-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630501211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501211, "uuid": "be47d27e-afe5-4b52-91d9-9df1a5691ae1", "comment": "Malware payload", "value": "4c14ef778be2141dfd8c43158546a1db", "object_relation": "md5", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "malicious-LNK", "colour": "#903FAF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501211, "uuid": "a7945b2f-b79d-4d82-9c55-6378a40dbc93", "comment": "Malware payload", "value": "6d97a4130da6078f418edc94f45f13a21fbde4b87c75c05c102efb207c1e0f3c", "object_relation": "sha256", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "malicious-LNK", "colour": "#903FAF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501211, "uuid": "de11e9a7-5226-4915-ba30-f86afb752741", "comment": "Malware payload", "value": "08bc70ca9b0e68df8278b5f5f315046ea521251e", "object_relation": "sha1", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "malicious-LNK", "colour": "#903FAF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501211, "uuid": "4f5f0ee6-f180-4fbf-8ae8-67fdf8aec76a", "comment": "Malware payload", "value": "cf55cb689fc32e708def5519d9a5a180a78c8a5c25cd8ff18373b16e2394caccd3e630b875a419a73a862ff3ea070182", "object_relation": "sha3-384", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "malicious-LNK", "colour": "#903FAF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501211, "uuid": "6187cd20-c6fa-4647-8f98-9baefa204036", "value": "T1B8C2E157C885AFAD7AF0365A91EA31736196F489F14D8CA76C3364F29040F2DF887136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501211, "uuid": "e7481d6d-6e97-47ff-9467-79759c956440", "value": "768:bkNTAP6nvvLtnP7KAjYmz2KNEdji3gQ9k:bSTHnvvLtnP79NzISgQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630501211, "uuid": "9a25aa7a-c1bd-4048-8675-0450f2a7e1e3", "value": 26955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630501211, "uuid": "9ad40b92-c406-4e75-8343-285e3e25aa55", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501211, "uuid": "0568ed6c-e3db-4246-8e5f-7d7355334724", "value": "Trabal S. De R.L. de C.V. ( Solicitar cotizacion ). jpg.arj.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25b250c-0b79-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1630537865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537865, "uuid": "5104b914-02c1-452a-9e50-d55e0346c1bf", "comment": "Malware payload (Adware.FileTour)", "value": "25f9b6f64d4c687c6f5c5003a1ce815c", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537865, "uuid": "c56083b3-c173-48c6-b735-796cfcc76f22", "comment": "Malware payload (Adware.FileTour)", "value": "6dd6efa0fd92ed74a70003b923b702bc16fa3c1374b737b4ede50d752a0cc58c", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537865, "uuid": "cd9838e1-2d27-4b7b-9f97-21a7ca1f7883", "comment": "Malware payload (Adware.FileTour)", "value": "76acfabdea71c81c7e79fa685b3d71a0299f6fdb", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537865, "uuid": "53456d65-1cca-4256-ae94-d78d8ddd9ade", "comment": "Malware payload (Adware.FileTour)", "value": "4c61a90cab511f1cd13302634ca61bef78efdc280ef80f8ac4d82bda465137caac3dc8e60719d4bb053b4ea4370977f9", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537865, "uuid": "d4ba0f35-0d7b-493b-9f06-36538aa51edf", "value": "T11D063340BBD58AFFE9820471BA586EF4C0FB470C43BA06C31710E49D5F68ADA757AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537865, "uuid": "3eaa8080-6adb-4a0c-b9f5-4b03bba2a5eb", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537865, "uuid": "048beb34-60f3-4ef4-b56b-44bb87b775af", "value": "98304:xgrRBJfNCQkNoUI2EK65vFXNexLmkAhScarmZnv6kyzCYdU/:xgrR/MNNg2EN59QCk2aknSkMCYdU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630537865, "uuid": "230f742d-ba21-4494-990c-cefe896047b0", "value": 3949828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630537865, "uuid": "43459a92-ee94-4b00-94f0-c7d529a7bb01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537865, "uuid": "64540478-1d8f-4b34-805e-ecfafd32db10", "value": "25F9B6F64D4C687C6F5C5003A1CE815C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8bcc8e-0af5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630480840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480840, "uuid": "40619f81-c6dd-459f-bf4a-8d96b9e7e052", "comment": "Malware payload", "value": "38573024c89691c378496da1b894044f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480840, "uuid": "ecf2c523-844a-4179-bba4-776ea1cfb936", "comment": "Malware payload", "value": "6ddfda1aea6130ba051ac71ba01ee387f7fae575fb8e7882b57879e6fa4c4e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480840, "uuid": "25f5466b-a7c1-48e8-bf81-5ad9fbf9e588", "comment": "Malware payload", "value": "2f699a761e522d671121e4fda3d256b13b78e8cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480840, "uuid": "37dfc373-360c-4159-93e0-08abdb60b85b", "comment": "Malware payload", "value": "c6e038a5cdda918fbb1684bf9fdd7cab559f7f4d8ff4da70ebd3998fbe05d82a411ce1e5a89b70eadecbb1a34817189d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480840, "uuid": "c8888336-bfab-419b-98ad-9368517ed9fa", "value": "T1F355AA39AD35DE27D37981AB84863D0AAD5C0CCB623B7E9F4192B388283651375F671C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480840, "uuid": "8214b1cb-1d75-4584-a5bb-9895581b656e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480840, "uuid": "345217b1-c191-4ddc-a7f0-fa615a3d25df", "value": "12288:lZ7HbK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmol:f7PWXW33zmNnfSsbciszKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630480840, "uuid": "db6117e9-4291-440d-9ad5-f4c77166ed13", "value": 1307648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630480840, "uuid": "d0f47080-c8ee-4df8-9f7f-c1efac1036a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480840, "uuid": "79152058-acc7-41c1-8191-8b742a3fc252", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecff9d4f-0ae9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630476036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476036, "uuid": "40d71ab6-fdfe-49ef-a3b3-e5c77301175c", "comment": "Malware payload (AgentTesla)", "value": "995fbfe3ead83db1f14d022551b1f7a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476036, "uuid": "52ac1f1d-c915-4e78-8dce-bdc9542a54cf", "comment": "Malware payload (AgentTesla)", "value": "710cfe7b2eae27d8a8af40c89f4c0163a47e2839e43dd437305ace3c2261c234", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476036, "uuid": "19de5d2e-c357-4875-89b6-af8a8c2858e6", "comment": "Malware payload (AgentTesla)", "value": "4065de6871608108f5a28247713aa162cbb4c04f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476036, "uuid": "651ee59b-9c0d-4d78-8fa4-b671556b3beb", "comment": "Malware payload (AgentTesla)", "value": "292f8baf78e1e7519673dadc96e639d610663df5f17794b28ee21eed7c36bbbfe5182303d88c98fa5fad7c41d1380669", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476036, "uuid": "e39717e6-61ea-4996-9c6d-d1a5a92ed46c", "value": "T114D4F10E159109F6E6CEF1BED507445B7F2EFF9C8A30A08B980039099C759FB78B8665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476036, "uuid": "31608961-fc6b-4e19-9dce-563bc6458eb4", "value": "12288:41i7ak5lUS6HdyBBSfjbRG24C7U4F+WCmM82IwRjaDMJ:41Sak5CxyBBGjk24CF+WCmSIDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476036, "uuid": "e194efe1-b7ff-4a36-a57f-588a3b57fe67", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476036, "uuid": "b2fd71f3-cc3a-4fce-9178-e753d04fd074", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476036, "uuid": "4daeb588-e0b2-413a-849d-b46f230bfc48", "value": "SO2108042.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db72479-0b51-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630520517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520517, "uuid": "9ec3424e-2360-4bed-99b4-8b604c52e012", "comment": "Malware payload", "value": "0c605276ff21b5150365b7d1991f5904", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STASHLOG", "colour": "#93012C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520517, "uuid": "27cdcbce-9f0d-4a99-99a5-abc1675ca92f", "comment": "Malware payload", "value": "720610b9067c8afe857819a098a44cab24e9da5cf6a086351d01b73714afd397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STASHLOG", "colour": "#93012C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520517, "uuid": "885d0b90-efd7-4969-9a7a-1fa2f2241a9c", "comment": "Malware payload", "value": "2d336978af261e07b1ecfaf65dc903b239e287a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STASHLOG", "colour": "#93012C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520517, "uuid": "9b351de4-59ba-482b-96eb-2c79ee8136b3", "comment": "Malware payload", "value": "7410eb87027fbced1e1e1006983da97345ffcf0923a79bbd41b1ab53bf66e44816d68d258d4ed88ef546c393c5d6a9fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STASHLOG", "colour": "#93012C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520517, "uuid": "7339b036-2b6b-4cda-9cd4-140fe429f12a", "value": "T1B774BE02364088F6C0B5543C0EF9BF79C76FB8405968AACFA39C0AD94DB51E1D96939F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520517, "uuid": "b05c77ed-4402-4c1b-bbb1-6a3472ee16d4", "value": "82d6e4bf4f14c83adb28faf787bd64d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520517, "uuid": "5ef19d8f-8300-44ba-9ccb-4af44b51e4d8", "value": "6144:eDUHgB9QEtvTzMmXy1A8jxdBp16BO1ATk9irTx:aQEtvTImC1AuLMTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630520517, "uuid": "f6bcc05f-60d4-4dc2-9b83-ce9329c398b8", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630520517, "uuid": "8ef6b06e-3e2e-4a5e-af4d-fafa27814867", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520517, "uuid": "c47fa242-111e-43fc-8a17-b6a994f08042", "value": "#STASHLOG.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422060a5-0aed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630477467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477467, "uuid": "50fdf037-2089-48c1-9053-442307c57a73", "comment": "Malware payload (Formbook)", "value": "7b51d08670290644b055079e33e791f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477467, "uuid": "52cad541-288a-434a-a99e-0ba9403c02ab", "comment": "Malware payload (Formbook)", "value": "72362ee916d9697bac201fb3de3c8c736725e4c35c0cab9adb7fd5f184e9b2e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477467, "uuid": "75414ce1-7c93-42b7-9efb-4b7fe93b9037", "comment": "Malware payload (Formbook)", "value": "7166acd23ebed6ac87c2aa0cd035eec56b3b40a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477467, "uuid": "7b79006e-1bff-4fc9-bb6e-519adf9bdddb", "comment": "Malware payload (Formbook)", "value": "4e14f13c53ead4515bc63faadaf230c754301bbb53f7c77892529e2dbfba9fda8434d0a3e1f1c1ff27566952b194db55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477467, "uuid": "e5ce94e5-ec35-4c4b-baed-0a9ef5a13ad0", "value": "T1F2B4E05C765472AFC95BC97689A42C24EB60783B430BE303A45325EDAE4D69BCF160F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477467, "uuid": "f8566a22-7803-42fc-be95-36be0fe98beb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477467, "uuid": "3190d2f3-af8d-45f5-9f26-9600628923dc", "value": "12288:b4evZRUOAgGo1XsEarkXBhqbujRLXKMx+3OurLrC3KuwopLrTk:hpaEsZCSujHxWtLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630477467, "uuid": "b32f7918-651e-4630-9513-fbbfc4d0ba98", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630477467, "uuid": "d9aa5791-f969-4ec0-be73-a0af69189418", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477467, "uuid": "de595bf0-ab3e-43e9-9b24-e99c7eec43e8", "value": "swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ae537e-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482766, "uuid": "03a2f61b-82a1-4e11-b413-040c05010243", "comment": "Malware payload", "value": "c3fcf6bd70a52aa0f6d4e39e4c09babc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482766, "uuid": "460447d5-a83a-4be1-8790-6c9aaa04667b", "comment": "Malware payload", "value": "72369151d3db2db1344f78c7f0cfbf036775b9320b7a930bad9c436503bd2584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482766, "uuid": "1e6587b1-aa15-4baa-a2dd-3609209b2eae", "comment": "Malware payload", "value": "d8a82bfa5e6a33a7c2da82deec2186b1a37c234d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482766, "uuid": "740f8a98-b9b3-431b-ac25-189a89042276", "comment": "Malware payload", "value": "d116bdc538bb2afbff2806e8b42361d4f9022c1dea6152f0ef04d8b6138bae749a2726ca11996f80057ee3f2e8a3eef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482766, "uuid": "be1f269e-6167-438c-b77e-c10fb414ea16", "value": "T150D5331160C08572E8769A304DF8DB31A63A3C202F759D6FA3D8BA5D6B349C0277E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482766, "uuid": "bb557901-0d62-40b2-a0bf-280fd917278b", "value": "c127345c03c7eb109783c6cc61e16834", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482766, "uuid": "9a58bd33-3cdf-4a52-8c6b-9191eafec33f", "value": "49152:gEF719WMZPeNLSeKuXsv+bY2pYc4GaDGfEOEwq7NAS4L+DaWDvKIizTSX:pF719PZPEe1uXsvXc4XCfXqpATLpWDvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482766, "uuid": "546bace1-3387-42d0-a837-fb0d0b8c82a2", "value": 2900552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482766, "uuid": "8f781185-8332-467a-83be-2fb211f2f039", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482766, "uuid": "d05634f1-1f4c-45e0-9281-bf5e79858bf7", "value": "72369151d3db2db1344f78c7f0cfbf036775b9320b7a930bad9c436503bd2584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea20bd39-0ad7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630468300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630468300, "uuid": "3f7d4cf2-5e10-49c5-bce8-ed95d5911ce5", "comment": "Malware payload (SnakeKeylogger)", "value": "afe9ed6c664ab8a6e3a3a069c86e899d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630468300, "uuid": "709d19c1-46c9-40f9-ab80-74d63abda74f", "comment": "Malware payload (SnakeKeylogger)", "value": "74de1fa81cfd66bfbc4b0fe4f68839afc3e0761d2efbeddd9571be46b802d211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630468300, "uuid": "c88f37da-7e77-4d63-9ff8-f7fe40bd255f", "comment": "Malware payload (SnakeKeylogger)", "value": "9067113dae2750d80fa876b4fb539b0be1254a47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630468300, "uuid": "196a615e-1838-40fb-8d13-e356e23b05ef", "comment": "Malware payload (SnakeKeylogger)", "value": "b87478609fd7ba6e142f1c35602718d83d322129081f25e5a02ff559904c7a7b80bbd113fd956cee5cca0790dd408c8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630468300, "uuid": "db530c32-6772-4121-8c5d-eaa81cb6b01b", "value": "T126F43BD1F15098DFEC6B49F1AD2A6C302093BE9D54A4810D559BBB1B6AB3343209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630468300, "uuid": "c8d2a6e3-cea6-49e1-9cf9-97394f8a86ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630468300, "uuid": "172ff1be-6274-4a0a-a65c-030cf4d9d099", "value": "12288:trLjbIBblgDzDw/mQXjACFDj7w9c+U6Y:twJUw/mQXjNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630468300, "uuid": "30500ff3-4bff-4fe3-8334-cb7cdded71dd", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630468300, "uuid": "d040d138-3499-4110-b32a-4518f023bb98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630468300, "uuid": "6c13f88e-0a82-4b7f-8324-6daeeea5a936", "value": "Faktur pajak.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2acba3-0b2e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630505589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505589, "uuid": "ea582be9-a118-4619-bebb-08294d324b62", "comment": "Malware payload (AveMariaRAT)", "value": "2acbe3f628e0872306b0620b1c65f411", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505589, "uuid": "7eee9eff-f2da-44b4-9c3a-5162720cf1c0", "comment": "Malware payload (AveMariaRAT)", "value": "74e572bc38bba5ae10cb950fb8002199c50479a1e7ad3e5f7f8b8507eb506c8d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505589, "uuid": "d5e3526f-5e55-485d-a587-0d20e6c0c9b3", "comment": "Malware payload (AveMariaRAT)", "value": "e958a23f4fbd9a7d5bc7baf698b304ab24d72abb", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505589, "uuid": "b2e1ba3f-bbef-4c60-a3c1-9dd769ef5618", "comment": "Malware payload (AveMariaRAT)", "value": "b5333afd4a39854b22390bab57ab8522824671634cd9b01ca412d5b1b9d43b5ce3bf1c2c05c76fa25ebac33da7a033f1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505589, "uuid": "633c2467-42b7-46c7-9ae9-93fbe79c8b02", "value": "T13ED4E046EA80C444DC3E67B0F07E8DF0155B7D66EC74A69F2E49BF3876B30E2256244A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505589, "uuid": "fcc973cd-326f-4b90-bd3e-2ff2adc7a18b", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505589, "uuid": "7723a91b-ec11-421e-b1b3-af43f1d442cb", "value": "12288:sXe9PPlowWX0t6mOQwg1Qd15CcYk0We1jRKtGyT0nGVE5XHhT/uO:JhloDX0XOf42th7E5xT/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630505589, "uuid": "709594a1-8736-4314-ba7a-4834103445be", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630505589, "uuid": "b7b30bc7-c9e9-41a6-a498-97650d2e5e4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505589, "uuid": "f6827335-054a-4337-b9de-9004a56a2219", "value": "INV.Order0021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0882e096-0b52-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630520749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520749, "uuid": "9f3df0c6-24ed-49a9-857e-930fbef6e152", "comment": "Malware payload (Glupteba)", "value": "7aba16a936d0f58ceb04a360f0767bf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520749, "uuid": "e5382daf-bee7-4963-b377-eb5203325231", "comment": "Malware payload (Glupteba)", "value": "74f19d23d99aed723ed2584ef1e558cf3d6995a1a3624a4454f9d4c4c53c2963", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520749, "uuid": "2884dcdc-0fec-4ebe-bf56-bfe0e35fbdcb", "comment": "Malware payload (Glupteba)", "value": "5ea3bff48322a21ae7623989b8dad72ea15bf189", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520749, "uuid": "9d97d28c-36f2-4e28-93b8-365d96ec9a73", "comment": "Malware payload (Glupteba)", "value": "420e07ed8890010163d9acea5b8983c0dea0432d034be30eb5afc2033464fdeaa3d13a3765a733c56333298447ea196e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520749, "uuid": "32e7665c-f0ae-49c5-b8f8-806ca49a4cbd", "value": "T17426337F3604DC36E96802760C2CDBB79DA17CAF8E52DD8577E8255F2BF1282A712610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520749, "uuid": "83487eed-0d70-4ee8-84ce-324c075f0076", "value": "6c24281dcaa86901b7166ae3ce878d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520749, "uuid": "b647cea7-c787-4e32-a595-448cf2c73865", "value": "98304:rwJUj/cXGt2L8cUsaMVXZJowRFipdCyz9iv6itkCkrpEqkD19Ir2JAZI:WGT2hzXZeZz9iv6TJFhk4rk+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630520749, "uuid": "b5724d91-6e71-4c0a-a3a4-204fd27fb260", "value": 4707880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630520749, "uuid": "7fbbf6b0-1971-4f98-97b1-8cb4af59346d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520749, "uuid": "ffb58b2e-ebba-44fc-83a3-00ea9668034d", "value": "7aba16a936d0f58ceb04a360f0767bf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a14769d-0b53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630521343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521343, "uuid": "69fdcc7f-5e90-4634-8476-9d18a967902e", "comment": "Malware payload (RemcosRAT)", "value": "36909bb88f91e69d271e206ab3fa8f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521343, "uuid": "d1245e85-7e70-46c8-bae5-ad0ebc346d7b", "comment": "Malware payload (RemcosRAT)", "value": "75591cb23ef20e0a1bc8d01a392621d608b83ee25bcf37b330d3e966d2c8a50b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521343, "uuid": "ad37ef62-f327-49a2-a50f-1c2e6eee1784", "comment": "Malware payload (RemcosRAT)", "value": "ca4d3fb640f12537fabe1eb107ef718b21c92c63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521343, "uuid": "68a0464e-850c-424c-bbd9-812b0deb31af", "comment": "Malware payload (RemcosRAT)", "value": "44ed40e4ebf450686cb809584388b5f4e0595262ccbb63c0f467599a765cfd51f70ad71d490ff871c51cbd381ce2e86f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521343, "uuid": "ec649064-b50d-4bf1-a7b1-36531af1d58d", "value": "T145A4B48E62484208F5A6FF71988D81F903316D31ADB6C44E17D9B13A0FFAAF59B17847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521343, "uuid": "5ab45172-9530-47a0-a9cc-e4607f9ab26b", "value": "c4b3ef5cd2bacd05c5793b6be4b1aeae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521343, "uuid": "a5ccaa85-eafa-4160-9c64-e61bbf3b7751", "value": "6144:swnXSYbm2at3ZjyPt7Z3CZzw+38Pt7cjqJWa:bSwatJuP5N8H8P5cEWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630521343, "uuid": "d94258ef-6a1e-4c7b-b2af-4c130df09f69", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630521343, "uuid": "87c61175-e2b0-437c-9516-0f7f67539318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521343, "uuid": "0159ba26-e045-4ea1-9556-95093d31ea79", "value": "36909bb88f91e69d271e206ab3fa8f00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ffe348-0b1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630497069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630497069, "uuid": "ddc66826-6813-4187-842a-7f5aad3039ff", "comment": "Malware payload (RaccoonStealer)", "value": "54007ad4cbfefe0caf5e1628c6403bba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630497069, "uuid": "d5a32731-b402-4546-a643-ed0380080a6e", "comment": "Malware payload (RaccoonStealer)", "value": "7578b1f217fca3612bbabadca671494f35cbada8d58fc11c68092477c99ec084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630497069, "uuid": "b09a03d0-a214-4afc-ab79-8b04440e0812", "comment": "Malware payload (RaccoonStealer)", "value": "2f0caa62408422229091db138a54da4d7879469d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630497069, "uuid": "c929e83c-f7ea-476e-acf6-0bfe6ad4f43a", "comment": "Malware payload (RaccoonStealer)", "value": "85eab939ca416fd5c72602382ecadad93730bb203d6cf419b979e9a85c867c1b0931906dabe3a76f804dcbcbdd0bd8b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630497069, "uuid": "a3c4298d-c3f3-4603-b360-abe56583be19", "value": "T12954BE0B3290C83BE59106324C61DBF89E26FC6D6E22C2C777D5275F2EF12999B12356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630497069, "uuid": "d1266089-383b-4a66-8840-b6768bb56647", "value": "7449bb1bd2f7cf11b31b665cb048bd37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630497069, "uuid": "eb39864b-e6ae-4f78-9613-349ed80ac447", "value": "3072:EaxD41pLTMUo7WfXrtqLXHuAouWHGq5zSXPIymMHJ8atSMu8KY9wmSVgsCmbmF6:EaKrLFo7WfXBqKz950IanX59EPCmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630497069, "uuid": "e6143604-40a5-4fbc-bc17-eb46e7cbe4bd", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630497069, "uuid": "70106460-d268-4c60-af74-86307752f198", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630497069, "uuid": "f86b1048-11d9-4333-9e46-6116ca62da19", "value": "54007ad4cbfefe0caf5e1628c6403bba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1905ce49-0b2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1630504886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504886, "uuid": "0148099d-e48c-4d77-ac90-e423b0e8874a", "comment": "Malware payload (Dridex)", "value": "88385d7c98280b9a188a499c47058b5a", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504886, "uuid": "638be3b0-439a-43a3-bb26-3557217de41b", "comment": "Malware payload (Dridex)", "value": "75af70e23da2b599da4494660650ed0cf042caacd80749f3015b4cb323b57b8f", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504886, "uuid": "ce2829fd-d103-4f1a-a220-e97c99e7c09d", "comment": "Malware payload (Dridex)", "value": "48ae0de2a9fe51a577086b186f55e72bb3aab37f", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504886, "uuid": "f0a17cbe-5cd5-4311-893f-2e4c4f702bfd", "comment": "Malware payload (Dridex)", "value": "b56b838dc0eedda918aac0da24bf4551d01a7ff5c9cbf16c6c0e2d7e0ebbe5a154a9df9a1f9267405fb6603b2fa75b60", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504886, "uuid": "796f85d7-c5f6-43ae-b99f-529c3fa916ab", "value": "T1F5F3F18DB46B1138C91B153D2AEF0FF827A80FAA10919F0BA1B1B2285F136FA77D4541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504886, "uuid": "c2f6c63f-5fef-409b-9ed4-930e2913352d", "value": "3072:oU7qYQvd5duY0433TM3dwIvmPytSyb14822ZUlJxeeKeu/nAyMEQfpdERkFHpfa/:o2U5Z0u43UyG822geXJEuke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504886, "uuid": "0585c5a1-257b-4906-9c47-a6e8a5fb7765", "value": 171359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504886, "uuid": "020574ee-0d4d-43cf-9e83-0e6d5b0809c5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504886, "uuid": "1fe0fcd4-42a1-40f4-ad38-ce92f12d4b7a", "value": "WAGES-No.-75628914_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f0316d-0b19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630496450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630496450, "uuid": "252d66b2-c591-4f16-a259-fbd21646d6a2", "comment": "Malware payload (RaccoonStealer)", "value": "88a6884eee6c0c99c9813f4025c3196e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630496450, "uuid": "8bcc4b73-988c-4067-9c30-031368b61334", "comment": "Malware payload (RaccoonStealer)", "value": "75e1b4939493508e2cc388d2918eb23e1716644e659bc9990e04220db3af4060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630496450, "uuid": "c37b83b2-8897-4467-adf8-dea299aacd8b", "comment": "Malware payload (RaccoonStealer)", "value": "953e865f22db1301bd7504eba3410b5ee0ef76da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630496450, "uuid": "66649a33-0ee9-42f7-9854-dbd2c234a38d", "comment": "Malware payload (RaccoonStealer)", "value": "e40c96caaab9c94a5a24e7323e8f068ccc0dd96d82c03c243af400c92e28856dd89f5ac1c1bf57b549cf979cd799a60f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630496450, "uuid": "3e8aa784-54e5-4f00-9d76-f820a8f3d769", "value": "T17754AD1B3280CAFFD15106316C61EBF81936FC6D5A22C68B37C5266F2EFD2919B12356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630496450, "uuid": "92a93a1e-ac90-4190-a6a1-87d291105a6b", "value": "4dfee2d5d789a471aa176a087571f5a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630496450, "uuid": "48e5f2f3-db13-4dc9-b566-e9a1da0abdb7", "value": "6144:AygWiULhm4slvjWQbpb7SpbdaIanX59EPCmK:wWiUdm4O6QbpbGjRaX59Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630496450, "uuid": "29244684-67b6-4425-a049-d377ed8bfd5e", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630496450, "uuid": "f001058c-3c4f-48cd-9cc6-93e1ae965ef1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630496450, "uuid": "e7ba7eab-f1f5-4181-b7b5-64b01dbe1cfd", "value": "88a6884eee6c0c99c9813f4025c3196e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9d7f30-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482771, "uuid": "a4e90039-cb5e-4bcb-bdc1-246e0eaf546d", "comment": "Malware payload", "value": "7eebc4faa06e6d345d0742f1a73539d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482771, "uuid": "2f927117-6524-4c1b-94b5-a039028f8721", "comment": "Malware payload", "value": "760696852e04b9836f71b075ca1e000660dba1aea53eb549bc8ef15b11427a2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482771, "uuid": "9ffcbc00-d992-4dab-bf8a-fcc9f965a9ab", "comment": "Malware payload", "value": "e1b7e0d7430cdd7f24057fc2c36653681f44fe2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482771, "uuid": "9d0f0d61-53f4-457d-8961-96e9b5ffad9d", "comment": "Malware payload", "value": "7a152ed5e46eb5b7858b6c33a5804f1bd70ac9f4dfe0fa52a9d19c21aeaa2a4f03ff0ee5fcd33a1d96544d3dd76008ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482771, "uuid": "67394bf8-73d8-417f-8287-ef4ad4cbb928", "value": "T1F4054B138D498B93D46887F8BD434E9D2F162B09E8413AFB305E1EDB7F612625C9E41E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482771, "uuid": "b93e3336-4b60-48f8-ab4b-31428018ed42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482771, "uuid": "a4674aa5-2a0e-4b5c-b9a0-7513fe265099", "value": "12288:H8z29+WZLf0nvQUZ3xvKf+pllRaM9+f/peDzpdATk5GvOXzN:o29+WZL8Y431Kmts6S2dd1DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482771, "uuid": "7d642361-234a-4aba-9410-b4d6b73fd171", "value": 828312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482771, "uuid": "0c749d30-9bac-45a0-b7d8-a4fbbc36014e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482771, "uuid": "3ab26cd5-ec46-494d-9426-f4bf84f24823", "value": "760696852e04b9836f71b075ca1e000660dba1aea53eb549bc8ef15b11427a2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da2e942-0af2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630479714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479714, "uuid": "965d78ef-71d9-41ae-a581-4b2baba4b958", "comment": "Malware payload (DanaBot)", "value": "ae8b40bdf27fcdd4bd5fef4c5b1448a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479714, "uuid": "0c1ec747-b4cd-4fd8-98f8-48634cce7194", "comment": "Malware payload (DanaBot)", "value": "76481e75bf486a5a2dbff6bb550830404cc52ca59a8638e0c0df32d8b1b18d06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479714, "uuid": "7bfe9516-5e63-4676-b457-7ef7990cb51b", "comment": "Malware payload (DanaBot)", "value": "35b99757e7185b527a6b6e304e3e87b20411dabc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479714, "uuid": "d152845c-a406-428b-8693-9aeffbef6386", "comment": "Malware payload (DanaBot)", "value": "045fb373a8fa8cf1ad8028736f77ff70bb4d6ba8e81dbb626af89639b1d7e3a99a3d8804158511d7ac284e5890367c3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479714, "uuid": "18cc9b5e-c61e-42fa-99f7-02f8a9fd9543", "value": "T1D445222736A3C477F291057048A7D7B9663ABCA9AF21CA87F7C5224F5AF02C19335316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479714, "uuid": "3d8091ca-a4eb-48ed-a5cc-4c99b714787b", "value": "66f6132807e59bfb21d701cc690ae848", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479714, "uuid": "c84c396c-9de6-44c2-bd62-04a9efe16273", "value": "24576:MziZ1Rc0uA+/1vx19vJaOIuK1emfT+aJaKuyh4dDL72BQxwn/o5Bl31:v1RfuHtvZJtIuK1rfUKEdDLCrw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630479714, "uuid": "6c93d5b1-28f7-4bf3-a074-51e164964904", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630479714, "uuid": "17f419ea-a8f5-4a4d-aee8-df0a93bcf63d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479714, "uuid": "579389be-8c06-457b-8a09-c11878abf464", "value": "ae8b40bdf27fcdd4bd5fef4c5b1448a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745fd85a-0b60-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630526943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630526943, "uuid": "9808db2c-6bea-432e-9055-5dffe83f747e", "comment": "Malware payload (Glupteba)", "value": "17758a9d97bfeb580c36fd9291344135", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630526943, "uuid": "a3383fa2-aa53-4fd1-b030-33e62137373a", "comment": "Malware payload (Glupteba)", "value": "7648e6caa40622f2d5c625f3b05b3a5c985592f845c26126311a769c7e256c78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630526943, "uuid": "ed93c42d-c2af-4e1a-9057-52b8c9c49cc6", "comment": "Malware payload (Glupteba)", "value": "1d3856941b73a1cefd4307847b243025994bac90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630526943, "uuid": "e37a307c-76d3-47e3-a3fb-3345c973b305", "comment": "Malware payload (Glupteba)", "value": "5125e518882b7f7543f693c418feacd2f0c6e153a8f717d96e8433268a496a02626f7c02937bcb34e7f5ca5d7e965320", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630526943, "uuid": "6dfd5cc4-80e1-49d3-9015-d604576ae57e", "value": "T13A26332F2791D0B7D8DC073449C54FF996667E599C04E81B2F811B6EEAA93A2C706333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630526943, "uuid": "e2cfaca1-dc25-4299-9274-615e9758745a", "value": "2617ed69d5fa8c0972283727d551e89d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630526943, "uuid": "7c568121-b88f-462b-9cba-323563b11445", "value": "98304:hv1Ien0lEuPLzWdMA0ZHlBWxO9ujyb1U6h3g:34kMAYl8xO9cwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630526943, "uuid": "93b523ba-328f-4dbf-b68a-d82223a2635e", "value": 4628008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630526943, "uuid": "a6d5a8ea-cf41-4417-a661-03863e1f268c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630526943, "uuid": "3b75c919-0256-4d81-98c4-1eadc08ffa2b", "value": "17758a9d97bfeb580c36fd9291344135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5d0192-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482744, "uuid": "9b51a0b1-44a0-44a4-91de-d2ec15c57a21", "comment": "Malware payload", "value": "f43ee46b6d2d5bf677a4d3cd550554ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482744, "uuid": "1fecc56b-fe9f-4a98-9a23-450a61b37c62", "comment": "Malware payload", "value": "77a825de2426a199fffbd178d67e8282ff63a037c96cbd1c1ebe5913ec4d1a9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482744, "uuid": "8eafb0cb-8b7e-43bb-aacd-4efc48220879", "comment": "Malware payload", "value": "8fcab001feed935b4cfa34345cb93b9ef56300c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482744, "uuid": "bc0bf797-bccf-4bb5-bea9-cabd8f15e32a", "comment": "Malware payload", "value": "9e95eec717f704ad88d2b5489ce50457dce4135b485843c1c279f0f8c1e212fcfb8ed96dea3d5c3cf9d0d26b985ed7fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482744, "uuid": "d11a8be9-366e-4697-9759-de004a1fdd91", "value": "T1EC256C078D45CB93D56842F8BE430EAD2F162B0DE8813AEB315E1DDB7F651225C9E42E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482744, "uuid": "d1ed1e90-d7a6-4b49-9016-83d35f8c0e0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482744, "uuid": "d66a5bdf-3f60-4279-8c6b-4b075a14eb93", "value": "24576:p29+WP29+WWm20CL8Y431Kmts6S2ddlpM:pILPILWm20fKMs6LVpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482744, "uuid": "b743f0f3-3acd-4aa3-a7e1-bc3df667a392", "value": 1023896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482744, "uuid": "0174a6dc-b501-4b18-9c3f-9920f629a880", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482744, "uuid": "c4601dcc-a372-4ddc-9a2c-87500d931d59", "value": "77a825de2426a199fffbd178d67e8282ff63a037c96cbd1c1ebe5913ec4d1a9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3794522d-0b38-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630509662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509662, "uuid": "d55d9c1e-e1e3-4a7f-88ad-ef4f4bdf2aa4", "comment": "Malware payload (Formbook)", "value": "928f82822d997033b331fa2e51e5f6dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509662, "uuid": "8da251ec-ddd5-4814-aa38-9d1e1bbc9fad", "comment": "Malware payload (Formbook)", "value": "7804b61e9db003a8c658d4288da507be6a478942229af9b4f0753dec75184b86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509662, "uuid": "f3c0fe7a-7b6e-4a14-8a13-acc4260cc428", "comment": "Malware payload (Formbook)", "value": "37cc34dbb86da75db254bef1090572e8132c8bb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509662, "uuid": "d83b00e7-ac15-44d1-80d5-827ba4a11bd2", "comment": "Malware payload (Formbook)", "value": "b74c757b74d53d0323097042d747e51a0169964266582b579f1418d55966baa0291bbff7d52bdc3fe65149f93e2d492d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509662, "uuid": "897330e7-bda2-4783-be28-9dcaae7c2758", "value": "T18CB4E15D7650B1EFC827C975CAA42C20E761B47B570BE243946322AC9E0E69BCF191F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509662, "uuid": "a1d367fd-319d-484f-b788-7f4df466b44b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509662, "uuid": "5448b8b7-6323-4a28-9f4f-e9ced85cdb82", "value": "12288:Tdfy2Up30/jtfmYyXCI8FOW8Yc/zB4a7TL9mjXj/41w:LUp36joYGaOtTt4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630509662, "uuid": "b3ae1cc0-0f59-4120-97d1-7439580ea74a", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630509662, "uuid": "70fb5124-635d-412d-b967-3ad601addf24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509662, "uuid": "e1cf2bde-7ddb-40be-95a4-9d5799916f04", "value": "928f82822d997033b331fa2e51e5f6dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf59b18-0b58-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630523602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630523602, "uuid": "c3692341-3070-4143-91e1-d9cab0cf4c17", "comment": "Malware payload (Glupteba)", "value": "04ae6415e67addc26dcf09724371e8a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630523602, "uuid": "990893d2-eac0-4486-ac19-88ff2d7c7ead", "comment": "Malware payload (Glupteba)", "value": "79123c765ff9f7d116bbf4bd64a52c2bc33195a1287666ea379d89a5eaf0ec40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630523602, "uuid": "b6269bd6-0c85-4a49-967c-4bf50288dbcd", "comment": "Malware payload (Glupteba)", "value": "e8843fbe85aabe01b6127f4236e11c86cc724f95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630523602, "uuid": "4952a11b-0293-4876-bc51-f931fcd74c4d", "comment": "Malware payload (Glupteba)", "value": "16a1541297afbf426aa679c60f73fddae195efefe15e5beefabb855a52524721e330ab7b19b40aab1a3b30a69f7e899b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630523602, "uuid": "05d6d881-5978-40f0-b6ab-4a7a6e604657", "value": "T11526332F2791D0B7D8DC073449C54FF996667E599C04E81B2F811B6EEAA93A2C706333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630523602, "uuid": "615888b8-5109-4c38-8e51-f4fa3a98cd76", "value": "2617ed69d5fa8c0972283727d551e89d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630523602, "uuid": "97f7736c-188f-49d3-9b70-d65291a7a433", "value": "98304:hv1Ien0lEuPLzWdMA0ZHlBWxO9ujyb1U6h3Q:34kMAYl8xO9cwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630523602, "uuid": "22578651-631f-41ba-9b24-b25aae73ee75", "value": 4628008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630523602, "uuid": "5546af0e-1d19-4b9f-8962-f8bd31e3516e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630523602, "uuid": "3c057da6-34e8-4b67-b8f3-aebbfecf21f8", "value": "04ae6415e67addc26dcf09724371e8a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2598ee-0b21-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630500034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500034, "uuid": "5d794c7c-be22-4da5-87f7-cf0f0f5185d2", "comment": "Malware payload (BitRAT)", "value": "647ca708578d150575f22990d4f59c80", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500034, "uuid": "f22269af-c771-4bf4-b146-2a3f2505a484", "comment": "Malware payload (BitRAT)", "value": "7bb79061b7e9fe2e1149f524b99757604729d0195e56f737cf793c776b95a8aa", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500034, "uuid": "0d483bcd-6fd0-484a-b7f5-bce7a3faef46", "comment": "Malware payload (BitRAT)", "value": "444acf34db6264ac9612ae2a3c20546482f64070", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500034, "uuid": "c6072b39-7b7e-42bb-ac1e-11fb603334b0", "comment": "Malware payload (BitRAT)", "value": "e96adfbd21f5454c91d253936959579b9dd324d111a557220cf51f3d38e5647e0a642fa5383c01c229ef44c3524b2c6a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500034, "uuid": "c8951f8f-9a69-4a9f-8047-4692c8dba216", "value": "T18106CF02FA46C562D2170230E96E77BE053CF9354B2085C3B3946E6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500034, "uuid": "da4a1296-6847-4650-80e3-0d84f0cc8a0c", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500034, "uuid": "87e2154a-9d36-4225-9b53-914d99a0a2dd", "value": "98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/WmlwXVZaFB:K+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630500034, "uuid": "aee57b03-409f-4d4e-b1ef-525a3a76c7aa", "value": 3943424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630500034, "uuid": "be615dc4-e0a5-4d73-b0c6-bb6ee6acda96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500034, "uuid": "a71217af-043e-47d3-bcdd-d5469458c473", "value": "647CA708578D150575F22990D4F59C80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a96a6e-0b23-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630500604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500604, "uuid": "8c4e93ad-2551-42c5-aa51-f0c10708163b", "comment": "Malware payload (Mirai)", "value": "dfdb80157f894e6237903899333f4ea9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500604, "uuid": "a8c38409-8c3e-4e97-bbd7-354084382170", "comment": "Malware payload (Mirai)", "value": "7cc57bcffd201a2b49876d063765828a09f05dd9bd9c7d03bdd23c807706f863", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500604, "uuid": "20c8983e-155e-4d83-9a5e-411d2a0342ca", "comment": "Malware payload (Mirai)", "value": "87de1cd84fab28404735503e005f2dfd23d5bc3d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500604, "uuid": "a0b18050-2a0f-4294-b25a-16462609b57f", "comment": "Malware payload (Mirai)", "value": "d951b47591636a8b6df9d571f4aafbf7ff5f587b3f6229930d2a69459cc7c63c381e1f1b62911cdefd1824eb7a56eb64", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500604, "uuid": "37d45141-0559-4f40-9ac2-3ead928aa8a2", "value": "T1AF630846B8918A11C5D513BAFA2E118D331353B8E3DF7222DE146F6077CA92F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500604, "uuid": "9039c7ec-8d0b-405b-b69f-ae8e9cf93fe0", "value": "1536:+xngPBbNz9PLzyKSM90ViHAiczK7F+lVZ3ENBD/qrJhrsL4IviCci/ZWK:hbhpXyK36ihczKSV5ENBD/iJwci/ZWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630500604, "uuid": "db4b6fb1-8d6f-49ba-83e5-9a08c0b1fe0f", "value": 70952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630500604, "uuid": "7970b409-b0bf-47c2-b85a-cb555fd8a0ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500604, "uuid": "ab2d4e25-f53b-486c-9cc0-7eea40a0c3a0", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a86b9a7-0b46-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1630515653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515653, "uuid": "52f51daa-c765-44d1-94e6-56e085fa60da", "comment": "Malware payload (Adware.FileTour)", "value": "8adc5d57a26fc6ad44338a47a1a45dcb", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515653, "uuid": "3b0fd0ed-dbdc-4986-8534-703744916782", "comment": "Malware payload (Adware.FileTour)", "value": "7d50e22081955b574b989561277ce0e835117e716817736373ac8799774b6f03", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515653, "uuid": "0a3bbb7d-e82c-4852-8641-278f61bcd6ec", "comment": "Malware payload (Adware.FileTour)", "value": "5160b9f42a52e2d9d7c286cef12499e53f34ac46", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515653, "uuid": "0246765b-bbc4-4da8-ac4e-735f239c4644", "comment": "Malware payload (Adware.FileTour)", "value": "73792abbba322cae716f11f79cb2ef608ba68e51932cb91722ccff9a63ce345fe7d9272ea81060dc82a4dab4833e27f8", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515653, "uuid": "149ec656-1c6d-4664-bec7-41d0c0f2755c", "value": "T1B5D533DEA285DF26E0A80972E5B7C223A4F18F1334986B7F835837787EE9554E12C5D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515653, "uuid": "26dbdf46-0a4a-4a6a-b9f0-15f1bee07441", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515653, "uuid": "395333d7-916c-4003-b570-5b3117566d91", "value": "49152:9g/PiVJuJNz0XqAbsC6QFC5vXIovwASRIyQkPXhmZUS6IspAdVnXC5yrzIKPVG5n:y/Pij4KqoPzPXgPsidQcnw9am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630515653, "uuid": "becd1869-0b3c-45d1-b300-3b824e6356eb", "value": 2965516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630515653, "uuid": "40bc93ad-2ca1-41c0-a807-90aac3bafb0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515653, "uuid": "63cfd34c-81f1-4693-a3be-90669edf2cd3", "value": "8ADC5D57A26FC6AD44338A47A1A45DCB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bdf723-0ad7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630468241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630468241, "uuid": "7acee7c4-2cc4-4999-8960-4f920fd88841", "comment": "Malware payload (RedLineStealer)", "value": "9c531281ce95141d0fc050f7c9942594", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630468241, "uuid": "6376cc4a-d67a-41c8-b8f9-2f2c495f8596", "comment": "Malware payload (RedLineStealer)", "value": "7d6bc9c488ef81546e89c929a34e3d067ff083599c80edad38987fd0771cfe4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630468241, "uuid": "d95158a0-13da-4cb5-a46f-b4302730a3e6", "comment": "Malware payload (RedLineStealer)", "value": "fae43876b8bac540d09de5fb22269ca79abe3721", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630468241, "uuid": "5bd2ad97-971c-499a-8513-1eab085a1c11", "comment": "Malware payload (RedLineStealer)", "value": "930a1c7d675f3feb426bfda563004dac16bfa5ab977adee0b0822acd3a7d3c9daf6271f5ebe2d9b71fab3ee09c957077", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630468241, "uuid": "d1124907-4764-494b-a2be-ac06d2e238bd", "value": "T18D058C33384414F2F53D1BF12BC6ABB659AE6E3B1DC0499663DC35F9A476260829C13B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630468241, "uuid": "3238d26c-8810-43ad-b264-bf44373a578e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630468241, "uuid": "6cf33103-ba46-4bf6-ad27-3fa41444f823", "value": "12288:NRZ+IoG/n9IQxW3OBseESyzbUW9Ra6lNmjg2E5th1sPneIdZpubDmr8ARFmUf5tD:F2G/nvxW3WFy3UW9R+Im0dsFmUf5tD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630468241, "uuid": "97b10413-4718-48a0-8f3d-ee4ebe3a9c5e", "value": 852241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630468241, "uuid": "9fd2febf-eb84-4079-adc0-723e09913114", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630468241, "uuid": "6577d9d8-0cf1-4aed-ab12-c7fd001fa111", "value": "9c531281ce95141d0fc050f7c9942594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fbcf1c-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482701, "uuid": "5caa8b94-6141-4675-b16a-29814442b2fd", "comment": "Malware payload", "value": "25c32feea568446872d164b93224d0e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482701, "uuid": "4cd2154f-0e61-46b6-ac9f-1d41a49ee823", "comment": "Malware payload", "value": "7f2094eb1534c20b79bb44b68ff5b0126d3ce3401b409569037aeac022b139de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482701, "uuid": "b68ff8d4-4aee-4e17-9546-13d1c90678c5", "comment": "Malware payload", "value": "a99b2ce542bbeb648c1dbaf93d68d2ae83cad7ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482701, "uuid": "162155aa-0504-4bd4-be8e-99f3a83ea7c8", "comment": "Malware payload", "value": "3e6a5dc8676a0dc42a288e59210cb66d7787189d630c40174cfd5aeb3342402dd0281cf1412c5c4c440864064a3258b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482701, "uuid": "6591b9e6-cacc-435d-8b8c-27299f647f82", "value": "T19705522656D8B979E3F69B307FF252D3BA69BC523834CC0E11D5030D0969A42FDA076E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482701, "uuid": "84999ab8-69ae-47de-917b-ef3a1d87ff7b", "value": "81fd276d49dcfb5944ab1253641f139e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482701, "uuid": "39f14cca-21fa-42f0-9580-52ccb980afb7", "value": "12288:aDuWNvtS/PHV4c1JwX2afK+ixeCzteMb01JQntLOCrs9eM10l:aDlvEPTJmix5ztemrsLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482701, "uuid": "c7b64970-d0a2-4912-825d-d5ac49f70fcf", "value": 797592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482701, "uuid": "bb81fc67-09dc-433d-90ff-02e3f76986a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482701, "uuid": "8807b72c-bd6d-485b-8945-e31e47d10965", "value": "7f2094eb1534c20b79bb44b68ff5b0126d3ce3401b409569037aeac022b139de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca0e2ba-0ac2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630459231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459231, "uuid": "8257b741-4927-44c5-8bf4-2b76f3d916a8", "comment": "Malware payload (Formbook)", "value": "e2bbb850c21363d228dc24d273e1a8a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459231, "uuid": "acdb8f43-2a1e-4e56-8a92-9afe254465ab", "comment": "Malware payload (Formbook)", "value": "7f41f56fccf71bcb0c1f50d11e9d05a0342cd08a3a27d55d31cffe0ef95b2272", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459231, "uuid": "b428e928-c47f-48ed-859e-7144fb953c57", "comment": "Malware payload (Formbook)", "value": "fd22b3c7eb8baf4a5f73cb32340c1503cc5d2b2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459231, "uuid": "1cefe47d-a207-4490-b95a-7d24c950bd74", "comment": "Malware payload (Formbook)", "value": "2d5320dc8b35a83c99de6aa69b095e20e58a91766e8f4a3fb293a881fd3e13ba84426f5b1bf75182509b0d4338281aa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459231, "uuid": "22251956-c74d-4296-9407-2cf31446f676", "value": "T1B3B4E0487654B19FC827CD36CAA81C24AB21B47B931BD307A15356EDAE0E69BCF051F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459231, "uuid": "9cfaf3ed-abb3-4ab3-94f1-184374c1be12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459231, "uuid": "0baa0ec4-6ecc-4b93-afd2-918e7e6de55e", "value": "12288:AfOusTlZ4F8YdfUMhIwWbm8RN5qlGeiSLRMcfj/i2CuAUgh:AWuyZRYdfJhIwWKOPqs3Qfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630459231, "uuid": "e83b5db1-6a8f-4465-a300-ba551c7bd35c", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630459231, "uuid": "79505cd8-b57a-4c8b-9a16-f74eae199d53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459231, "uuid": "a7fffff4-41ec-4a53-9671-be645e979832", "value": "Released Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70436c6-0aea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630476428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476428, "uuid": "6751e554-356e-424f-8515-f3bf1b2a2e26", "comment": "Malware payload (AgentTesla)", "value": "b6bf34dd8db8ebc1321dac7b8466a9d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476428, "uuid": "49b80f5f-893e-4dda-be41-242c7de82920", "comment": "Malware payload (AgentTesla)", "value": "7f7323ef90321761d5d058a3da7f2fb622823993a221a8653a170fe8735f6a45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476428, "uuid": "18039f20-b83a-4a98-8f25-729b5ebae373", "comment": "Malware payload (AgentTesla)", "value": "6b1d04828961ad9ce0fc053eb3236d8f234d6b97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476428, "uuid": "06bafbc4-462d-4136-9415-2b37eefc5e5a", "comment": "Malware payload (AgentTesla)", "value": "6dba858b2813592c048ba0420e30082099574d9d84a5715c12ceafdef3e1a15d9eacd6cf05559caf19780deb367ba3a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476428, "uuid": "bda582c6-ae30-456e-ae37-2da031bfc491", "value": "T1F0F4EA7F19BDA1279175C2F58BD78423F0018BAF31206925B6D647264323A7AB5F332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476428, "uuid": "f5bbddf9-9bfe-4977-895e-41100c1a0365", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476428, "uuid": "8d1db827-5691-4334-b585-e27abda1ed38", "value": "6144:mHv44VO55RakGgA3uWOLUg3DOmk9OWv7Bh3WpmuD3Om+JDp9tMr:mHg8Qa/gxWQdDOz9Oq7T3WpXfsDpQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476428, "uuid": "c89f7106-9fb0-446d-83fc-74202d015c6c", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476428, "uuid": "a611029a-b479-4652-b5b4-da85d641eebf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476428, "uuid": "15cd4e94-6ec9-4263-a47a-8054a2eec016", "value": "Nuevo orden.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf486a5-0b0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630492278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492278, "uuid": "8af0b9c0-2b62-44d3-b9a5-1e040eedc2d7", "comment": "Malware payload", "value": "e5c299a33588d1e897e09d854b9b8de8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492278, "uuid": "d4ac0568-145f-482d-95e6-7cb88b0da478", "comment": "Malware payload", "value": "800f9509b1b9901dd7d49c8f41913ab1d9de24aadd28dba35c5ac27720778573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492278, "uuid": "43d762a3-08ac-4082-9b56-01e53f70d396", "comment": "Malware payload", "value": "10372c12654f4fc2cd9385b1c368fb3a16d3ff9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492278, "uuid": "26a55f34-ded2-4fac-b6b8-91da63b998ed", "comment": "Malware payload", "value": "4cbaed25bc4c967cb1b13f8f12d8b58384e773258590082b112c7fb28cae9f8a3df34d20e9ad6058d55b5e484c8804fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630492278, "uuid": "baa8fd81-4d2f-4ba3-ae21-52b7b9859007", "value": "T100C4129D9AE64CB5C5394734E0C7C73E2115AF5A8562328F8109B1B36CF2E24FE9B44E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630492278, "uuid": "c89e562c-e2ee-4114-91d3-c9ad0ea23f98", "value": "12288:OXe9PPlowWX0t6mOQwg1Qd152tcYk0We1X2MyfTJg6cq+ep:jhloDX0XOf4ruMytg6b1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630492278, "uuid": "d36e180b-88cb-4c66-bc29-facd73351c75", "value": 596341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630492278, "uuid": "494090bc-8ff9-4a90-b92c-ab34b6d7d549", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630492278, "uuid": "2ed590fc-75f3-4c5f-b519-9e44b42452f5", "value": "98722345678900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f0b4ba-0af7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630481740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481740, "uuid": "28aa0150-cc59-4929-b5eb-72d115f25983", "comment": "Malware payload (AsyncRAT)", "value": "114611cde9d62a903bdcb1c058469c07", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481740, "uuid": "5124e4e3-70fb-4c5c-92b5-abf400e520bb", "comment": "Malware payload (AsyncRAT)", "value": "80566337bf524f0dcbef98b4b8a474c324c71b73a02c793c5e2068fd2fa74a02", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481740, "uuid": "097b4066-b99f-49ab-825c-d850a9cce362", "comment": "Malware payload (AsyncRAT)", "value": "1d43bc1401caa889c431b46d2a01d251d7cd4917", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481740, "uuid": "04aa8a67-fc2b-43de-90ee-9daf6e6f75ec", "comment": "Malware payload (AsyncRAT)", "value": "fdc05cfb8e10c114743700329a94d472f1967f78d07fd58b1b20555c7653c98b33a6ba12a09f9553361b94f63e290880", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481740, "uuid": "7cdef6e7-ea95-4eba-b72f-afa42d254ca1", "value": "T124232B1037E98127F2BE4F74ACF22245857BF2637603D55E2CC442975A23FC69A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481740, "uuid": "1195042e-8b38-431f-997b-13892639b78c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481740, "uuid": "1b05ddd1-01ce-4822-beda-430d6b403fdb", "value": "768:2ugPNTjgkH7F7WUHw9pmo2q7ANfhkhi7F/piPIlg15C/0bspbslse/EaMkljNKBw:2ugPNTcI42V6E/prlgicbspiTIcj+d4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630481740, "uuid": "a0d74ddb-ad3e-46c4-b91f-a9661c7b6dbc", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630481740, "uuid": "a72c4b9e-518d-477b-a2de-5d5397ae3d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481740, "uuid": "444e13a2-9027-4c90-bc43-038f9f697965", "value": "114611cde9d62a903bdcb1c058469c07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef780b5-0b53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630521378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521378, "uuid": "44af6587-a8b9-4992-84a6-8ec9ebfc0cd9", "comment": "Malware payload (Formbook)", "value": "5fe2f71aee232bd330edea9145a449d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521378, "uuid": "8bfd112f-1036-4719-b4e6-3c1181ab3ff6", "comment": "Malware payload (Formbook)", "value": "80fa55e625d257bc39a7bfcee0d2e7f8f59e2a3e501a9bf85cfc9655f65b2ca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521378, "uuid": "06ab8d72-9631-4b2e-964c-1ab82a0147be", "comment": "Malware payload (Formbook)", "value": "5dd8115fd69d4d626ed190de16d453ce91f0a521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521378, "uuid": "62e14633-e53e-43ca-8533-dfca6a4c43bf", "comment": "Malware payload (Formbook)", "value": "969c750a0dafce407e45a2d01cbeadc96638d16d260a636285466ece0c2851e4d4faf1d7f0376a58f884716d25726eeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521378, "uuid": "ce664139-d586-46c5-8559-acc296cc4124", "value": "T1937401187FD59C43C72A0E7B95612061553AEA626907F397A99433FC1A0F3FB0903AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521378, "uuid": "7907350c-ba5c-46f9-9ac4-8e49c08a9213", "value": "6144:5iFskbJ6/ai7oYAzO8HCICeP9nYU7m9kxtB1zAhX5Wl1wlZDIofpY87afXkg2z:IFLbM/aikYIO8HCICeVnYSm9iDWETkiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630521378, "uuid": "b678fcf7-1471-43c0-93cd-0de9867027ab", "value": 355843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630521378, "uuid": "1cccee36-59a8-4aa6-83cd-b4710d705e31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521378, "uuid": "4cd24822-c981-4215-a1a2-a2d604b36d7e", "value": "5fe2f71aee232bd330edea9145a449d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbcdb05-0ae9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630475772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475772, "uuid": "e288e002-41f9-4a74-86c8-11a4bbc027bc", "comment": "Malware payload (AgentTesla)", "value": "59084f95a9a2733334ead577e5f0aba3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475772, "uuid": "8030e3d8-153a-47fe-b3ce-7f197f45b60a", "comment": "Malware payload (AgentTesla)", "value": "8205b9d316580d43a6c24b3902c08ecc7aeba1e928a50d4a012891e4e2a17f1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475772, "uuid": "f07c6b79-f8ce-4aea-83a9-6c61059d3199", "comment": "Malware payload (AgentTesla)", "value": "be7ab26421aae3ac498857b7eb7e8226b5a4a806", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475772, "uuid": "b5133dee-a7f2-4e7c-aabc-81eda6ee8f58", "comment": "Malware payload (AgentTesla)", "value": "e64c121c2cdc146264816d7c484bdfedcb557cab7a2de3c0247a7f2f84a93980f3a888ba501d62ff5fdf14f7984ca0f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475772, "uuid": "5ebc704e-95e1-4854-87f7-9e4e69a2e5f1", "value": "T1E4B4D0487610B29FC467CD768AA42C20EB21B577631BD243A45716ECEE0DAEBCF111F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475772, "uuid": "2fa84a1c-8892-4202-9b5e-ab666685c0d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475772, "uuid": "ae751099-04c6-4a57-a55e-b18eabba73aa", "value": "12288:/GXP3bXdZ/pv99uk6Ze8U+UAg3g3bZ2kp+wjZKO84kCs7Iko/MD:/G/LNx9Xu9ZlZRg3g3bZlZKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630475772, "uuid": "af9854ea-f4a1-4757-b49e-6f1f4f8a1a93", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630475772, "uuid": "526fd870-2c11-4361-89b7-e228995c7f92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475772, "uuid": "27b86888-98b4-4bfd-9c18-aa6832838e10", "value": "DHL AWB 0125286 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ee8240-0b25-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1630501552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501552, "uuid": "ced8e5d4-6f98-48c1-ab11-187916556648", "comment": "Malware payload (NetWire)", "value": "7bc0c3b8dedcdaf2469d023b237ca681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501552, "uuid": "12e06d9c-a406-4d56-92e1-88b7b59f63a7", "comment": "Malware payload (NetWire)", "value": "8280ae0f658012a4fad6f3d1371818e8667488ea20af33549746e291d103c841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501552, "uuid": "af83f5ef-e63f-4f90-a619-f577689000d8", "comment": "Malware payload (NetWire)", "value": "4620c1ab949f42762f3578f67d656d8761899358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501552, "uuid": "5a0ed148-ab5d-49dc-9a26-6b7c12e0c1b4", "comment": "Malware payload (NetWire)", "value": "2c88148c745d860791478cc9817609130ef4bb945c0fe1f9761bf8599bdf4d6f5a71d4233b421973820ee819bc1757c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501552, "uuid": "0c1ad282-6449-4ebe-a43d-09068963af2e", "value": "T165D4234389C58CB2F326B3319076CE961DB6B4328CC57B789619E61DB874243B8539AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501552, "uuid": "acbae8e4-3cba-4b13-9e9e-56b0f995422d", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501552, "uuid": "4a3b3a2f-03c2-4e5a-a431-8625291a7ff6", "value": "12288:+Xe9PPlowWX0t6mOQwg1Qd15CcYk0We1wPOs+pTF4/rAM7skeZPqJMv:ThloDX0XOf4hDTqkM70PqCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630501552, "uuid": "5e198158-6864-43dd-b026-c5a24d1f1b74", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630501552, "uuid": "7538c758-869c-44ee-adcc-92e2390ee402", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501552, "uuid": "d2ea58a5-4e5c-4cd6-a64e-e7e1f81db964", "value": "??????? ??????? Dhl,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953b32a8-0b07-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630488773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488773, "uuid": "4c9b4d5f-9f40-4556-94ee-ec0b63a75019", "comment": "Malware payload", "value": "fd5fd75395985d48fa6ef4c833eb9d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488773, "uuid": "becbea92-03c4-4f9f-a1c5-64d7e0cf84df", "comment": "Malware payload", "value": "82b2930af51d8cdb57db169338d9bead52d3c82769c4542f1465367c55cfc2ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488773, "uuid": "82c401e2-8436-4103-96a6-c527b8c972e3", "comment": "Malware payload", "value": "06a59ed4dbfd3fa6850fb9017f85a61da5c92d28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488773, "uuid": "88e21a07-a111-47f2-8990-21573dbca9a1", "comment": "Malware payload", "value": "cab2026e6e7c3324c35ddc01e3bc2307d1ea04bdc16a9f6df3a21a28728af93574b96510c7c2d6bb38b1226cdb00b6df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488773, "uuid": "4cc54516-af46-42b8-bfe4-5568e9e6b54a", "value": "T194D35D3078D1E4B2E4A372329D66EB6E1A7CEC214BE18FDB634C07D54F7A4C446B5826", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488773, "uuid": "33225c01-f713-4a56-a046-bb87547b18e3", "value": "78948c332525fd19f0ec279869459f6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488773, "uuid": "df518cd1-10fd-4b07-bc95-8d47e98efcef", "value": "3072:42o+7LKKYFYRxsLsWZuLIGQB6gqU20jA7Voj6fo5jSu:hKKYFYRxsLsWZ4/rbV0j5eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630488773, "uuid": "05710e54-2683-47f5-9d9a-230ff525ab33", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630488773, "uuid": "97ca5bc9-82a9-4133-b330-663975e3b8cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488773, "uuid": "283e7961-82bd-4bcc-815f-71417baadd19", "value": "82b2930af51d8cdb57db169338d9bead52d3c82769c4542f1465367c55cfc2ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91f712d-0b72-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630534897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534897, "uuid": "a8e33d73-67e5-4378-bbea-00a346f1b1e6", "comment": "Malware payload (NanoCore)", "value": "8a6403567f07bb3c73744804f11369ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534897, "uuid": "33b1a0b4-a83e-4630-b315-2e4e101209c5", "comment": "Malware payload (NanoCore)", "value": "82b674263f55d8a01ead098666bbabac4e1b9de9f7bfa7f3b319fbc93da3ffad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534897, "uuid": "e9b0248b-dedc-412e-9f51-203531f4570b", "comment": "Malware payload (NanoCore)", "value": "e274162a7821eb804e3127b30b83279d885686c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534897, "uuid": "f05fb5b2-42b5-42cc-8b94-f72fa9c83e96", "comment": "Malware payload (NanoCore)", "value": "f3efc5991147cff1a008d53902288a5e0158f5178397447dfd1bcd72df369d962be71566bea1f55e2fa55c4fa3fd94d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534897, "uuid": "df8605f9-fb70-4874-9036-502adf5cc470", "value": "T13AE4BE987250B8DFC817CD76CDA85C20A62174BB831BD20BA05726AD9E5E797CF121F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534897, "uuid": "7edb9b9e-2f16-4816-b401-a689d0c4bb18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534897, "uuid": "c0ce3cc2-516f-4f92-a479-d3b41950d601", "value": "12288:QrEvOeDNmqw5tGPW5aAKv87Mbhxr5qEcpT/NzE22MVgNQ1:yE2F54u5abv8Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630534897, "uuid": "c12a9391-2eb6-4ad6-8ec4-e3b7b1700f8f", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630534897, "uuid": "cebbc078-5506-4c61-ba27-ffdede0e9871", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534897, "uuid": "441c3124-d486-4b83-9915-9632f88e834a", "value": "e8kuOR8icHSE83C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87a01ae-0b05-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630488000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488000, "uuid": "72c3eba1-f901-4460-8b2d-ee736bad75af", "comment": "Malware payload (CobaltStrike)", "value": "0a437fb1e3676922ae25f6be9222cb1b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488000, "uuid": "c97a8a19-d4eb-46bd-a145-e636a276c97a", "comment": "Malware payload (CobaltStrike)", "value": "840dd55418bf2bd428f401ee565f08aef2c92eab8b4709158a845dd981dc090e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488000, "uuid": "962ca0f6-6290-4246-89c3-9a2b62ea7c90", "comment": "Malware payload (CobaltStrike)", "value": "62d21804e79f0030553cdc8f86710b9fa3c88296", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488000, "uuid": "3460a63b-12f5-4b14-9961-7b17fad46151", "comment": "Malware payload (CobaltStrike)", "value": "7e954e449e79448c1874cab7b0a19111cf70af0e454896263d75553ed3aff2f9885e3e9c04c2b8e6fec3ee0439c4d01d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488000, "uuid": "0c364d12-954d-466a-b33b-c72ad0dcdd0a", "value": "T15724CE79880C38AADC66887B76454AF1CD9CA4CF0415493A0DCFACEEC75C6994A0FD9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488000, "uuid": "a42490e7-bfa9-4d78-97f6-d7cc4af82ffa", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488000, "uuid": "512af60d-e50f-4926-8764-c551c8bcfacf", "value": "6144:FkSxotDaZXrOXhSOstfidqTuX7qT7YDRKk8AYF4sOEt:aSxotDaUYv+qT6k7QRK5XFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630488000, "uuid": "038978ce-784e-453e-bac7-27563d187c37", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630488000, "uuid": "03e76aa4-ae92-488f-8b56-1fc39ae4df4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488000, "uuid": "f1c5412c-7548-4505-be35-b3c972bf36b4", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e60a77-0b09-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630489555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489555, "uuid": "6297796f-72ad-4c5a-8a8f-d056b45467d0", "comment": "Malware payload (RemcosRAT)", "value": "9ad6073a6250edc10c175ab08599231c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489555, "uuid": "8c08b5d6-52b7-435b-8311-cceb228eb1a7", "comment": "Malware payload (RemcosRAT)", "value": "864fd8b4649eb6987b523f4d1f614bf560f9dd7edad1244312847a3ace52ed48", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489555, "uuid": "76dd0338-1244-4913-bb39-844a66050d49", "comment": "Malware payload (RemcosRAT)", "value": "7cb89c5c7fcc22491553f8c9cd2bd7ac4d3f1a42", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630489555, "uuid": "8247a09c-a2a6-49dc-933f-12829f63750b", "comment": "Malware payload (RemcosRAT)", "value": "b6822ce86f7d0c302876f86ed83c43f2e2441aeb6d673fb03973eb64e7e280e89cc01717df5832cc17f1dea731d87ad9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630489555, "uuid": "de97dc29-80d0-4867-ac69-898c8737fce1", "value": "T10FE433C1D4AC6F90F6F8FBFB51C1A728CA217D9D76CEAB044E66828850FF056584D68C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630489555, "uuid": "9e380605-152a-4caa-bbcf-042aa04249fb", "value": "12288:+jCfBTfCN64nv3i/h2kdRWlrym61MU3W8Bj6vpDCeRvVdn6asV/7w2owPo8dPCKf:USBTqNbnQskalr8B3nxeVZsV/7wBuo8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630489555, "uuid": "74533baa-cdd1-4c00-9347-e25eba1d7a45", "value": 697064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630489555, "uuid": "64a6af17-c97b-490d-9103-ef45e00d3976", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630489555, "uuid": "228f7ade-9c8f-43f2-9abe-3ecb8efe027c", "value": "CV Tarek Yehia.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fefc0ed-0b20-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1630499448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630499448, "uuid": "573a488a-1b59-4c06-b09a-e0a7ed098f0b", "comment": "Malware payload (AZORult)", "value": "c15e14c3d2754f39fb12586831d1c5f8", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630499448, "uuid": "8ea71f80-2729-4dff-9456-7a73d2a4009a", "comment": "Malware payload (AZORult)", "value": "866444d9139177a3c6dc187dccd1629a48b402c6ee401075c13d51e6224cc1ca", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630499448, "uuid": "f322c757-3f7a-4dfe-8959-aaaec3cfcb05", "comment": "Malware payload (AZORult)", "value": "5db81b8e550ac1c91161927715484cacaaa323a6", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630499448, "uuid": "4c061c50-12cd-4169-bfc3-92e9f9e339e5", "comment": "Malware payload (AZORult)", "value": "79564b2a49ef9c2330aba630681b16ab933addc6a0e32d1359067929e8725fef99ff2c5bcfdaa916d3f26292035f5a21", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630499448, "uuid": "30253e8e-335e-4dec-9b5c-a7afd350e6b2", "value": "T143D4235588D48CE2F726B33280738ED519F975338CD16B38D354E92E78B0287A89396F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630499448, "uuid": "8b615061-dc2b-48a3-a5e5-093a37b4a26d", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630499448, "uuid": "8456759e-3f15-4c22-8e00-20ee36225195", "value": "12288:iXe9PPlowWX0t6mOQwg1Qd15CcYk0We1rgGkOiEWBp7eIh8EjnbArUUmMv:3hloDX0XOf41iEI7QYnbAhbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630499448, "uuid": "c8db98b8-da85-4cb3-bf83-9ee905b902e0", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630499448, "uuid": "670015da-109b-462b-b70b-881627ad3102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630499448, "uuid": "3826828b-212a-4716-b2e0-07ad71016771", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44295fcd-0aea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630476182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476182, "uuid": "1846d01d-7946-4e3c-8480-a9b9abeb006a", "comment": "Malware payload (SnakeKeylogger)", "value": "5b8b42771a665a91e614b503473e29db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476182, "uuid": "072cde32-f28d-4060-9057-6004709cada5", "comment": "Malware payload (SnakeKeylogger)", "value": "88fb6e9f1807b8010816165def64d336f7097517dfc773fc3ab39ff9868cec18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476182, "uuid": "e90b7f1f-3f4f-40fa-aea1-450ac008b478", "comment": "Malware payload (SnakeKeylogger)", "value": "e09c202012f32202a38de1dfb3e27510baf8b2ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476182, "uuid": "e6d9548d-3feb-4d3a-bf64-92ff21959531", "comment": "Malware payload (SnakeKeylogger)", "value": "4213b7eaac40fd0185c03c7d4173925a40e702350751dadb6bd1f34e76d479654ca64bae890c16507b6e56d6a6c050e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476182, "uuid": "fa59572a-3d9b-4aa8-b308-66f74e68b00c", "value": "T1B394D05D7694B1AFC41BC976C9982C24EB10B47B930BE243946715ED9E0E6ABCF021F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476182, "uuid": "e753ceff-b04d-456b-bdc3-20bfbab4689c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476182, "uuid": "f0ce1202-d5d3-44ca-a496-097fbc7f69e1", "value": "6144:epqY5TtmmciJdopP337CErx0qAovC8o//M9XjQIK5OmpX0SMZiUvCW85larBJAZ6:a9tmmcTpf7Tos9OjX0SkbZcbD0jdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476182, "uuid": "b27f27d0-dd52-4171-9ca0-28c856ea2d07", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476182, "uuid": "ac732a6a-0977-4d4b-a047-c4ba600f80dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476182, "uuid": "f7642a93-3181-4b2f-9f3f-1fc43684d817", "value": "DHAIR00215986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a55547-0b2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1630504956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504956, "uuid": "170546c6-4998-4949-9075-36e0e61f54ed", "comment": "Malware payload (Dridex)", "value": "4865ff759e4cd979e67f2470b24272b6", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504956, "uuid": "67aca932-4ce3-4fae-bcaf-68b68f7c596c", "comment": "Malware payload (Dridex)", "value": "894d02dca84d511af9bdc59d39767ff96d4da112babe1c7c1e6efa585a82789b", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504956, "uuid": "91e0f983-35b1-4097-9ce9-d911b692ca29", "comment": "Malware payload (Dridex)", "value": "d5f8ba9c2f4d88e483b84b8dbbc80f7f8228cfd7", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504956, "uuid": "bf960df2-2a93-4c9d-b7b2-c61d355b3074", "comment": "Malware payload (Dridex)", "value": "c7a97b25a1168dffa32f527d82f36fddfbcb52568ed0cd6e4fe1c0e960d6bb9c6400c70f0ce85bcdada54712915a7790", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504956, "uuid": "87df6b96-2a59-45ce-890f-48cae3bf00be", "value": "T16014D067EE8704D9D2D704B0619A283FF75A1A17C538CE2EC5CAC70E8DB652250FE2D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504956, "uuid": "1d54f5e5-af2e-46b7-bfff-03c9eef5b910", "value": "186f1499d3d5ae3e8092b83cefdeeba0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504956, "uuid": "97a73f17-9748-4ba1-922a-a58ba424da74", "value": "3072:YteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzV9qM:cq7fYIHBZkTB6DWruUCOwjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504956, "uuid": "eb7ed1fb-2748-4c40-beda-c3ee20760707", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504956, "uuid": "489e386a-09a4-47af-89a2-1812613313b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504956, "uuid": "b12566b4-6a12-4437-a33e-be659b91ae31", "value": "stclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793aa42e-0ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630472405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472405, "uuid": "48d346c3-48bb-475c-bd68-1282d667fb26", "comment": "Malware payload (Mirai)", "value": "f17a94d9db16a7e8957bb96d23fac830", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472405, "uuid": "f06bd9c0-6e4b-4cb1-8482-aac135461771", "comment": "Malware payload (Mirai)", "value": "8994cd72c1e14c402f37b89304ba2680b79a3913532f2bd2e7852325e3b595a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472405, "uuid": "074de463-3a4d-4d32-9dc9-63788be27979", "comment": "Malware payload (Mirai)", "value": "ff8d81bc66b015cc09fe1d0c639bebf233608024", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472405, "uuid": "d5c68845-c7cd-4c18-9318-5968e8e1ebf9", "comment": "Malware payload (Mirai)", "value": "9ba9262168b2b7e28cd93b64bfaec8c4ef8a15b7ab3dbef99856bb267ef7e3380740483bf6be47e5eefa9da233379c26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472405, "uuid": "af857071-3e2d-42fc-bd14-9c6701587065", "value": "T1D0D34D46EA418A13C4D5177ABAAF02893323E754E3DB73068D186FB43FC6B5E0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472405, "uuid": "82a73e54-f47a-4718-ad28-d9935bcce502", "value": "3072:YMkobfbHsKe1C2Z9dNPe0gcpEMmZ9Br0aBEeM/93Pl0:YZobzHsf1C2Z9m0gcpEMW9maBRM/9fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630472405, "uuid": "a108910e-b26f-46a2-8684-c1103b925173", "value": 136843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630472405, "uuid": "64905f6b-fc4b-4a40-a8af-cdd45f3f2999", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472405, "uuid": "e401f79b-f7ee-4a5e-93bc-28c17bb4b60b", "value": "Josho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07cc021-0adb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630469921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630469921, "uuid": "b2d055e1-f263-4e5e-ae04-a8acc71a67a8", "comment": "Malware payload (Formbook)", "value": "ec9bc7cf247b5824c06b4a44912a9158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630469921, "uuid": "122aa828-ce11-4519-a326-91879f3fa21e", "comment": "Malware payload (Formbook)", "value": "8f20faa7f6518392ef652a0bde4cd71a1f693b08d633a6b116e1da4b8b9122f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630469921, "uuid": "e04b42de-000a-4170-abe8-0fa6122c29f7", "comment": "Malware payload (Formbook)", "value": "39da546e066a3e83b9d9c18a942cb18690868320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630469921, "uuid": "aa008645-a08e-40ae-9217-6712ece5f78c", "comment": "Malware payload (Formbook)", "value": "9a2ea69f90eb464de4f24e523b6e2703fdeba429a958e11a753005ba695c88f1610ccffe99026a9718beb4a451a36e6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630469921, "uuid": "e7436d55-ee3e-48a7-8658-6b268f6cc511", "value": "T1FEF49D85F54065ADCC1ACB319A36CC3096227DBE9A3A950D24DF3E6B3FBF29745110A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630469921, "uuid": "98a0e31d-4654-4f2f-990e-e670f04c5c3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630469921, "uuid": "1ed0326f-10e4-4da5-aa4f-06959f4a3470", "value": "12288:S5vxdHRnttFPo7JvYxADAg8gc/WRB2qEsIpMcMGFGocE6cHL01lWvGPP7r9r/+pj:StxdxttBoJH7JEnWcM6c1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630469921, "uuid": "91c07f21-dc09-481b-b7dd-19fb5761f365", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630469921, "uuid": "5598f05a-00c0-406e-9c34-1f40fe978151", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630469921, "uuid": "d7d21de3-16ac-45ee-b0a5-9a440f0d8def", "value": "Remmittance Advise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d608c9-0b76-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1630536401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536401, "uuid": "e8de00af-713a-475f-939d-68cef8c1bc1d", "comment": "Malware payload (Vjw0rm)", "value": "24228bcfaf2e821c314a0b7bb40e5581", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536401, "uuid": "858c3392-cdb8-497a-85c1-81691b7d59f8", "comment": "Malware payload (Vjw0rm)", "value": "8f321e7441a406a616e4b163eab96ee15310e16c5af51c2b24213ccbeb1cca4d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536401, "uuid": "d36f2b10-5f05-4ef7-8c5a-b40902fad43a", "comment": "Malware payload (Vjw0rm)", "value": "0d3de7fcebbb431673f1bacb4ab785915cea6e04", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536401, "uuid": "5833f63b-9a49-466f-8224-6f999fa0fa73", "comment": "Malware payload (Vjw0rm)", "value": "e42ae74770189204af2ad0a47715597cef1bab952f0c0bacd79e27976c90502aff9ceaa314e7839a0d5a9723b840722d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536401, "uuid": "3a6589bd-be4a-4736-b7f7-8f02fae6388c", "value": "T120C312C93B77BC70B7E7EFE0E87352579456040AA81CDDC6F3089169E910C7A6888B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536401, "uuid": "fdfe0f18-bc20-4837-8f34-5ab490c07c84", "value": "3072:R64WZZTCCQj1crqrApp2V/KCpDPCQokQVsq:gZTCCccrwAGV/KCpDN/QVsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630536401, "uuid": "c77d9ddd-10a3-4862-af26-3d793e070d8f", "value": 127930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630536401, "uuid": "75536715-f0a7-4893-abe1-aca7090d90ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536401, "uuid": "1e38ebfd-3ebc-4fdb-aac4-1bed0b8344a2", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6594af-0b7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630540303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540303, "uuid": "27e34cee-b972-4949-bd58-79b80adb7478", "comment": "Malware payload (Loki)", "value": "19b000d55b249d12c7a0ade4b96865fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540303, "uuid": "624a4f60-bd9c-423d-8d07-1d0d84d7d223", "comment": "Malware payload (Loki)", "value": "8f32f4ab6f296834aada023487375844444faa005da968ed2f45302c9dc01664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540303, "uuid": "5a516981-8f18-4108-82c9-6da2f582d02e", "comment": "Malware payload (Loki)", "value": "d386ceeb1471f499cefc95523ee0d0ff2537689f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540303, "uuid": "33c10460-da85-4fd5-bee0-1ef16bb687db", "comment": "Malware payload (Loki)", "value": "6cfed034d7891032095f4ce0e345936f6b653e616528d2758601faf043f173d7be8837fb473108f9ad2862e217f758e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540303, "uuid": "bf627051-4444-4dc2-b41d-949547972d05", "value": "T17414F636B781F42EE482447DB909EFA55424393029A9C443F7C2AF1B78715EBDA25F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540303, "uuid": "13171eaa-273c-47d6-8cd2-d9e173ea3167", "value": "1ae303f9ca154f97154a83434ad1cdc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540303, "uuid": "df4df9b5-5674-4942-bd80-c049e95a182d", "value": "6144:owEfD/i1lkemVTtOASZNaEz2d17DnFcXp:WmetOfNI76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630540303, "uuid": "afd144ea-c7ab-41e0-b09a-638abd3454ff", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630540303, "uuid": "648460d6-0ef0-4fe9-b330-64a2017866dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540303, "uuid": "9135299d-63a1-4a55-ad3b-c6ffd380396f", "value": "PO 5800209777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62cf819-0b55-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630522329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630522329, "uuid": "1aaf77af-7700-430b-a05b-35c5876755ae", "comment": "Malware payload", "value": "651d07e7d9f52f908e60f3de37981a83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630522329, "uuid": "3d990ee7-9df8-4310-b755-4aa49cb233ee", "comment": "Malware payload", "value": "8f7184f1d5ce44854997187e8b846ebfe852e0a3779bdc88bf009e68a3afa1de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630522329, "uuid": "50015862-709c-4307-996d-4cfdeacca21d", "comment": "Malware payload", "value": "f121d72d895eecf399a4ce5b0f3dd9844899fd0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630522329, "uuid": "5a601a3a-bd58-4005-8b44-7a36fc5976ca", "comment": "Malware payload", "value": "0391f7253980c71ec1e919751a333fdf7bdbfe365591f3b257ea88ae8ce9e9e6f5ff579bc96be7bfcb4f7ddb1b548e64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630522329, "uuid": "1014bb0b-3a22-46d5-8b72-1684af78cdb5", "value": "T1F5F42C3E19FE2327D176C6E5CBE08823F2D098AF3133A96567D747664316A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630522329, "uuid": "960f6145-9973-4317-b368-323abefe22f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630522329, "uuid": "ab95d665-7ec4-43c0-b66e-b3516118a7a6", "value": "12288:aaBDSUy+QR39U1gIW0BhflxdlmF4v9Ov0q8b:e9Ce0Blbp1tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630522329, "uuid": "8c12b274-1041-415e-9bd7-192e2aa17655", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630522329, "uuid": "0f636023-7b2f-4b58-8740-f2d826f4018d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630522329, "uuid": "894e9bef-0c7f-4901-859d-742b7181b1b3", "value": "2947 NOLU TALPE \u0130\u00c7\u0130N TEKL\u0130F \u0130STE\u011e\u0130_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bf46a0-0b4f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630519562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630519562, "uuid": "cd796a09-5bf0-4a8c-94ef-e3ce332560a3", "comment": "Malware payload (RaccoonStealer)", "value": "da71f890d7072450dc55fc3c6c967559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630519562, "uuid": "c78b7dd2-59f8-4e5f-875a-8d83baec4d3b", "comment": "Malware payload (RaccoonStealer)", "value": "90ce71b329b36b4de9c965148987ee33ce0e2f6b7bcca1c571640b2cbbe54feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630519562, "uuid": "a1b4537b-f287-4f80-afef-c839de3a3fe9", "comment": "Malware payload (RaccoonStealer)", "value": "cc202f3c7e2a09e0ef33cbd3f74a90e787d8b351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630519562, "uuid": "83c438d8-9b3a-466e-9e43-7b60d788ce77", "comment": "Malware payload (RaccoonStealer)", "value": "532e21c30aac126c254337cf648daa8c242ea363bd4f6749ca26d85a1059e56beb1ebd5e6fe192e994f20a85e5f024ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630519562, "uuid": "79f65b2c-867e-4527-bdee-5b9c8518ad9d", "value": "T13554AE1B3280CA3BD6B606314E75DBF85A2EFC695A22C28777E1275F1EF13919712342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630519562, "uuid": "50e2648f-bf57-4490-b9f7-6db97482d669", "value": "6c24281dcaa86901b7166ae3ce878d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630519562, "uuid": "34abf09c-53f9-40bc-a170-47795dbcb05f", "value": "3072:RRD30OLTWRDC2qQ61Wr5ZoSREfHogITESfIymMHJ8atSMu8KY9wmSVgsCmbmFr:RNVLTWRD8EcSR4I5TEWIanX59EPCmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630519562, "uuid": "c5df5d8a-7e32-4628-8697-075cd06c3a65", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630519562, "uuid": "c1103f8f-47fd-4c6d-96be-74833327071e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630519562, "uuid": "3d8574a2-af01-4e6c-8f34-6834b1e375ee", "value": "da71f890d7072450dc55fc3c6c967559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29822722-0b05-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GootLoader)", "timestamp": 1630487734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487734, "uuid": "50e95211-6708-4422-8026-68b04b1875c7", "comment": "Malware payload (GootLoader)", "value": "f45a211098395e558b4d93a15787b9fb", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487734, "uuid": "b7d126ea-6656-4233-a295-d9dbb478f7fb", "comment": "Malware payload (GootLoader)", "value": "90cfe73ade8d89fbda5c9dc870e3988db0e08c579c214f807181568e463db68b", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487734, "uuid": "293dacae-9c88-4682-b664-a37e770b5fb6", "comment": "Malware payload (GootLoader)", "value": "729f52a8ce00f588c9a7a6483a1ec3ac682135c5", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630487734, "uuid": "9becdc93-63d5-44b6-8da9-0fb64ffb4e58", "comment": "Malware payload (GootLoader)", "value": "247f4a762e5f43e62382606f6e64151f7d9660a7af94d5c5ab686e3b3f949bc66b66b1ad0ad6243bb94b3271d30d40a4", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630487734, "uuid": "f8cf4961-b4ab-48b1-b35f-00ea4788e6ef", "value": "T12751D7C87065F2E898873FB0B70F6C39BCF23045CB684410DB4AD7D4592857E666AC8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630487734, "uuid": "49d6a7e9-c738-4608-aa05-d904861f00c3", "value": "48:nWHd9L4X2txOM184+WBKj7KyvmXvAY1m8H1iYkX5ywokb12bxWfHueIDzb3Q3zfo:WHd2XoABoXqt2AOLL6Kz9OYiWu7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630487734, "uuid": "dcd27c3a-519e-43c3-b606-c6723b7e8acf", "value": 2854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630487734, "uuid": "88168731-7f91-4d3d-ba79-feb73ac942f4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630487734, "uuid": "605f74c4-c2cd-40ab-8efa-a132ac209a17", "value": "tarifvertrag_lebensmittelindustrie_ngg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5c7276-0aca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630462591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630462591, "uuid": "281e2fd3-9789-468c-b75a-06f510b21bb4", "comment": "Malware payload (Loki)", "value": "93a53238e4fe3a7f65aa84f7b9089307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630462591, "uuid": "ea9aaef1-a23c-4ecf-97e8-e26267a106aa", "comment": "Malware payload (Loki)", "value": "914a5312ecfb619d4ddd764668bf30e1ee1681ce770dca3f60bd2698a420b542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630462591, "uuid": "34189e0b-51c9-4121-9c3b-c90f51dd6c76", "comment": "Malware payload (Loki)", "value": "c512c4b2dd66f5514b22271335f74ef5bcdce7cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630462591, "uuid": "b5544f37-ec6e-4d94-b579-01ae8955ee95", "comment": "Malware payload (Loki)", "value": "82a474fcaae55c4ef5a072c1635db044cc84f606e8c4c9173ccedc75d6578f06c9d4390b69d7b6466c9edb6372a4e8a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630462591, "uuid": "8619319d-2e30-4476-b673-aac3d91f8c2e", "value": "T18FA4D05D7260719FC96BCDB299A41C60AB21707B630BE343A45716ECAE0E69BCF051F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630462591, "uuid": "02d3575f-c54b-4a63-8c30-45b4adf70241", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630462591, "uuid": "b940be08-0dfc-45a9-96e8-442c8ecaad0b", "value": "12288:MftXXBknHdUFTxUkdHvoGAH3IeyFYIL+1:EknLk1DAXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630462591, "uuid": "5e0eb58f-4850-4a59-99ae-8889dbcf06bf", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630462591, "uuid": "e680c8d7-3978-4f71-a883-1f915dcde074", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630462591, "uuid": "2848e54d-04a1-4ee5-95d0-fee81d55f37e", "value": "PO770291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70aa89a8-0b48-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630516629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516629, "uuid": "82c52071-1184-4b77-93ec-bd05c9576b4e", "comment": "Malware payload (Gafgyt)", "value": "ce5d35a944372fe6d8631782011ffe2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516629, "uuid": "a72f79a6-cfa1-406e-b0aa-fd61f7615391", "comment": "Malware payload (Gafgyt)", "value": "919d3001c65e15ad3d6554f6d074db0d3d548d124fa18cff296a1cef26aa90b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516629, "uuid": "a6a5dd37-6c94-4eb3-ba79-965a38359e13", "comment": "Malware payload (Gafgyt)", "value": "231683c81f39ebe49df112a319eef2ba75b8a2a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516629, "uuid": "99e6a487-2e85-4310-bc45-63f23da4b75b", "comment": "Malware payload (Gafgyt)", "value": "5c03fb544eea238e10618a3b5861a845c43ad249745dd3df903271436b996ea70bb94e224faefbc8b0dcbd4ed1b41f47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516629, "uuid": "cf85d5fb-ae73-446a-a000-2845a6a3c348", "value": "T181D33B4AA4E45FBBC056B5B124AF6920071AE5920B2F1B96753C5AF4038F5CEB01FF78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516629, "uuid": "1caef86c-e2a0-4792-b8c4-b44c40bdb0b2", "value": "3072:xLtsxde4dxNQwXwXPJvTzd1Ldvq5hUPpe/kUHTVmxwVy84GYr6Fi:x5s9dLOJbzZvq5hUkhzVmxwVy87Yr6Fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516629, "uuid": "45ef4f88-2179-4219-91ed-1287253c3db3", "value": 140854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516629, "uuid": "2bd2206d-beaf-4033-8abf-d7fcb8a42a2f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516629, "uuid": "0749b3c4-d182-4f86-a218-04e1c1687f2c", "value": "ce5d35a944372fe6d8631782011ffe2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de798767-0aeb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630476870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476870, "uuid": "199b7c6a-11ea-4ef8-ad91-0c4acd825d85", "comment": "Malware payload (RemcosRAT)", "value": "29cf935bafff5bf4047f666dd4bc69e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476870, "uuid": "b04d307f-8bd8-4b9b-9a04-6b40485faf75", "comment": "Malware payload (RemcosRAT)", "value": "91e8ea3e431c0ad9faf6dfe01eb29e4834940054379deb8b657d9cbe23e91682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476870, "uuid": "8c295bd5-b99e-4cf1-b03d-b2e1ba3ea3f3", "comment": "Malware payload (RemcosRAT)", "value": "74add63778d6481dc4ac75bc31043a78dc0726c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476870, "uuid": "cdbe56d4-3a94-4e10-9ca4-4c0b236787f1", "comment": "Malware payload (RemcosRAT)", "value": "41f1625e151019d8686e01d64a3f33e923dbff214d5eaf30368472bdd87aca0d2ed5269b914584ae130fdfc467d6e80e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476870, "uuid": "f4004ad5-8d7d-4cc3-b420-2efb90f42f3d", "value": "T12C05231D48584C4EF622C539A0EB4F2F3E4BB602946D8B58A61B4F4CEDE27163792CF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476870, "uuid": "98314c73-dedf-4fbb-9e32-2b9639177337", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476870, "uuid": "05543cb6-9d4c-4f34-8ba9-8712ffee07af", "value": "24576:2hloDX0XOf4acOevCIhraMZ0JyWKtvGe:2hloJfbDevCuraMZ0JyWKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476870, "uuid": "816f2810-858a-4187-8325-77c2e72beaff", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476870, "uuid": "f4f90130-6b55-4eb3-9923-3af4ef564ee8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476870, "uuid": "36ded847-5f18-4267-9427-68c0f8ab7ad1", "value": "29cf935bafff5bf4047f666dd4bc69e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b8f7de-0b16-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630495299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630495299, "uuid": "ced793db-e311-4508-817c-bd67d69c62f9", "comment": "Malware payload (AgentTesla)", "value": "a8d09ffabff76ce64c3adf13a0831d34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630495299, "uuid": "bc5d8bcf-1eab-4bfe-9bf5-9d2b44e3d990", "comment": "Malware payload (AgentTesla)", "value": "9233f9077f989e8431fe678c79173c9b5f04c6ff68660fb2405ef0b39f5303b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630495299, "uuid": "bc7990e1-f85a-4b59-911b-6a0b536ce980", "comment": "Malware payload (AgentTesla)", "value": "a3d113195e1db3f4af387e3c1ffe886b82bcf9da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630495299, "uuid": "bf61e9ac-6792-4bd0-887d-d806a0f12d15", "comment": "Malware payload (AgentTesla)", "value": "10e641a8cb1f80f5889dd352a1605ac09bb0503594b4d26807eac217e0a6441efe4fa4fe67808d3478e8bbca8566e307", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630495299, "uuid": "af545e7e-e42a-4531-b4ef-c4447a988731", "value": "T1B2B4E05D769071AFC86BC936DA642D20EA61B47B530BD307A05366EC9E0D6ABCF110F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630495299, "uuid": "66e0fddd-7fc9-48fe-a74e-7c18ac2e9737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630495299, "uuid": "7c097f69-11f6-4308-8d43-be3a5a188767", "value": "12288:fX2s6KOyaMEne1+Z39MCBqP3J8kb36ymQX0MKaJM0KDNGSB7:fX2s6Kzb10BqP28yZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630495299, "uuid": "8cbdc82f-5593-49b6-adde-5056f7435af0", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630495299, "uuid": "d3196bdd-0941-4924-97db-4a8d61b35c11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630495299, "uuid": "fd03ad9c-670c-45a5-bb9f-56a34b779904", "value": "PO-2021080198823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b49dbc1-0b61-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630527411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630527411, "uuid": "951326f5-b819-486a-b2cf-c01de67999af", "comment": "Malware payload (AsyncRAT)", "value": "3e5ac17f75ec0412788648686bb2faa1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630527411, "uuid": "37553ff1-6578-4f50-a40c-3662a9187041", "comment": "Malware payload (AsyncRAT)", "value": "92d244554671489e469aa000c0a2bb2e5483ed5e30858c4a0f9a745532c19a07", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630527411, "uuid": "bc16de85-3c73-4355-8ef3-a872752d4248", "comment": "Malware payload (AsyncRAT)", "value": "c82fbd8ee2713d16fa377d014327f7be5e2e8943", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630527411, "uuid": "bdc25a7a-4603-4d02-ace2-c39153366717", "comment": "Malware payload (AsyncRAT)", "value": "35991af36f2603642e67ed83cc379c0f1ca2b552eb07f15ae68a7501bf91b106d97b08fd3d2931d9a67a8c3088084e89", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630527411, "uuid": "6cd089bc-f9a0-46ca-9e0a-c477aa7754fb", "value": "T1E5A2D80823B8BF53E1FE53F55AF9A61043F2656B74A1E6480DE190CB0E76F084A91F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630527411, "uuid": "1cda8977-6a40-4324-9af6-f92e4322dafe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630527411, "uuid": "5d00fee1-f195-4ced-9e5c-70f9c9e703b0", "value": "384:NjDvIFyeXu6PV5M0ZsW7ZGtIzU1/x3MyD65ro51ZKhwl:lQGtMUrJ65851Yhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630527411, "uuid": "8fa8ca4c-44ba-4780-a773-13a25c708f34", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630527411, "uuid": "3a728b51-2fae-43de-a3e0-5e8123fbf484", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630527411, "uuid": "e20f1cac-7bd2-48b6-a93c-3b07e99689c0", "value": "New_Order_PO#960780_MT_Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc9efa4-0b53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630521455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521455, "uuid": "64be0b09-1b03-457f-abea-7f23462c5eb2", "comment": "Malware payload (Glupteba)", "value": "509c128f8f1d1e659ce5b8cd2fffdc0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521455, "uuid": "2e36c455-7cfd-4c0f-ba80-8195728e99d7", "comment": "Malware payload (Glupteba)", "value": "93ce6999d6249ff0b1cc363e50b91886fc87f832dbf819c33e4a7c9f01fbb431", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521455, "uuid": "976d96ce-41c4-4e73-8653-42c0c988e9d9", "comment": "Malware payload (Glupteba)", "value": "d72b0b6208f22ef5753202ae8677ae2395f744bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521455, "uuid": "7e54051b-ac7c-4a24-984b-8dcf2842dcb6", "comment": "Malware payload (Glupteba)", "value": "6560fb2bfaba7ede210886b564a49f3d98f21f073b41079d36f8af953f2414584f3c380183fdbbdefdc311253516e337", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521455, "uuid": "6c799ebf-c6ee-4505-9712-9ac514ddaefe", "value": "T10226337F3604DC36E96802760C2CDBB79DA17CAF8E52DD8577E8255F2BF1282A712610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521455, "uuid": "9dec4aaa-50b9-475f-8218-11f43ab8bade", "value": "6c24281dcaa86901b7166ae3ce878d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521455, "uuid": "d564589f-eb8b-4801-b1e1-533e876dce07", "value": "98304:rwJUj/cXGt2L8cUsaMVXZJowRFipdCyz9iv6itkCkrpEqkD19Ir2JAZJ:WGT2hzXZeZz9iv6TJFhk4rk+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630521455, "uuid": "8bf89161-f451-45dc-b457-d91fb3f024a9", "value": 4707880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630521455, "uuid": "202f1024-f53a-4717-be18-b09ab01c4a5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521455, "uuid": "0d96cf58-ccd4-4c25-842c-38fdd286833d", "value": "509c128f8f1d1e659ce5b8cd2fffdc0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbffc715-0aec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630477242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477242, "uuid": "b3556829-df84-4817-8c4d-d8a86c7f92b5", "comment": "Malware payload (AgentTesla)", "value": "08abbbfcf4b77329b3e22cf54a8a23c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477242, "uuid": "20c7d910-f32f-4048-a783-19c5fa50703f", "comment": "Malware payload (AgentTesla)", "value": "94fbc7b80a8c430535a8af0614d1ac8703d308376ecfcd11983dc0874eda7908", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477242, "uuid": "019f90eb-8a57-462e-b7ec-0a5f66efee21", "comment": "Malware payload (AgentTesla)", "value": "52e2165a76d10db9648488136f8aefb624208f08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477242, "uuid": "02ef1701-2c7a-4cdf-b4bb-c878faef28e9", "comment": "Malware payload (AgentTesla)", "value": "5475c5b33f4b6e8e8c10dd25424e6e2c692287d6ee322af6a5018039a5ac5583caae314d60021d9e48d79acf58058b5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477242, "uuid": "0b00e7ff-ca08-4c41-8c2f-59312f13c31b", "value": "T139D4CF89F640618ECC1ACF3585751C2093537C76AA7BA20F945B71B8AF7F1C78A224E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477242, "uuid": "6b1a773d-cede-49ed-ae6f-1029a173ec7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477242, "uuid": "e7d53ed1-8688-49f4-9d1b-c1934f92530a", "value": "12288:Xtq/+cwB5mtdH+eM6TwzeJO3u1+kdrj7IEZ8zuaId:IDumtpD0yJOor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630477242, "uuid": "42338f2d-b84a-4a29-a9c4-e6bacc44660c", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630477242, "uuid": "d2cbb31a-e958-4579-a1ef-a71c29a86c1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477242, "uuid": "6ba6245f-04ff-4ec9-aab6-f9c7e96699f3", "value": "FARIDA HCU2343ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93da448f-0b26-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630502085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502085, "uuid": "04eb1e9f-ff4f-4116-a91c-d72ec3cca897", "comment": "Malware payload", "value": "fb273c1f727fc086a5a094fe0f540a89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502085, "uuid": "24043ade-f883-4ca1-bc93-a60adb17ca20", "comment": "Malware payload", "value": "95267c6b97f6d4561cac296381ad3f649ed15db7b12a10502e9662f33fa17db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502085, "uuid": "93fce116-99f4-416f-b583-d94f1f53d53e", "comment": "Malware payload", "value": "08f03e2074b33732a572bfb3d6afdc04ede7e87d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502085, "uuid": "f231f81c-bd0f-466a-a83b-32a38b1d5754", "comment": "Malware payload", "value": "2df9760421cd3832e13785b0f4d9d4b283af077d2f2169230e70cc5975d2bebc0ff16837a83889dc9d44163962336b46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502085, "uuid": "592fbef4-a493-4b1a-b19e-42a9eeec424d", "value": "T13F72060633A8077DE3E50DF08B6167B4C126F2215A12D60A7D8232D67E2BE1E8CD3778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502085, "uuid": "be097019-28f5-4e53-959b-7e819dfd77b8", "value": "384:+okCDHV3Iu8Rlm0ELvZm3HIOIuB0xOf6IK:/J3n8Rlm0ELBqfX+s5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630502085, "uuid": "d825e741-6cad-4b45-82c1-5f147dcccbb9", "value": 16484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630502085, "uuid": "15d445e1-47d7-4f47-83c6-34fbb54b6340", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502085, "uuid": "fd3e4881-3c6a-4d6d-b32c-bba304c0539e", "value": "lnk-decoded-5.exe_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e422ab10-0ae9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630476021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476021, "uuid": "ac82e7a7-03f9-46d3-8595-1b004c65bbad", "comment": "Malware payload (Formbook)", "value": "4687367e47aef2eaf8e4df70c1e39553", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476021, "uuid": "91fa28f9-bec6-4c5e-9354-e63b722bb2d2", "comment": "Malware payload (Formbook)", "value": "954ff60aa2edd186cecb8f5bb11ec77cd10c4bc46ef49861434477439bffa088", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476021, "uuid": "1b02dfa8-18e8-41be-95df-4387bdf50726", "comment": "Malware payload (Formbook)", "value": "5be9db64aae257077c26075c5c36c9a6eab4fdbb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476021, "uuid": "7980034d-aecf-4408-b4e5-85f74ac1fdbf", "comment": "Malware payload (Formbook)", "value": "1fd52cb1ddc092bd8ef4e28d4c9b490c5721bf8a9d91fc7b2f6f39f1d6be629bc52288839ee0a779f98c9d6b9794c0e8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476021, "uuid": "7310f63c-ec0b-4cd8-bd17-3b941f228e6a", "value": "T11306AFF875047DE62A7F576BDA96ACDC03B61A239ACBA4CD806477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476021, "uuid": "6805436e-eb78-4d54-bbce-6a3bb13a12b2", "value": "24576:Ll0FyKgF464UbpUa31vsh4SIlyHpJISVniXA0qapHLPRxQOBVrqgQI2454aVJ4LP:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476021, "uuid": "35c8bc45-adc8-4f7d-ad6b-bc6c9ed69bf8", "value": 3812836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476021, "uuid": "b40984c2-4050-44a3-9df4-b2c3038e66d3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476021, "uuid": "e8640396-aa56-4350-824b-492d67be567e", "value": "BALLANCE PAYMENT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea356f8-0aeb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1630476629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476629, "uuid": "f328f5ac-0ae7-4e3a-908a-064960735d92", "comment": "Malware payload (STRRAT)", "value": "fccf9ac7d9db45ce6dae839ab0660a28", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476629, "uuid": "5a497b0b-92dc-4048-81b2-7a97cf0c3849", "comment": "Malware payload (STRRAT)", "value": "968ed5f5fbf0b4666905b104eb77371942716fbfc2e240fc2c7eb4a99a9265c2", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476629, "uuid": "6bf33af2-acc4-4613-ad2b-eee0c665df8a", "comment": "Malware payload (STRRAT)", "value": "ab408309380f26dac93fb1aa81e8da7035fff8be", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476629, "uuid": "11ae5c78-de30-4b6f-8cb9-3acfe8fae317", "comment": "Malware payload (STRRAT)", "value": "6753ba4eb7655e0cb4bd3c692f22cefdc7abba5c993c522d811c0bfb358466924f2a3acb93cff3302495aa93aefa22c7", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476629, "uuid": "abc8cf85-471a-48d0-93c5-a334909cfc2e", "value": "T133639C753E0BC084D86B7EB8B3C9B97435040E7765D2E53E08845DBE21A9FC2126DDAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476629, "uuid": "49013240-5afc-451e-b95b-d6ca9452640a", "value": "1536:29LKBLo0CLRyt7VrolmSb4wjE7zF0Rhdv1hQzMrTeLAD:2dw9Cd1Lb4GE0DrTekD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476629, "uuid": "eda480d2-b611-42a9-8bc6-51952c5c3b6e", "value": 71416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476629, "uuid": "a94fe8c6-19a5-402a-99a4-81cbbdde498e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476629, "uuid": "a5ff5a32-e9b4-4b4b-998e-8b4985ab01ec", "value": "invoice order-9951487307#..xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011f3a78-0aea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630476069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476069, "uuid": "fc291e6c-b311-43f9-8d3f-2f0437c4cc66", "comment": "Malware payload (Loki)", "value": "a50132e486f63219611ad880610a24aa", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476069, "uuid": "6b86db18-cfce-434c-b398-0859bec28075", "comment": "Malware payload (Loki)", "value": "970aec442d2f980fc04857d75e5b239f83a14634dcbed1fa66f0d4e664a9a16d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476069, "uuid": "9683aff7-549f-48c0-9742-d96d46b5ccc2", "comment": "Malware payload (Loki)", "value": "e22ba948d161a6cccd1ee1596061a20753217a0f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476069, "uuid": "4a7a746a-a089-4f2e-a3fe-56b8a7815841", "comment": "Malware payload (Loki)", "value": "dc4668257d1af0cc97c3fc5cae54883d5bb392ac4f782d1ac431fe8a89c1b0ce25b12021971354fe7227dd1e94af7186", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476069, "uuid": "68dc62ff-6cdb-4ccc-9892-3466533ea77d", "value": "T15D45124F63520F2BC1E9C8B4AB894A1E85FCEC17942E49C3EE25724758B3F512B49E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476069, "uuid": "148c8eb9-f1db-4347-8a7f-db52710bccae", "value": "24576:leFt9xoJ4AgRP0j4lu9FoAIAghtF6qWPKBAXV2o+:22yA4mojzFuPFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476069, "uuid": "f1ff9d10-8cd2-45c2-94d2-fc8aecdc188d", "value": 1268736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476069, "uuid": "5ba80fd1-78a5-4a36-a5e8-a73b3f7f5f4e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476069, "uuid": "9408d624-bee6-4ae8-9379-6aebfe84a96a", "value": "swiss.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2895ec28-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630482578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482578, "uuid": "fd027497-6a15-423f-819a-0401f275f984", "comment": "Malware payload (CobaltStrike)", "value": "04e32ed36140895b4f855b8487e74421", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482578, "uuid": "e9242189-e83b-4ab1-a3dc-155ba16ffe68", "comment": "Malware payload (CobaltStrike)", "value": "97fbb35c5073af391068712aa31992c2d6d174c8c297baef188d687fe6f4fd62", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482578, "uuid": "2b6d238a-a4cb-4102-ab51-a54e3c86ea10", "comment": "Malware payload (CobaltStrike)", "value": "609d820dfbc5cbac4fa30b138f27b528c499a4f0", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482578, "uuid": "c6d734e5-9d06-4652-93ba-92b6d41b5fe8", "comment": "Malware payload (CobaltStrike)", "value": "411f72f3df3ac61296c0c922ef3a523a6f2d0835a8b22d87e4940151eef3530f8d95c68ec2fb02641fc62cf108d9c700", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HasCred ApS", "colour": "#D0DE8A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482578, "uuid": "122a727f-c8b5-4d2d-943c-f86ed7a83185", "value": "T194556C1578E144BBC9AEE2304866E2E136357C6943393BC71E9569ADFA71BF02B3C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482578, "uuid": "95499c15-ee61-47ad-a59b-449eccc4123c", "value": "2869cb885758b15d003acb119f131468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482578, "uuid": "311f83e5-6d47-41d4-93da-0d6205b4a064", "value": "12288:uPddKVO4kguV+5j5HJ/QtlTp40t0rWVHFES9teBGW0XcOTuj79PbNJ5kkfsCOQRE:Sddbr0HJ/STpz+M1WAIPo/IyXSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482578, "uuid": "69ffe556-ab88-4507-8d2e-96f3024f0643", "value": 1286112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482578, "uuid": "8a26e464-683a-461c-b352-9d7c71b3b386", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482578, "uuid": "e2044d97-834b-40b2-97ab-dd6da66cf8d5", "value": "97fbb35c5073af391068712aa31992c2d6d174c8c297baef188d687fe6f4fd62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9c5ffe-0b2e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630505667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505667, "uuid": "0552920f-5300-4395-ae2f-ab7106d1e0d1", "comment": "Malware payload (AgentTesla)", "value": "41b0ce69b84e80516810f0154587f539", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505667, "uuid": "c7182746-58d0-4ec4-a1ee-446f59645b6c", "comment": "Malware payload (AgentTesla)", "value": "9a065e7ac958ecf728cee5521723da7d6dce2e08184701ba88955fd5b16b8e04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505667, "uuid": "67971e04-ed1f-463c-ae7b-1dccd261fa4b", "comment": "Malware payload (AgentTesla)", "value": "9bc0fcfbe5e24841c2925a2973458d4a568bb4f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505667, "uuid": "a3426a6a-bea3-4faa-b63d-50b1b3440d18", "comment": "Malware payload (AgentTesla)", "value": "ccdfe823cac1cf64cef709987dd1c504842c82d565eb6bbb768f4f2230f1dc48e7234161131e02bbbb29973ffb6bcd0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505667, "uuid": "b2ef12ce-f21e-42e8-a9ce-fb8a8a7841fe", "value": "T1BDA402C3B400307EFAF6C577B8E5497551A005765C574A1E8CA03FA3BE2251DABE8EE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505667, "uuid": "5936512b-1afa-44b2-a1e3-3e9ee6e5bc20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505667, "uuid": "864c0eeb-afd1-40fc-b89d-ff642494966a", "value": "12288:NGU7lLvCs7MyV1Uk+RyCW3f4dlH1lSIS:DvCaMS1NwyCW3faAIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630505667, "uuid": "45c9e5e7-d29d-475a-b8a4-38db1c390c6f", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630505667, "uuid": "53695450-4d7a-4220-9d1e-f6ec304efb0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505667, "uuid": "a21be8d6-1db0-4e37-84a1-57b55edda58a", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350d1aeb-0ae8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630475298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475298, "uuid": "01f8742a-19b1-4422-a282-cbecfb10dfc9", "comment": "Malware payload", "value": "402dbe1be2a63a14216807c1573f2e2f", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475298, "uuid": "fd9e1201-7800-4f05-b022-017fe7aa0889", "comment": "Malware payload", "value": "9af373f93f8f6f9feefb9270d56dea51d8b5e134fe9afa8552d6b8d00c8ee89b", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475298, "uuid": "bc34a0fd-2dbb-4e1d-9ea7-cd36a3496810", "comment": "Malware payload", "value": "93bb42f0d700a7513a27591f22837ac36b786307", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475298, "uuid": "ddaa89eb-98dd-47ea-b713-11dba3dcd075", "comment": "Malware payload", "value": "04885419f21ff9bedf836a1d1f428b484f043744a70216dd021dd5ea7e4bf6cb6b03532f281416bb0b3346af96cb5d1e", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475298, "uuid": "61faab9a-be74-4af8-9b0f-d95dc5f43877", "value": "T1E844E093C3800C4119F37222963EB69F4975FA2A25671F1AD78FE18612F65960FBB03D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475298, "uuid": "7a04a51e-c661-4d1c-b2dd-1af3901c7bb0", "value": "6144:EBwbrk09u8DZ/kJLL3gVWVF8CY1Hw/aVxRfw70ruuOfw3B5nxM:wwbrkmu8DyLLjVF8Cr/Yrw70ocB5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630475298, "uuid": "434e074b-1cce-4a0f-86f0-edfb752f455a", "value": 263239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630475298, "uuid": "da706bf6-b494-4cbd-b5a1-2f72b451d8c8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475298, "uuid": "9b42ff5a-6e89-4765-82eb-8bd65c8e07f3", "value": "x64_beacon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b56266-0af2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630479667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479667, "uuid": "75e3cfdf-4574-48cf-9e13-65b520ac5b62", "comment": "Malware payload", "value": "31aa53560e3a13222199e38e1098f10f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479667, "uuid": "8710b13b-0146-45c1-8bcb-56191f2ca192", "comment": "Malware payload", "value": "9b09828bd53574f3c86d70942dcc5088daa891b6b355fc5dafac07987bc2b413", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479667, "uuid": "306c7041-6ccb-4af8-9c81-2b0016a9a62a", "comment": "Malware payload", "value": "3676c0c80b00a0a07d40726616af358b15f11ac1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479667, "uuid": "0f17b2c7-8ac5-4aac-b8a7-31a61e0c9775", "comment": "Malware payload", "value": "f1d698f5092bb4435e3a80cbf96c4fe4f11e82af9ce321d54bc9b2e2fe4078f9d4bef150cd1ddf8d5fe8ccf7e962031e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479667, "uuid": "4033e30a-90e5-4f23-b8f9-0e90ec32f49f", "value": "T14BB6B695EB3FB3C439E65287D34EB2B9C9078A7BD5E960C51A919F838261CC3DDD8801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479667, "uuid": "88583f10-b7bf-48b3-80ba-85a533218a93", "value": "49152:RfONJ1anL4a4W+HxAsNyDe4yxF9Iu8nlBI7sOfNl60ckqtd5n66CUZhJrKyqoPAl:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630479667, "uuid": "b8bf80b7-a0c4-4677-bad6-a3d302c24db7", "value": 11130970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630479667, "uuid": "6d967f07-fa12-4d7c-b4c8-b2aaf8310fcc", "value": "application/csv", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479667, "uuid": "baa1e74b-c306-4ffa-9cf5-4e3b540cfff0", "value": "2021-08-25T09_04_39.808Z_TLP_ALL_(ExportFileCsv)_Stix-Cyber-Observable_all.csv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67c4b1e-0afb-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630483756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483756, "uuid": "f5a57165-aded-42ee-bf0a-40c771441e02", "comment": "Malware payload", "value": "bd0881aa4565c736a489f5778a8b3eef", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483756, "uuid": "9bb9e774-4b94-4313-a39b-9fd33abca597", "comment": "Malware payload", "value": "9d2cd9848417c12f38eb5572eb7303ab06b63cbb48339e3cda7c9919fc2e8469", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483756, "uuid": "727145a0-f583-4d77-bb79-acde7092fa5b", "comment": "Malware payload", "value": "5ff4e92fb6a6521bcafcc86cd4cc9150cdae2875", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483756, "uuid": "ba610b3e-3640-4ba2-8072-45858375c852", "comment": "Malware payload", "value": "d79365e3e2691095cfdf9d321561ce1fc8e0542b1689e60e5160e6a7d9cf864bd5fa9a37e49fb05d45178a8a16b141a7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483756, "uuid": "2184946d-a12e-4a71-ba0a-893e10f46b36", "value": "T13F0633C6A9D9793B98715D074B072DA21DF5BACF61E26EF302F2C4052DBD30899D90E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483756, "uuid": "af998af5-5eab-41f6-aad8-4f9c6388a3ff", "value": "98304:yLjo6YnfXdg/iYmcr/zWf/pPH8ePRBczoW/TQRiRLdfDxsR:YjjUq/zufdPRoHTzRLdfeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630483756, "uuid": "995cca0e-675d-4c67-b159-4b3a0d64f8af", "value": 3824626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630483756, "uuid": "30d58a6c-c6a0-4be4-870b-22d63842f53f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483756, "uuid": "b43540a7-aa61-4879-b35d-22ed21c337ec", "value": "190e0ce36c1a63ec976f7e80618c620f75f853a370ea3e602253a98781f4e5c6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c66d09-0b2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630504884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504884, "uuid": "980e1a1d-61f0-42dc-8347-05ab1089e8bb", "comment": "Malware payload (njrat)", "value": "7ab9be50e69390506c4ccc32fe58c4e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504884, "uuid": "bec6caca-21a9-4d5c-adc0-8d1da613d679", "comment": "Malware payload (njrat)", "value": "9de8e8b8966f59a105a3d7d210075bc99535e9ba996946a4bb00f61118c49c92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504884, "uuid": "98205ff5-6f24-4935-88be-c8c57e6e8edc", "comment": "Malware payload (njrat)", "value": "af4972e56e140762ff2d2162d9ae8f3144fc34cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504884, "uuid": "4ab2d281-08d6-4971-bc11-ddadac9ffdb5", "comment": "Malware payload (njrat)", "value": "942d9c36723654cd58ce909cef27931b0709f9d66f9da7c0e24d51bae3abb9b59a4d156f90842baffe54916b2108dc2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504884, "uuid": "091af0fa-8688-42bd-ac0f-bbb40651a261", "value": "T1C814D71038FA523AE57BDFBA5AD060A58B7E7F22331BD56D1CD232D60663B409C81837", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504884, "uuid": "40544b6d-45ea-4845-a247-d297143b9a05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504884, "uuid": "0a2283de-7e3e-49ce-af25-453bcf658129", "value": "3072:xzdKOyuvC6q4+sxv3inZ99urGQFcnzi/fCGJQ4KRCdVsSQ5euzg5hOIEQYuWLX/:FqFnZ99urGQSzDFQdmRg7WQYu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504884, "uuid": "66d44f82-6bc3-491c-b4c9-d16a73a4af31", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504884, "uuid": "23249709-5df4-4418-8cbe-4612b6209846", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504884, "uuid": "02cfb052-c3c4-4906-930f-eae2165b0821", "value": "9DE8E8B8966F59A105A3D7D210075BC99535E9BA99694.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924077dd-0af5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630481037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481037, "uuid": "e347ff37-9c44-4136-a49e-c8a6c0d25ce3", "comment": "Malware payload (AsyncRAT)", "value": "f805e0d740cfd22eefcdbfccb2ba7d2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481037, "uuid": "10a2cde1-b767-4afa-942b-324e8e298c16", "comment": "Malware payload (AsyncRAT)", "value": "9e8808badd0c31ea5e0168a0de776ad797d48f72dd2116447ffd901ed6c42d34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481037, "uuid": "633f02da-88f0-4cc8-87a6-923647ca0f0a", "comment": "Malware payload (AsyncRAT)", "value": "36e4a52409e0a95b3b43c6b86ff6ac2ceb09e583", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481037, "uuid": "1e67bd4b-3f55-409b-aacd-47810464c077", "comment": "Malware payload (AsyncRAT)", "value": "63918808a12320a895ceec1ea27820194e1b874591d31cb3b731f9632e12daade2576c9d9880fff6489176a0c86d5fa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481037, "uuid": "b32e0449-6293-41ec-8a88-de1f7d47417f", "value": "T14E84CF5D7254B2AFC52BC9769A642C20EB61B4B7570BE203A45315ED9E0DADBCF020F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481037, "uuid": "6425052f-3e54-4f0d-8999-a2c97407b9c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481037, "uuid": "050e783d-469a-448a-a6cb-57f25c15c56d", "value": "6144:T5gL52qKQ6ahnJpxZJCPB6zhi3txxTjPXt2B28ustxcte+SqG2106OwO0HaxD4:+F9F5NCPB6zo3txxTjPXts2stxc0FqG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630481037, "uuid": "42a1715e-7687-4c97-9686-dd745097c582", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630481037, "uuid": "cdc53390-0ef6-40eb-9264-8db59aa94379", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481037, "uuid": "d02f8fb2-00e6-48e5-9725-3de3859441a1", "value": "f805e0d740cfd22eefcdbfccb2ba7d2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b019e5-0b38-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630509653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509653, "uuid": "d5ef08e5-f94e-4594-aa4c-84f742ef7490", "comment": "Malware payload (Formbook)", "value": "2aee5ea79b9327ec85da89421b92d219", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509653, "uuid": "acf8f088-d0a6-4009-80c4-c8046e847ac8", "comment": "Malware payload (Formbook)", "value": "a03553c928c61ff148b7440e8dab61dc7eac554f576a35d9418f438439cc18d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509653, "uuid": "7ea51efc-6440-4845-8f41-d69a27d08e25", "comment": "Malware payload (Formbook)", "value": "4f20d0608bfd3d10a8ef00ed65d9cf51387c4e00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509653, "uuid": "da0a6167-7517-45cb-9d6a-f74130f154da", "comment": "Malware payload (Formbook)", "value": "52ed972bdae9cd1bc5b1b11afe7781777d3a6a2acb0faf8bb85ca73523b0271363922523e2bc20a99f074ae2a391c7f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509653, "uuid": "883ab517-e035-44ae-a865-22423e9015ba", "value": "T1F6C4E04AB210B2DFC517C9768EA40C24AB61703B571BE307A45365ED9E0EA9BCF161F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509653, "uuid": "5a1f3463-da61-4172-8cbc-2577c1e30f2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509653, "uuid": "524a4590-46f7-4c2b-a323-61b8b0ca2160", "value": "12288:trOuCAXO9G6myG5C0rkWw797CCf0bvCmmKa6e/jsFkYuSquA:1OSwG6zqFrkTN507CbKa6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630509653, "uuid": "02acc595-56bc-44e0-a35d-c5493ea0e067", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630509653, "uuid": "b8458c40-f87b-4a62-b08a-3c859595c36c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509653, "uuid": "f4f07f66-2521-4f3d-9bb9-5bc87bbc2eab", "value": "2aee5ea79b9327ec85da89421b92d219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6b989c-0abe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630457410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630457410, "uuid": "0de69bd8-3a7f-4348-831b-cbd2014ac156", "comment": "Malware payload (Mirai)", "value": "15d4501c3fe6240bc4b490f789b674e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630457410, "uuid": "21e621fe-8fc7-44ee-b2e0-517fd2088a6b", "comment": "Malware payload (Mirai)", "value": "a2f21a7484ac459139022a182874a44b39d0f2f3eefcdafe42cf4cc356831bb6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630457410, "uuid": "0dc9d1ae-e1de-4a1e-ae49-f7e2971322c9", "comment": "Malware payload (Mirai)", "value": "08c08e83b1129dddd1f905da69b37d47fe8994d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630457410, "uuid": "b1faa05c-7f32-46cd-8036-eb5bb167377a", "comment": "Malware payload (Mirai)", "value": "10bdbc95173c03f7f7ffb22705fb387dc7f7d1a2014c873271f2bd4b01fd70da852eaf13abaff91f9ddec853d5108b54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630457410, "uuid": "8c960dd6-4f90-4075-b056-197d25a4b884", "value": "T163D34C46EA818A13C4D5277ABAAF42493323E754E3DB73068D186FB43FC675E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630457410, "uuid": "fa034ec3-82d5-447b-bd15-d80a7b579f1b", "value": "3072:MAJsD/C7z0LHmGtU4tcgQspEMj2NvzMabkGM/9nQ8XQ:MksD67zgHmGtULgQspEMiN4abJM/9Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630457410, "uuid": "082a2d88-977a-4035-b8e5-bb32659e075c", "value": 136843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630457410, "uuid": "2d2e05a6-9913-4506-b499-bed6367c4303", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630457410, "uuid": "fbf3c29c-f1ec-4eef-b627-d28b4b945ad2", "value": "Josho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4b6cfc-0b1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630497076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630497076, "uuid": "82a90bd7-cf96-41d3-8432-a764e07feafb", "comment": "Malware payload (RaccoonStealer)", "value": "424e3790ec8f558a94fbee17503e4420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630497076, "uuid": "6f690462-8522-440f-b9cd-e8645450fa2f", "comment": "Malware payload (RaccoonStealer)", "value": "a457d8e2fd8793653224c3e906c19ca23487de6881d1fd39c4652f336957ab5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630497076, "uuid": "dd43574c-6bc7-4763-b9ba-2a4c6448c8f0", "comment": "Malware payload (RaccoonStealer)", "value": "4d2a331ccacd3ca170773988ba527152bab46f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630497076, "uuid": "4b6a5c14-ed24-4ed7-aac6-e17a3131aed3", "comment": "Malware payload (RaccoonStealer)", "value": "30f94202dc5d3875576716807b8092a72e0cc7a90912de2042721d5936e16a7cb6cbb334de5c364a3285afcff03e2bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630497076, "uuid": "f9ec5b5c-61ba-40cf-9141-802898958527", "value": "T124C4F00731B0C6BBE1A14271BC65E7B44A66BC6D2D22C5CB72C4631F2DF93D1A722356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630497076, "uuid": "29f6013a-e471-4539-8f14-141e94e6f405", "value": "4dfee2d5d789a471aa176a087571f5a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630497076, "uuid": "28c68a6d-31b6-4b56-80b9-8f20b7ec48d7", "value": "12288:dLUqTyu5tsKE/tpxu1oC76F69V7ogMiJ3nEaX59Y:dcuTslXbO60rffK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630497076, "uuid": "8a5fbdf1-2cee-4ae3-ac6e-02a07bc125e2", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630497076, "uuid": "16dc7c2c-0a44-4405-9817-c1fbdac6b66a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630497076, "uuid": "bc3a644a-97e0-4c11-82c0-5a24cbb11e48", "value": "a457d8e2fd8793653224c3e906c19ca23487de6881d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d797ae-0b53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630521304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521304, "uuid": "11deaea7-0634-4e74-9dc2-f4cc819ef844", "comment": "Malware payload (RaccoonStealer)", "value": "fa5605ec5a98db4fc65ec5d2f7f2f3d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521304, "uuid": "a9c78890-fb31-4ffa-b2fa-62e8e0ce1ba0", "comment": "Malware payload (RaccoonStealer)", "value": "a486da5d4b90a37ab4e1f6bf3160af7f355d4eb1dc4466a8b48a1297ba1ea53a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521304, "uuid": "05cb9cca-ceba-44db-ae20-7045c4c860f6", "comment": "Malware payload (RaccoonStealer)", "value": "264c985a6a97aec3425a553bce1773f35edd90c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521304, "uuid": "df16b6df-065f-4e20-afff-b1d2f1cba4de", "comment": "Malware payload (RaccoonStealer)", "value": "222137ee566ab70e3736cb077362fd37d9fc3e3a8cbfab63db20f45a5bc59364a41193718d95d1b5f4ae500ab5b06eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521304, "uuid": "4205553d-2450-4439-a5a5-4e5aae4ab49c", "value": "T145C4F11B32A3E037D255C2B04CA9D7B85A36BC695C22C68B37C0675F2EF12D39716366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521304, "uuid": "d24a25dc-3cb6-406f-9df8-41039768aa85", "value": "451c17c19158849d8a13a33ee740b7fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521304, "uuid": "609fc2c6-08d7-4ee6-9a04-c90216e74bbf", "value": "12288:i5XsFu66NNesz9i5CUNYuqM6H+026UhaX59Y:ix62NPg5xNYq6H+0291", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630521304, "uuid": "48be4cb7-ef60-445e-944a-4884a03f7e81", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630521304, "uuid": "f2ed501b-ea5f-4c10-8b66-5852bd6132cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521304, "uuid": "c39d4999-b4ca-433d-a940-f2f060b251a5", "value": "fa5605ec5a98db4fc65ec5d2f7f2f3d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbf280b-0b50-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630520218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520218, "uuid": "aac0df6e-aad0-43dc-98e2-4b58993b6234", "comment": "Malware payload (AgentTesla)", "value": "5fa1c99f6e40b3a510455cb618bf5e88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520218, "uuid": "fdb00fe5-2424-47e9-890c-7018a5a20ff1", "comment": "Malware payload (AgentTesla)", "value": "a4b7dd3df88593c325beed8cdb08a3ba1fc5e18243800cab00b58cc44868359c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520218, "uuid": "4174bc29-f6c5-4fe2-9798-11c968f550f1", "comment": "Malware payload (AgentTesla)", "value": "c39baa54d658c8ba7a296749c722209ca8b8c2db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520218, "uuid": "91f74bfb-b251-40b1-9f53-fa98a11757ca", "comment": "Malware payload (AgentTesla)", "value": "ce56616830b936403f3a289872b4aeaf6d61367b1e5c29cf06a096407eb6616efc03b713a0f1ae9c61a24d21d362a06a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520218, "uuid": "d4ea2ba7-85db-4f53-bcef-85f71978753d", "value": "T140F43E3E58FE2327D176C6E6CBE08823F2D498AF3233A96557D747654316A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520218, "uuid": "a33fc738-054a-42ae-9494-95c75e69efe6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520218, "uuid": "64d88271-9a78-4ec1-9c2f-7291c84b5ff0", "value": "12288:yEwQGsOBYRRw+1KGolaNKfrJ/2aEKsKrjqB980D12:DO3+76EirG98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630520218, "uuid": "25975dd6-19e9-49c1-90ca-a08084ab3f4a", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630520218, "uuid": "f85642ff-4e34-4654-8bda-a9ce8d8806e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520218, "uuid": "a027a690-44aa-44c4-99f3-2f0b0966a50d", "value": "PO0972378.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dc2c63-0b0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630491343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491343, "uuid": "1ac136b2-926d-4860-bcc7-0df2f572c58b", "comment": "Malware payload (RaccoonStealer)", "value": "2ae0318378b6b865a99b7426f4593b49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491343, "uuid": "a9b2c7b2-17e8-4419-980c-e28a8d6e66ec", "comment": "Malware payload (RaccoonStealer)", "value": "a52de63a368575c4aded6fee0452dc23043e4c260388caac93c2242f0bdfe97c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491343, "uuid": "9a51089c-dea1-4a08-86e3-2fd0797f7b5d", "comment": "Malware payload (RaccoonStealer)", "value": "5e108f63be8c1e0f904958251c91b81a032a9068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630491343, "uuid": "1aa9a39c-b376-457c-bfe2-7fe03d57fd4d", "comment": "Malware payload (RaccoonStealer)", "value": "9892b6fa970e0758a269306cc6c8b020c532348fd53847bdbc247946089482385a8a922f0b8fa92feb250df6861532d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491343, "uuid": "0d63eab6-275e-4978-92f3-0241eea9161c", "value": "T13054AE0B32D0CD3BE59206714C71D7F91A26FC695A22C28B37E5275F2EF13919B2235A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491343, "uuid": "38c295b0-1b9f-4761-87c2-3f941cb3cbc5", "value": "4dfee2d5d789a471aa176a087571f5a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491343, "uuid": "80141ffa-9920-4a01-b00a-2ba0c7e041ff", "value": "3072:/NpwJMiJLIVmWIFkjf28zZuXoQ/gznxxYLiIymMHJ8atSMu8KY9wmSVgsCmbmF6:/NpXiJLwmd27nXQWIanX59EPCmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630491343, "uuid": "bc9c8460-2577-4aa9-b497-13a8de69fd93", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630491343, "uuid": "2789fb54-f52a-4db6-95c1-41de0bb7b4b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630491343, "uuid": "11188809-2017-44b4-826a-ad429aba4065", "value": "2ae0318378b6b865a99b7426f4593b49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3ac565-0acf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630464706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630464706, "uuid": "7cd95144-40f2-41c5-9672-e9cac1ceb191", "comment": "Malware payload (AgentTesla)", "value": "034d9eb8520e0785392d708c3d3894ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630464706, "uuid": "4a93d4f4-28cf-47cb-a53c-1cca746c5809", "comment": "Malware payload (AgentTesla)", "value": "a564eb282800ed662b1c55ae65fbba86b6feca00a2e15ebb36a61fc53ac47c3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630464706, "uuid": "817985f9-f6ee-411f-bd9c-a51523599edf", "comment": "Malware payload (AgentTesla)", "value": "36c044ebc65aaa77234cd05bc39f9ad4b2638f42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630464706, "uuid": "16571e25-eb97-4c5d-9161-c3439bcd0e2f", "comment": "Malware payload (AgentTesla)", "value": "426b649ba8fe716218577d62fbdd0df59f56f11fa18af701fd4f1428d091e2d4503eb3a28058fc4b755308143bcc1434", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630464706, "uuid": "884fd9f0-e53a-4846-b380-5cff8346910f", "value": "T1C825158D9C9C51CDE42D97D01A72C6D4639ED3FF3802253AB46DE2722D5BA29DFB2804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630464706, "uuid": "85b2118d-a9e5-4fd7-994f-243e88adb347", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630464706, "uuid": "de237d67-2865-4919-8b8b-d5c57a32f4b1", "value": "12288:D3rYCnNcpdUHWoYdxgW3Q+91jlCo2c1JUQtwOcQSM:D3rTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630464706, "uuid": "4131897a-bddb-4c51-96a1-5a57dcdc9ef9", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630464706, "uuid": "f4aa5ada-12b0-4e52-af40-0a8208f7f70b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630464706, "uuid": "7d9fc313-acd5-45f0-8f0a-04063412c511", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78263465-0ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630472404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472404, "uuid": "2e44646e-fd2c-4e9d-9356-bc6944347b8f", "comment": "Malware payload (Mirai)", "value": "5dffcac88fa5713707bb2a9ef9cd4636", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472404, "uuid": "63ee196e-31fa-4068-a588-45501bf50f68", "comment": "Malware payload (Mirai)", "value": "a6d0b936992ca7cbc60e37c77612381af0dc468f341179d54ecbe5128f3ef581", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472404, "uuid": "27615c4e-618a-42d8-8a5f-d010878c86e8", "comment": "Malware payload (Mirai)", "value": "3ba0553145c91c9b49dfb95a263e6e04104834bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630472404, "uuid": "5414f08c-e581-4184-acb1-1ef3e0287330", "comment": "Malware payload (Mirai)", "value": "315069e03f43bd3434a70a7bc451cf0e8007cf3ba5835fcb5cd8cd5e83366c8b77e6ce7b486a0f63b692fa5b9cf744fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472404, "uuid": "b5c54388-5653-4157-9328-b92c2cfde74f", "value": "T168435BC1A653EDF2EC1205B52036EB727AB7E13E2128D957C3E9A873ED42A43D11724D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472404, "uuid": "cbbd2663-779c-413b-9ff2-908e12670aa5", "value": "1536:koP4V8eC6qDzurFYzEvJ1MBOEF/pfcTJ2PVrIrISos:k9VFqD6huoJ1MBOEFBfcM9rGISd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630472404, "uuid": "edac4cdc-a442-4e38-888d-5d9b7173757a", "value": 58592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630472404, "uuid": "e05ac3b1-7ed0-4fb1-99f1-5ac91d8f5fa5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630472404, "uuid": "af5067c0-32b2-47d9-9fa2-89effeaa6e9f", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc27194-0b34-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630508138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508138, "uuid": "e793a192-6da8-4a84-b067-a089b85c569b", "comment": "Malware payload (RaccoonStealer)", "value": "b7a2af11ab5c2c997b5d9b2278da3076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508138, "uuid": "00dc66a3-12d5-4934-a02b-30dfe37a54b3", "comment": "Malware payload (RaccoonStealer)", "value": "a7062fb3a21fa88712e225861e57c12bb081bf13526e61f083f84ebeeecbc77f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508138, "uuid": "994a7edc-c327-4c63-aa80-b5ec185bf3d5", "comment": "Malware payload (RaccoonStealer)", "value": "a0add7a6eaf1661699627c2c4f52e900e59fcd67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508138, "uuid": "10145877-1bad-484a-84bc-68104f9f305b", "comment": "Malware payload (RaccoonStealer)", "value": "6a272ceccb3b5c1d327e880f914129105cfa71ff2a8fe1a797105714a0c88cd175b1be5a9dac66edcf381de09aa143b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508138, "uuid": "5fae500e-d0c9-4503-a012-e73bdbdf6fc7", "value": "T1EEC4F10B72E1D43BD1A44275487AD3F90A36BC5C591AC28BF6C5765F3EF12B1AB22306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508138, "uuid": "31798ca7-8155-4cf0-891b-957ca3bc35e3", "value": "80892f18aacf6a3ec193623c3a9507f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508138, "uuid": "608ccd71-e303-4e9f-b552-7d5f5cef8331", "value": "12288:ri9ZpxQShPLYet17E2Qez5dLn9Uu7yoZVX4/saX59Y:qLPLvt17E2NDjyoL4/s1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630508138, "uuid": "53df7dc4-c608-47b5-924e-55f6e0799e74", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630508138, "uuid": "21e39535-7198-48db-89f1-8ade9a5ca6b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508138, "uuid": "b2967599-325e-4278-92b9-146d7f62fe16", "value": "b7a2af11ab5c2c997b5d9b2278da3076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34dc8c34-0b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630504503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504503, "uuid": "0437882b-e450-45b7-933a-7601799cf496", "comment": "Malware payload (Formbook)", "value": "fdcd91aa7b0e3bbb23a28209c358d9e8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504503, "uuid": "f9d5a2bb-2f33-45b8-a0b4-e4f9abb05be4", "comment": "Malware payload (Formbook)", "value": "a8bf734d6799d56f61bb58aa044f44bd6b435550600d903f264bb0876a8b627b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504503, "uuid": "4c9dfbd4-f393-4ce1-b272-e0854cbcb48c", "comment": "Malware payload (Formbook)", "value": "71b06082b07c0558d3b350f4c0cba40570eab930", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504503, "uuid": "fa453d52-eed6-4b5b-95a8-881e7f1aa4d7", "comment": "Malware payload (Formbook)", "value": "64f33fab17d679ca72acea73ec891c1369d6dc1f5676707c2c794dcc6b3bab065b3cf3b51a8aaccc6827ef0faea2e321", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504503, "uuid": "470d11c0-18b3-4fa0-af73-a9f4f43703e5", "value": "T1CC92ABACD4A346988F85A7F8272BAF4501CD762EF784A133357C973167E2E7A501683C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504503, "uuid": "8d20b44c-f6ce-465c-89f7-4fe91662e151", "value": "192:VN4E64+7biIrctscar8pgjWgBKhDiUp9MN58ETr/qeTKgj8lLx:L4E+SaJcjKj96iUUNWETueTKgj6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504503, "uuid": "4d88bc9d-c001-4ef8-9bb3-a4a54f9eec6c", "value": 19958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504503, "uuid": "f4b4ad02-c9e7-41d7-97be-759162fec36b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504503, "uuid": "599cc21e-01ca-4b5c-b7b8-8ea2d8cebd0c", "value": "NEW ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7ac411-0b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630504459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504459, "uuid": "861a6484-a7e9-4a35-8c14-9324d9520df9", "comment": "Malware payload (Formbook)", "value": "dd59a0508d8c8327a0a326a8e50bc508", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504459, "uuid": "b6edf481-629e-47c9-b7cd-2a96f969eabb", "comment": "Malware payload (Formbook)", "value": "a95011de9a92158a8d8ff651e2470d4b50cfad4c1b4a5a0679bb7a6a0c8e75b3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504459, "uuid": "90bbb431-96dd-425f-ba1c-9592e3fe08fd", "comment": "Malware payload (Formbook)", "value": "209d5dc55c9f07357c0ddbaedb1f50854ff03098", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504459, "uuid": "0fba9d31-9746-4d03-8f4a-0132e21da3af", "comment": "Malware payload (Formbook)", "value": "aebd8270774288a48bba2ea0dc9c937ed36281aa8d2df7a68358cc6c8be75fbe4be659bbba2eb89a82bb1ea0f578d03d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504459, "uuid": "23be09e6-43f4-46ac-852a-eec291eb1088", "value": "T12F923F6CC0A742988F8AABB4372BAF45118C762EF749E132356C5B3117E2D7A416397C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504459, "uuid": "43d18a15-c889-4ae6-9ad4-19cfb489f58b", "value": "192:ar9OwESQ3E6dfT15QgUsOUz1Bxev3dkOffgctuAIo6ZQz3+fga59+suA:I9gSJ6BTgc11Bgv3dkOff8c6ZFF9+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504459, "uuid": "0493b127-134e-4907-aaf7-796e9a910a4b", "value": 20002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504459, "uuid": "18a4ba82-09f1-4a71-b93c-43a80df03fff", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504459, "uuid": "c0962976-526f-452e-9314-b45b6046d001", "value": "Appli Trading GmbH New Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79af495-0ad3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630466551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630466551, "uuid": "a50465e4-64d5-4d66-8464-039327f69452", "comment": "Malware payload (Formbook)", "value": "720e0d1a0cbb6a715c7ecec7002d8805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630466551, "uuid": "a707ee22-c79b-42db-b35b-69958fb0bfb5", "comment": "Malware payload (Formbook)", "value": "a9d0de4abec8a5d9f13b203b8f4bcc0dcd101fb5f5f89ea910414d4cc16391ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630466551, "uuid": "0ef5782e-ef9d-4473-b05e-cbbfa677d4bb", "comment": "Malware payload (Formbook)", "value": "b9a6c62e071546a26e454aaa04064f303fc5ff67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630466551, "uuid": "584afb36-42b8-4993-912e-d6034ce7fa47", "comment": "Malware payload (Formbook)", "value": "c66ac97337558f7a75cfeb27b44c0b619ec16d887ebca05c9f7982087d4781c32f484856d39baa222a3ead17274500d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630466551, "uuid": "910083e6-bd2f-4d91-a4a9-14c67484c8a8", "value": "T1A1B4E09D7694759FC92BC9B6CA942C20E721B0B7430BE343A05752ADDD0E6ABCE111F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630466551, "uuid": "812b0206-b94a-4cfd-bc22-cd578dc5e959", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630466551, "uuid": "d1e9603b-16fb-4170-8b47-64de571027ee", "value": "12288:cr++jVt1Vo1v58YQ97tn7v3ybYx711V8zBkh4jH0:cd6wlp7vkYX1V8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630466551, "uuid": "5238efc8-74ea-41df-b17d-eea510fed253", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630466551, "uuid": "e8bb9063-8121-419e-9a8c-0711b656f476", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630466551, "uuid": "02eb8042-8146-4ebd-ab25-c077bc3a8470", "value": "Proforma Invoice - PO NO - PO.L067.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15acac7c-0afc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630483835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483835, "uuid": "332b5b69-4603-45f9-b8d4-8e7686228ff8", "comment": "Malware payload (Loki)", "value": "c8268fdcf0f3b3c81d61dc1a657e9e7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483835, "uuid": "121a1980-bf48-4e41-a977-12c170f5ea5b", "comment": "Malware payload (Loki)", "value": "a9d8ff851ff8644ca724b4f4cac643aebdcdf200df30b86066db120cd0d574b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483835, "uuid": "91ec7206-26cf-4529-9080-f59380534192", "comment": "Malware payload (Loki)", "value": "a5292fed014578d4f500ce51263f3b68dcfa75a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630483835, "uuid": "4d02f2ae-14af-40c8-a257-6ce8d8948851", "comment": "Malware payload (Loki)", "value": "a4d0e21bb1702bdfdeca7eaedf296e524477853c8a3b006be0d84871f5386851814642ebccb5f699510576054549ff4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483835, "uuid": "354d1951-e2b6-44a3-a49a-e0cb0afff9f1", "value": "T1A9D4238688C4CCB2F7297370C0B7CF98196479328C55ABB8C35DF96EA8702473956D5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483835, "uuid": "993db71e-a0aa-4be2-a362-95dcba3c683d", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483835, "uuid": "a9aa48a9-4762-4c17-a672-379e0b4cd350", "value": "12288:1JXe9PPlowWX0t6mOQwg1Qd15CcYk0We1rSnTmaeJnFwtc5OG3vuq:1whloDX0XOf4sQnOclGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630483835, "uuid": "7712c314-4fdd-4bcc-9f3a-2279f6a482a2", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630483835, "uuid": "a1e6b7f5-5859-4759-af4f-cf71cbbfd78f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630483835, "uuid": "ff67cfa6-dd9c-4b97-84c1-692e2824ca1c", "value": "c8268fdcf0f3b3c81d61dc1a657e9e7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da1142c-0b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1630504625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504625, "uuid": "244d455b-0a96-4928-9b6a-b7bef1a1ebff", "comment": "Malware payload (GuLoader)", "value": "6f22fdd19b3d98a06e7a5ec9ba86f7c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504625, "uuid": "74f8e249-741c-4b8c-830c-9e45a9bd4377", "comment": "Malware payload (GuLoader)", "value": "aaded4fcee9176fe04085b40b5c11861cfbcdf76eea26f508b119eda00ada941", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504625, "uuid": "9643db43-f0a4-4a83-9a91-5c2a205bd239", "comment": "Malware payload (GuLoader)", "value": "0b401f224b554921cf864264081565332fee388f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504625, "uuid": "8a5b0c7b-4ee3-4907-af99-a238f4ea8292", "comment": "Malware payload (GuLoader)", "value": "952c0af34c9f67c5705519cb32f4ba25d6e4313678393255da721ce859c907ab46945472f711f4fa5d12de6c77c37bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504625, "uuid": "e63f8b81-fb8a-4d38-9c45-22c8482edf25", "value": "T17993AE92BB454485F04142B12877A3926721EF332C199FDBBA5CFA1C2FB4D8365E471E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504625, "uuid": "43dc8080-a0ad-4408-81d8-a9393202b1f0", "value": "f7c083b6cb03cef464dc06bc16741f3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504625, "uuid": "99790841-f490-4050-a8d2-56d500c72a34", "value": "768:3a0a5pjSPvO3Enq6XuA1LuuZrIaztV8YjkRDw/QnhY9lVME6IxrlzlS/02ll5NUa:3avjSnBXt1SumuVRkKonhGVMEpSQm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504625, "uuid": "4a15a5a3-4ae8-41f9-80ca-941c84b3aa7a", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504625, "uuid": "28e9fcbf-3fdf-4c65-86d4-e06ad8ef88f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504625, "uuid": "72bf268a-dcf9-46f4-9e90-bcdee2a0b5f5", "value": "THP03988499393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462325c9-0b4c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630518276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630518276, "uuid": "112462e5-3d80-4e40-bb38-5b2e7065e7d0", "comment": "Malware payload (Mirai)", "value": "b3a9738579fcb94156eaaa0f4b7f17e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630518276, "uuid": "b6eb1fed-9fbd-4073-95eb-7da60d18538f", "comment": "Malware payload (Mirai)", "value": "abb51d7b4e7f21cb1d733e440654d1199dd9a9b616e2685fad13d72b2f92b17a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630518276, "uuid": "bcccaf98-c735-4139-84e9-fac1b60c7d6c", "comment": "Malware payload (Mirai)", "value": "5c81f3b51f5a32294941ce5c7137e89445500209", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630518276, "uuid": "f95ea75b-be0e-43f0-b058-b5a14f01daf0", "comment": "Malware payload (Mirai)", "value": "9f2f5d8d49af389eaf01ba842ca09211f6755f830c95457b0adb5298180bbd34410e7a28c9f356af5cf0e6d9166cf563", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630518276, "uuid": "93b08090-9bc5-453f-842d-8aa7fe9c7b76", "value": "T1F063F782BC80E626C7C01677FA6F518E3315A7D8E1DA3242DD165FA07A8FC1B0D6B746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630518276, "uuid": "642dfcc0-031c-4b3e-a32c-163af1c1265c", "value": "1536:bZ4ZLO7YQ010oQJ6sZad7jL1B8t46eTmLCJG6:bZ4k7L0l7nn84JT4CJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630518276, "uuid": "0addbfa0-37bb-4a20-adbf-366a9bce15e8", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630518276, "uuid": "2b165ab8-341f-43bf-8396-5165502cb010", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630518276, "uuid": "88bdd928-529a-4022-b11f-68a215c3646a", "value": "b3a9738579fcb94156eaaa0f4b7f17e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fd6e9c-0b64-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630528563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528563, "uuid": "0f444e81-6549-4644-906d-dc834f3250d0", "comment": "Malware payload (RaccoonStealer)", "value": "62e941c948ccbf6c33e31e1608f33630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528563, "uuid": "ffba48f2-9880-4d14-a287-1e59191aed0d", "comment": "Malware payload (RaccoonStealer)", "value": "abb67941245047889df4a4cec2e3f533b4085f393281fba6db017a2c7153be5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528563, "uuid": "c15a4099-85d1-4323-920d-aeba03c20b6d", "comment": "Malware payload (RaccoonStealer)", "value": "f990ced857963d46efb4cfd1ea536ef7bd1fad79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528563, "uuid": "411349a2-5c6c-46f4-9591-6623bdbbc79c", "comment": "Malware payload (RaccoonStealer)", "value": "d3139d96d3130ced235664dc303866ea7af8442e51373ec8ec94adb725f288fa27c3963e228dd5049e7701caf3ece755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528563, "uuid": "f8f7bac9-5aa8-4660-80d7-2fd492ae697f", "value": "T1BCC4F10736B1D83BD1944271486AC7B91D2ABC59BD12D6B777D3329EADF1381AB32302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528563, "uuid": "8418f775-5c56-4028-8ea6-f816d54e7cee", "value": "6c24281dcaa86901b7166ae3ce878d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528563, "uuid": "9b2367a1-9037-413c-9a40-4c2457cc3d14", "value": "6144:hpHLOJnpTiilqRgJr/g8Jo7KEG0zPlFzgvrXH33kRCluX+Hjsqv+IanX59EPCmK:fHWpTLgsbVglGXcIuXUsqvFaX59Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630528563, "uuid": "984abf70-cc1d-481d-bb88-7e0d7474a6d5", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630528563, "uuid": "d7710afb-d1b4-4b04-89c3-737922deae01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528563, "uuid": "0666938f-972a-46e7-8dd5-a29bb2bf04ec", "value": "abb67941245047889df4a4cec2e3f533b4085f393281f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c712798-0b0b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1630490450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630490450, "uuid": "cdd7ef04-8cc7-4213-9275-3ca3f1f1f2b4", "comment": "Malware payload (AZORult)", "value": "3a1e5f74e0d70bf0ec8439fffbf0bb22", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630490450, "uuid": "5b3be76b-bebd-4624-8d0e-734e8b224d01", "comment": "Malware payload (AZORult)", "value": "abefceafcf523eefa54d0dcbf7911bd1d1e4245d223ed43297a862b3d0d78a90", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630490450, "uuid": "a61c7437-9da4-4d9a-b3a4-fad16eb44b56", "comment": "Malware payload (AZORult)", "value": "a685b6952fb1a3477b39eb404ce0b5477c7c2c37", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630490450, "uuid": "c244ca58-73ad-4b32-a746-8aa98fd58ee8", "comment": "Malware payload (AZORult)", "value": "4c6f6c942fcff47617c5e537b31ae153805c3f6363fe557200bccf30cecb576e3f6f4d62cbf8e15358eb94323ff11cc2", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630490450, "uuid": "c4017b7d-d0df-4feb-a1e9-e2875dd24ae8", "value": "T1F665DF0273E18036FFBA91735F66B20697FD7D250933851F22881DB9B9721B1263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630490450, "uuid": "b515229e-4b82-487f-b08a-9049e26ef2fb", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630490450, "uuid": "5d051d76-e0e4-4265-bd42-becfdb1526aa", "value": "24576:NAHnh+eWsN3skA4RV1Hom2KXMmHaYW62tszfmhl3QE+MiAQioiz0/Ev5:sh+ZkldoPK8Yah6Hq33t+9O0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630490450, "uuid": "ef778744-b809-484f-b4ab-bc6528745631", "value": 1490437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630490450, "uuid": "610a669b-62c3-46dc-a1ff-fddfd231a864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630490450, "uuid": "3f119fc8-c244-4e57-81e8-85196a6d8905", "value": "3A1E5F74E0D70BF0EC8439FFFBF0BB22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf2b502-0b26-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630502153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502153, "uuid": "2e77eb14-d1ce-473d-b734-953e41f4cce6", "comment": "Malware payload (RaccoonStealer)", "value": "6f017992a395f96e169f4b8c1cd31a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502153, "uuid": "cb85b96d-b826-43b8-9755-6cef756d675c", "comment": "Malware payload (RaccoonStealer)", "value": "ae63c29c973c00ec890a1f90909c3e1c05a975fe960e2e0794b99e6856e0be75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502153, "uuid": "e8e68872-68a0-45b5-8cf2-3399a775bfd2", "comment": "Malware payload (RaccoonStealer)", "value": "a0f9b2b46db5816f8e32a678b5446cc81a80fe79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502153, "uuid": "f9e0dd0d-0266-4dae-94ba-2eb6e4932a33", "comment": "Malware payload (RaccoonStealer)", "value": "f2b37a2e5c9e38a3c27ca84f9cc0e635bcd88bbf5d48e19a040c50bf1cdc514ff6cc87315e93bd2b0ac54597e506a2c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502153, "uuid": "4961ba17-51a9-40db-9650-848c10594676", "value": "T1C8B4D030B791C035E5F712F49AB682BCAA2D7AB15B6450CF53C526EE16386E8ED30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502153, "uuid": "e4d18f87-9754-4477-a962-e84272bc5df5", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502153, "uuid": "5d42fdd4-c074-45de-9ab3-6d535116dafc", "value": "12288:GucJmx9khiBnc05uVhxJBn/BR/aEPjOZYw0mnzObno:DcUrwCsVv/3lrf+zObno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630502153, "uuid": "5a5031fb-2b96-43fb-a898-07777cc3559d", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630502153, "uuid": "39b3f509-41a2-4c75-9296-c47b66c3779e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502153, "uuid": "e7da4799-7f27-4dd9-a56b-487fb282d393", "value": "6F017992A395F96E169F4B8C1CD31A91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d66fd1-0ae9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630475992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475992, "uuid": "8725923f-6cc6-4423-902f-c50576012166", "comment": "Malware payload", "value": "23e654b2f5301e5e43be11896a07e0f1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475992, "uuid": "15cd1a9e-6059-4199-8f76-cf358ba0ecdf", "comment": "Malware payload", "value": "afd8936faad2b5aa02c9801176d52f9b2969084a80ba21177d19ebfcf1103078", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475992, "uuid": "4488588f-ad60-437c-bf75-3e7481db6807", "comment": "Malware payload", "value": "8d881c13915e8da205b06e706efdf1561681c359", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475992, "uuid": "a6b8a9c9-cde4-40ca-aa88-bb0ebaef7be2", "comment": "Malware payload", "value": "81f192067faf542521d1251f3ea4edfda9bbff68186768d629c75ce08d0f74d00a8bd55a3e17558b6a0dd2355821a597", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475992, "uuid": "3d9cfe74-92ba-43a2-8d3b-6f3de209431c", "value": "T1F3447D02B3D5437AE4DB03722B8F93628A72EC788663412B1659750E2EF1554F7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475992, "uuid": "bb5f6ce0-7e49-4a4d-a17e-b8eeb6d9c2b4", "value": "3072:7mz6ahF9m3DcYoAQwgz88ereWn/7w05g0UMcB3RUN46ILJ9+ZB5yOan8Q:7mz23DcYoAh8er1nzTBrXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630475992, "uuid": "3bbef058-4718-4069-8bbe-45f454481400", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630475992, "uuid": "fc381db2-079c-48ad-995d-9022ba9b6d33", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475992, "uuid": "cea87e67-25ae-43bb-9f90-f99dac0790a7", "value": "factura_64995.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b28fa6-0b28-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630503073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503073, "uuid": "18f084f6-15d5-4a19-a47b-b5c0dc377138", "comment": "Malware payload (Formbook)", "value": "6fbb937496a9275f2dd99610db03137d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503073, "uuid": "0dfec09b-cd14-4fe4-8cad-6bc8375ecbe5", "comment": "Malware payload (Formbook)", "value": "b0a0d1d399e98e48cae6a87c280339bc1b0d1c22f84ae589e0c3dca78e76d108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503073, "uuid": "fcf0d624-9e48-4701-94ae-0d5c43b659df", "comment": "Malware payload (Formbook)", "value": "65cc47902c0f7c2cc22892621c6756816d70be2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503073, "uuid": "baf78574-f50c-439b-b845-375975ce19b9", "comment": "Malware payload (Formbook)", "value": "18da0c2f034950c82f66a561379fc69a02018af7c66803460bf50e5c9c27db56892b771d3149529f4d1d0d193397655b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503073, "uuid": "5b166680-8eaa-4b80-80c3-475aa3da6927", "value": "T163D48E0EF5819FBFD016243C8D5A35BC9C76BE61691C96CA7ED86F085B34B9230A7384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503073, "uuid": "051bdda2-a3c8-4bd8-ad90-32e2c56f5980", "value": "b22795c7c5933bf88ce6268fbff58dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503073, "uuid": "6d15cf47-27c9-4500-a400-25f184e16cc8", "value": "12288:ddKKG7bKBAsmMmkTPO+Axbeinq25zff/m/nPsilqj5:dLyshiWWxEgzff/6nJm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630503073, "uuid": "184acade-8a95-4918-9ffd-a66ea04d8e76", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630503073, "uuid": "a5a58ed0-b4f5-4745-999d-1670aaca771c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503073, "uuid": "87e5c654-54e5-4bc4-900f-a8caa9d6f535", "value": "SecuriteInfo.com.W32.AIDetect.malware2.9911.26669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984dd39c-0b78-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630537312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537312, "uuid": "beaa2b2e-b886-4d27-b8ca-a5cb456b23d0", "comment": "Malware payload (njrat)", "value": "5916eac72f7396edff49cad9dcd8d80c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537312, "uuid": "4d42a064-05bc-42d8-9a46-8409a411e221", "comment": "Malware payload (njrat)", "value": "b13fbd200b38f02c0278e54483e641a2cfb41acd1a90bed78ac8791d0c1cf5b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537312, "uuid": "806f0c0e-3820-46ae-a53d-ae580825cdc8", "comment": "Malware payload (njrat)", "value": "8e49c5a46c86c239ea314513ef80e0e275541e19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630537312, "uuid": "62abcd45-0617-4f21-bf1b-51e28c0b151d", "comment": "Malware payload (njrat)", "value": "3f1b1132fa08802c6b4155fceacbab4b19ac1fe4125cfa9eff4a3e94a74f14c78d190a50f5e8b0062bcec48f2b7cf3a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537312, "uuid": "648267ef-5989-47c5-b8d9-6f46fcd9f78f", "value": "T19AC3F1F6310EC522C77E60F226742A41621EC234FA06A6E3DE947437CEF698ED538D49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537312, "uuid": "6f6e1d5b-1334-4422-87e5-1b18b971e59f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537312, "uuid": "30c3f0d2-36f1-47eb-9b2a-6ca810a9bb6f", "value": "1536:ZVmDCzEXZKQSCqnSGgVM9NXiotLWLUrHOw+rDNdQLp3OwFPQhGIXPTasnmIbOKye:ZADWEXZK+GTypEnUNE3RPodmIbdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630537312, "uuid": "7ee68b4d-0115-4b72-b9b8-0f4c6513c046", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630537312, "uuid": "73166074-2d4b-4dc1-be6d-959711e8e6b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630537312, "uuid": "bae60da9-804c-400a-a7a8-08abbfa4d0c1", "value": "5916EAC72F7396EDFF49CAD9DCD8D80C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd7c4c7-0b50-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630520305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520305, "uuid": "96d090f5-0993-4b7b-bd01-6eecdceaf17c", "comment": "Malware payload", "value": "aa1f0cd5f939850476cd60c648ecc5d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520305, "uuid": "a2de5026-f04f-48a5-9762-b729003e8ec6", "comment": "Malware payload", "value": "b371f1cb76629e00e4cd545187ea722a7e5e98ac10ef5ff35495499136ed28cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520305, "uuid": "bd651343-98c5-4cb9-b97e-e4e5036ce26d", "comment": "Malware payload", "value": "488b496418bafe262ad1d390f2d8d76cfa8c2377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520305, "uuid": "c8e7c83d-8370-47d2-8716-177917756349", "comment": "Malware payload", "value": "352c028fd41284cbf173b678fa7137d7117c3471867e7c2d2b4e33fb9c88f9a0d21be9d235e70fc9d51202855e68fa76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520305, "uuid": "dbf6a232-538e-4b7b-b441-eb2f32109adc", "value": "T1F0A63316612238F6EDA2903394559438C232F8224B518F6F47B863366FF35E1BD3DBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520305, "uuid": "49c2e6fb-b318-4951-b20b-11b85bcd8d43", "value": "7320b3cae0f7c7e579e85728a091f04b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520305, "uuid": "eeb570dc-f420-4f84-9946-a1324d82f4eb", "value": "196608:96lAG6Zn0A9onJ5hrZEReB2WZufOuD9LS8/uIGfKyaGhLvVzeem:QlCdn9c5hlERq2WmfDZJbjGNv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630520305, "uuid": "5dcec39d-f43a-47a0-9072-cac9b1968bbf", "value": 9831681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630520305, "uuid": "f4c2dcaf-ffb1-4b76-a836-e036e45dce54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520305, "uuid": "64c007cc-300d-41da-a803-1afa04240080", "value": "dsad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aef4028-0aec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630476945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476945, "uuid": "bc5b7aeb-a4eb-47e9-a5e3-c9dc44149b3e", "comment": "Malware payload (RedLineStealer)", "value": "d494ecf353564056b1ad341d1e263ff1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476945, "uuid": "eba4ea48-8e02-471e-b522-9982a9335512", "comment": "Malware payload (RedLineStealer)", "value": "b3f56155505f07b8cf4a381d245d689f5609f10e29f5bc6e9d3046223ad4569e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476945, "uuid": "0c50e7fc-88ab-4419-91b5-886f70b96269", "comment": "Malware payload (RedLineStealer)", "value": "cd3a23c8175ec46baf3a30da9c60995b2a0fc37d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476945, "uuid": "f609ced7-71bf-42c4-b33d-d70f2f0e97a5", "comment": "Malware payload (RedLineStealer)", "value": "b1f4d20d9d8a419fe380fd87790bea53d64d86073a612c046d464fe580327a544fed8b34fd7671af74bec3fe26fe4f66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476945, "uuid": "f59541fd-6944-4215-909b-db4ab0f2aa30", "value": "T12CD3182752E24856C6449334E992DF373378CD180651F74A65C9BEABBE3E78E19B02F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476945, "uuid": "6609cc5c-cdf1-4508-befa-eea0fcfaa249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476945, "uuid": "1b13c1f0-2280-4a11-a12c-b22ddad78e21", "value": "1536:cgM+lsPcVwQW1XFCqPEoUZhhfa34TZ69QnFV:/nValFnlUL1a3VQnFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476945, "uuid": "d96daf80-2106-41ef-abdc-0409d600e5b3", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476945, "uuid": "4b6de92a-b708-4e32-92ee-eb5a61e56ed5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476945, "uuid": "1eec20ef-f8fd-44d0-bf0b-e9a96d5649e1", "value": "d494ecf353564056b1ad341d1e263ff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f378928-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482777, "uuid": "644bdf21-3a0f-4252-8264-35b19e035d2c", "comment": "Malware payload", "value": "a78893162556307cfbf4167aa1e98a16", "object_relation": "md5", "Tag": [ { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482777, "uuid": "b537a3fc-89a6-46be-9f0a-ac8bf5e74f8d", "comment": "Malware payload", "value": "b44b1e2c0a8ac47c94ebaad2f793801a6d641656d20d27ff1db1d0cbbc68f4b0", "object_relation": "sha256", "Tag": [ { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482777, "uuid": "ebd8441e-4fca-4ddb-9651-d1246ca2faeb", "comment": "Malware payload", "value": "562f27565f839ad0252c9fa787ed5e7eed2c1153", "object_relation": "sha1", "Tag": [ { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482777, "uuid": "754f3968-bd94-4be2-926f-600e32d7a99f", "comment": "Malware payload", "value": "eccae7dfcf768e3d02980325a4bc9e4043d527aee106034d5d9d42975286c3cb1effb1ac014efa01ab2768492cd3d16e", "object_relation": "sha3-384", "Tag": [ { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482777, "uuid": "3683f1b4-fbcc-4e9e-b5aa-74ccd42a5c37", "value": "T1DAD5121036C38B32D47B0A35546EDB711A3EBD201EA18E1B7394766E3D712909369FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482777, "uuid": "859b64f6-2c22-4b81-84ce-8f1c89778a59", "value": "49152:PYWxviWjsdcZaNsIaAXcv+HO2R/jecmpQ9StKakIS4nBnYnF8igl:jvLjs/ydAXcvgjemgXlTnBevy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482777, "uuid": "bf214064-2f2b-4a8a-b23e-f9bedc9101bb", "value": 2786816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482777, "uuid": "4a42a097-1c0d-4d6e-b25a-017ccc51d961", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482777, "uuid": "aca0add3-9b1b-42fb-8e1d-b456883b2973", "value": "b44b1e2c0a8ac47c94ebaad2f793801a6d641656d20d27ff1db1d0cbbc68f4b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb63923-0aed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630477731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477731, "uuid": "ce457449-e291-4258-8b68-e3644540e365", "comment": "Malware payload (RedLineStealer)", "value": "005453fd6cf9cb6729231f920a3bb7d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477731, "uuid": "3774db30-39af-4751-8755-4437c9417db9", "comment": "Malware payload (RedLineStealer)", "value": "b457dd4a687c867a8d664eb9d1200e3a78f7dc48c96d4da5a5b8247954011b42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477731, "uuid": "e8cb8860-1771-4be4-a1b1-5f9cd629abea", "comment": "Malware payload (RedLineStealer)", "value": "def31d858156623f6bf41f6b7e1f3acdec810361", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477731, "uuid": "ed87650a-274c-4764-a47d-96777b372415", "comment": "Malware payload (RedLineStealer)", "value": "41c80e8e8188475b3525edf482bf31ea1b34012603de0e721078aba90842f4ccd1004ae6e2d2c2234d378e3e40605907", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477731, "uuid": "530acc8d-0c27-4e3a-9e7e-4dfdaee1efec", "value": "T13DD4BB2865BFC019C4E7EAB12DDCA4BBD9AA94E3640D753311B4633B8B11B84DE0F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477731, "uuid": "01a9f0cc-2182-471e-99cf-0de07ed92ac9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477731, "uuid": "55eb1e10-486c-4bd8-8235-c3ef8c1c973f", "value": "12288:zgvDXFxC7b94xV+1XGoODYOqvG3YqBxGmZjLhxTQUZWqYqEsYh19zki6p:zgJS99ODn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630477731, "uuid": "71e81677-9f68-4dcf-ad0b-2180a0130367", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630477731, "uuid": "f1d5f53f-80c3-4853-be1b-8b286c0c0af7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477731, "uuid": "5d91a457-7790-4fe7-a640-0a7da154bb33", "value": "005453fd6cf9cb6729231f920a3bb7d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ab1cfa-0b4b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630517929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517929, "uuid": "088b181b-dc1c-4f80-8f1e-14f4f2aaa02d", "comment": "Malware payload (DiamondFox)", "value": "543ed8a17f16ce5b16b7c33702111dbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517929, "uuid": "72d5371d-f485-4d2d-a09f-944247b5b1bc", "comment": "Malware payload (DiamondFox)", "value": "b54dffe48f5ddc423d5f292363b29d5143e6f0f54120aea3208e067faff45457", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517929, "uuid": "3fde08ed-1fbe-4bb3-8d8a-8a84c22d1a57", "comment": "Malware payload (DiamondFox)", "value": "8a15f59cbc26b424cea2da8c8ca21fd1b468dc83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630517929, "uuid": "cac4d54f-440c-4348-a1ef-bb21283beecd", "comment": "Malware payload (DiamondFox)", "value": "15cfef5adca0bf88548b8a96de1ba95b2094730a8c0264be88543f7e9c2f5a104b885059d04dc33b89de69e80b1507e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630517929, "uuid": "b5f4eb90-a918-4d11-9d69-ff0f0cdab7c3", "value": "T1BD257C10B3D85A26D6EE1370F0B4492946F5BE31BB72E78F9644B4AC1E73BC198107A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630517929, "uuid": "ee15abce-880a-4823-ba3b-9fca2e6f588b", "value": "93fd4ae8d78e56fe707a53a5a49cf9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630517929, "uuid": "9c587f73-5f6f-4780-a15c-433e77353459", "value": "12288:pktZEyufdBGp4MAuVEaRtyncxQRhJJzhoqgH5sB4dxHG64:6tZoGp/HRhQRh9B4d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630517929, "uuid": "596a38ee-988b-4817-9769-5b3996f1e453", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630517929, "uuid": "b81ee275-4132-4979-8eaf-9501015a5eb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630517929, "uuid": "e0d4e34c-6c15-4211-a3cc-73a28c30a421", "value": "543ed8a17f16ce5b16b7c33702111dbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2a1ec8-0b35-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630508406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508406, "uuid": "111c331c-f0fa-4596-b3b2-70323c80319b", "comment": "Malware payload (Mirai)", "value": "b4b9a3939e5286965ee6213d8b102ee8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508406, "uuid": "35e131da-3337-4238-b25c-048edfd145d5", "comment": "Malware payload (Mirai)", "value": "b5acca34da7c5354460927613718da4f50455b4674e97754c34e81bf561a45c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508406, "uuid": "47be8372-858e-46e2-9c26-fada19ffd75b", "comment": "Malware payload (Mirai)", "value": "a0f9d67f2f4818fc1a6cc660f46c1e4dbd3909b0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508406, "uuid": "d67c8e9e-fca7-46f9-9734-67cc9594140b", "comment": "Malware payload (Mirai)", "value": "c1598c91c649619945b38da1b85098bca8cd0a8b4e661f567c7d21b33c8fcbd66ef3766f0b12202418007e3856b31162", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508406, "uuid": "9a23e4e8-9bdb-4629-8ccc-6409215b4713", "value": "T180433B59BC929B02C5C151B7FF1F4289772A43A8E2FB33039E256F20378796A0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508406, "uuid": "7b1cf149-823d-4026-96cd-46e5b52b13fc", "value": "1536:nrS6jlb1FNUCkXRkPOO8N5PdE3xKv3TJ:pFNykq5mu31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630508406, "uuid": "93f04ff0-23b1-4569-8d17-39603999bc48", "value": 58696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630508406, "uuid": "55825563-111e-4434-aeda-0f100d614636", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508406, "uuid": "9236d78a-842c-44b7-8002-473ba7accc44", "value": "peach.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ef3b00-0b2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630506065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506065, "uuid": "82bd4541-adce-4145-9739-23de1bc721d8", "comment": "Malware payload (SnakeKeylogger)", "value": "7ebc9d7ca6d0e5ae24bec8272f4a00bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506065, "uuid": "26f26e00-a40f-4f94-adcf-72f0fd2deac5", "comment": "Malware payload (SnakeKeylogger)", "value": "b5ec7f78185a787382d36904970a9635691ef6034a9acc501008eb817e11d07e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506065, "uuid": "af38275b-2bfe-4b30-9394-077399198724", "comment": "Malware payload (SnakeKeylogger)", "value": "b94ea61b837ba2cc51792d383ba3968caf4de896", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630506065, "uuid": "fabfd565-228b-4aa5-8028-25ca1748f123", "comment": "Malware payload (SnakeKeylogger)", "value": "e45baeb651752f6e2f825dc48d209876baceefac2a9aeae5bd6c85e0519efa3e90a65572bd58cc40c6387b448ce26f26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506065, "uuid": "d8554fe4-f3e3-4100-b4e4-e3af68b65e4b", "value": "T17B85E122B2D1903FC1334A3D8C5B6BA49939BE512E39B54B7BE61E4C4F3D2826D151E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506065, "uuid": "821f9cdd-dfb4-4a2b-a9a3-139a1d779304", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506065, "uuid": "7eebbaff-8171-49f9-aba2-dddf6314ae89", "value": "49152:znsHyjtk2MYC5GDIvRSRms8f+44oatajgCNgkUv:znsmtk2aNXT+Ogr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630506065, "uuid": "10c2f82f-e589-4b14-935a-22aaa0072e81", "value": 1760768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630506065, "uuid": "6923fa59-4297-4358-ae84-c12915c4b6b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630506065, "uuid": "23cac74f-8dc6-4a7a-b812-5ec8e7d1b124", "value": "URGENT PRICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5e3b05-0b58-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630523606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630523606, "uuid": "88c45e92-b612-4156-96a3-b0738b3faaf0", "comment": "Malware payload", "value": "8a89671224434cf041116884213d7166", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630523606, "uuid": "ebf43037-927f-4fb3-b259-c59281728433", "comment": "Malware payload", "value": "b6c20b3a2c6ecd2f50faf45c41218417dadfadc6b4230ca7c8fd1e4439d1046e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630523606, "uuid": "c2a8bdc4-1ae8-4b17-a4e0-8c00c4aac405", "comment": "Malware payload", "value": "db0d72b93ed4483075d51f278767f63787df1990", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630523606, "uuid": "93be3ef8-2d3a-4646-a22c-ab86b154dd64", "comment": "Malware payload", "value": "97d0ac1d2cb04f4acea84b1399901c8d2f4c78b477816c792fe3ae7748fc4864ba7248626bc27df6689c01eca9203452", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630523606, "uuid": "fddc94e1-f814-4bb7-824d-2837f33a347e", "value": "T1C426332F2791D0B7D8DC073449C54FF996667E599C04E81B2F811B6EEAA93A2C706333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630523606, "uuid": "0fc519f7-cd09-4470-92bb-05ab8785d82c", "value": "2617ed69d5fa8c0972283727d551e89d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630523606, "uuid": "c77b54e9-daa9-4965-ab58-8ed41fde5213", "value": "98304:hv1Ien0lEuPLzWdMA0ZHlBWxO9ujyb1U6h3b:34kMAYl8xO9cwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630523606, "uuid": "12ca7cb3-8bf2-4540-93b9-8cae546255c7", "value": 4628008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630523606, "uuid": "884501f1-6b03-4588-ba01-b27d6026e094", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630523606, "uuid": "3a469da2-1bbb-44bd-8ea7-933f00464184", "value": "8a89671224434cf041116884213d7166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a469342a-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482786, "uuid": "bef85a09-3f1b-4b05-b678-5846cf204704", "comment": "Malware payload", "value": "a2af4b9b0d6d864b89ab08dc2e97ffa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482786, "uuid": "ce6471c7-c9c3-4f27-a74d-1918e3687f56", "comment": "Malware payload", "value": "b703405b7e09a8982fbc184ceadcf2b31df93c8e3d9d16676087b626db657af7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482786, "uuid": "64a7cb8d-cd0f-499e-a026-28929de201a3", "comment": "Malware payload", "value": "5d737545920cdaebac7b2b167e67ef6fa58e9110", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482786, "uuid": "0c81a0b5-d4b9-4dee-8fd6-c73f4d9eea7a", "comment": "Malware payload", "value": "e191adbf1b3c6a5ad7fe2dd9eefb0efa1fc0e62c72b8822b0290b0faf5dd2df743830a0a89c3a2f165ae19575d32b14d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482786, "uuid": "3fb32924-dbae-4670-a90f-d4ec1706fc19", "value": "T13D256C078D45CB93D56842F8BE430EAD2F162B0DE8813AEB315E1DDB7F651225C9E42E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482786, "uuid": "d397c2ce-30fe-4100-be5a-67bfff9ba0fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482786, "uuid": "639be4ae-cbc9-40f6-9761-c4a5cd051300", "value": "24576:h29+WP29+WWm20CL8Y431Kmts6S2ddlpb:hILPILWm20fKMs6LVpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482786, "uuid": "e475eca1-48d9-421e-9096-042548b792c0", "value": 1023896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482786, "uuid": "344244ed-9388-4e79-b914-da83ec57498b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482786, "uuid": "307cc180-3963-48d4-aa54-27b1c19d0a80", "value": "b703405b7e09a8982fbc184ceadcf2b31df93c8e3d9d16676087b626db657af7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e33d8c4-0af3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630479957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479957, "uuid": "1c270a0f-4c7f-425a-8315-82a124f8b052", "comment": "Malware payload (NanoCore)", "value": "e1bdba8cd7ae8d8f3fe039b5ee58b88d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479957, "uuid": "715c2b99-5567-4dba-ab79-fc336f3cf742", "comment": "Malware payload (NanoCore)", "value": "b7f93fdcba04537197b4d1a307bf54da300480074376b631c82c1a2c903a5db5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479957, "uuid": "e7b5593b-dac6-4075-a6d4-13872d3861ef", "comment": "Malware payload (NanoCore)", "value": "b61a538cdbe88e5f9c769006147d64f93117f890", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630479957, "uuid": "2ba74fad-6fe9-4f8e-943f-24db7f677bb7", "comment": "Malware payload (NanoCore)", "value": "aa2f905768ef3222f5b822e91d988895cea4573cf74879c5b5709abc55e03ef5c76ab4cbedb74f709fed7ee7b1406d14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479957, "uuid": "0a775a98-8825-4c4c-8c76-21e0e0424b5f", "value": "T1D7052D7F19BDA1279175C6E58BE38423F0018BAF31206925B6D743164323A7AB5F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479957, "uuid": "020d343e-0815-405f-881f-44a6907aa92e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479957, "uuid": "bc41df74-2bdb-4240-bae7-60c0ace56403", "value": "6144:J85JVCO4nPDZvWekYzl23aPfulMJyn/2ENzDScV33TKtJWTlksz/DrPwjqh3O2oC:JqVCjDZuyTSMGJ3TKTmFDzPMar0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630479957, "uuid": "b0b3de3f-5657-470d-a14c-90ad5063fdf0", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630479957, "uuid": "07c59644-03d9-4c28-b05a-7c3a017746da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630479957, "uuid": "63d0a504-b6b3-4408-b749-4450db66ad0b", "value": "e1bdba8cd7ae8d8f3fe039b5ee58b88d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dfb6cfe-0b45-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630515336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515336, "uuid": "3afa293c-5f0d-4ae2-a202-ed5a6b09b2ea", "comment": "Malware payload (RedLineStealer)", "value": "095ebaa6679cc7425dd85b52c6c114e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "red", "colour": "#EE937A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515336, "uuid": "939b0965-e7be-4df8-84ad-3e70e3a8f5b7", "comment": "Malware payload (RedLineStealer)", "value": "b83f41a64ca1ed8f2a491af90ab174281099fdd7ab4fde6c70a8268ce20d8684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "red", "colour": "#EE937A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515336, "uuid": "cbc02d4a-de44-4478-aa92-4df6b17f6e2f", "comment": "Malware payload (RedLineStealer)", "value": "ab18d0c75da678780042968b146db6c8ef4a5412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "red", "colour": "#EE937A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515336, "uuid": "b03e9f92-5472-46e1-868d-7eedf8417e5d", "comment": "Malware payload (RedLineStealer)", "value": "5d39ff37b4ed00db206884ffc8e065b2ec4f5175eccdced50cd1dba8f6519adf2074562fc61c9d3f6e7164a5948da88f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "red", "colour": "#EE937A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515336, "uuid": "1f75cff9-cde0-4e93-846c-3c53b7c3e472", "value": "T166152C7E15BDA527D122C6F58BE78423F0109BAF7120991876D757264363A3AB0F332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515336, "uuid": "996c99b1-ed45-4e55-b936-3a82945bbd7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515336, "uuid": "5a5f171b-be9f-4ca0-ab41-0844539c0813", "value": "6144:fyyRr5HWlnVdad/YByChzAUrj1lxa68kvdTQpSCmQ5CstvLGyELbMUTKZ:fxrUln/0ChzA+lI6JCLcSiyyjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630515336, "uuid": "4febaa28-7fa8-408e-9f91-6eea4ce22d8e", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630515336, "uuid": "7c0dc7e2-ba11-4273-ba3b-36854991f1b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515336, "uuid": "fe5fd49e-eefa-49db-a6e4-d10300d9d83f", "value": "DOCU_SIGN8289292930001028839.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ca4268-0b37-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630509229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509229, "uuid": "70498c4c-6d2f-404e-aa7c-47954907ba53", "comment": "Malware payload (Formbook)", "value": "d23c720e800a557d04e4c0da44e57130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509229, "uuid": "5a8ce2fe-f065-4dbd-b999-dd470354fce1", "comment": "Malware payload (Formbook)", "value": "b9c7b6e3537f8278ce7338f46ec1b658bb0ed0d9cf5b4c04e8d6427ded11f7b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509229, "uuid": "6dee70f8-8836-4af9-b73c-de48c71e16b3", "comment": "Malware payload (Formbook)", "value": "58312eafc99f167d47a94fb47b6968d480ddc8fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509229, "uuid": "f6f32287-9774-46e2-b20c-d3a7d9120742", "comment": "Malware payload (Formbook)", "value": "df0e8d1814cea8f5d81952b9f31ccb71d7b0d0a6d6628a37480b883f9959fc1c768af74ee856bb2eb14916451b3a998f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509229, "uuid": "28863750-8c43-459c-91a0-ec82ab12770b", "value": "T197B4E08D7750B1DFC817C976D9A42C20E720A4BA431BD647A45326ED9E0E69BCF0A1F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509229, "uuid": "02fe1201-912e-40ad-9ee4-e1033fc787e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509229, "uuid": "2860f20c-4a15-42ea-94d2-62106aa1c54f", "value": "12288:44QeWgRDXEFUbcY+F3KuNCcgVyoaA5BW9zIVj1utvpxh059sIH:4Re95XE8wKuIcgzB5VjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630509229, "uuid": "09103a83-21b3-429f-aa86-61a21e3efd73", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630509229, "uuid": "9eb656a1-5ad5-46c5-bd3f-9aa543279e0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509229, "uuid": "7b6d9d93-a571-4a74-a2d0-9a70c4e570d5", "value": "Factura proforma # 65476_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4013c941-0b03-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630486912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630486912, "uuid": "17798b33-9c4e-48c3-bed2-e7e05a12e3a3", "comment": "Malware payload (RedLineStealer)", "value": "2115abb3b850a690a74ea252deaa710a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630486912, "uuid": "74c6138e-52a6-47f2-87c7-f4d71bdcec28", "comment": "Malware payload (RedLineStealer)", "value": "bb2a56b2d08dfd580aa7918d7f1f844959bee7f3b868488c5e2e932c9885ec32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630486912, "uuid": "a76c2467-d439-47d5-a9d2-ce4860c30d2b", "comment": "Malware payload (RedLineStealer)", "value": "8e42491122339c022ee5c6cac17e547bfabd4e2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630486912, "uuid": "0b36dddd-ed13-4037-b4a6-81a31bfc2e2c", "comment": "Malware payload (RedLineStealer)", "value": "e7d2faa6f02efae3393a67fc7e331da7076ed073781e7ab43fc49a36f4ce5091c3f1b48ce1f1c38add7935ed029bb366", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630486912, "uuid": "903a3c78-f7b1-4f49-96ca-e0d563d8a798", "value": "T119D4B928667FC01AC0E7EAB12DDCA4FAD99A94E3640D76331174633B8B11B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630486912, "uuid": "f92b84e9-bb8a-4d1e-bbfc-10d0dcc2c635", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630486912, "uuid": "8d3f0c5f-34ff-48b4-bff1-2834cb0c0b27", "value": "12288:iFQXX1C7b94xV/sJI7nD68b618g6ggEfzDehxTjUZW2H82h:CIOsRnDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630486912, "uuid": "a3153f89-79e5-4dd2-acae-b43ed270e5e6", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630486912, "uuid": "d643f10c-11c2-41fd-8e0a-e31275c58342", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630486912, "uuid": "4ced4818-6c1e-4173-81a9-6033563a100c", "value": "2115abb3b850a690a74ea252deaa710a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0b6633-0b26-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630502017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502017, "uuid": "780b742e-b67a-4403-aaae-28b5dee3bd7f", "comment": "Malware payload", "value": "646a834ec948b6db89bcd0d69a4f6d9d", "object_relation": "md5", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502017, "uuid": "b61a5112-cd64-48ce-8ee6-ff1b2a428ce9", "comment": "Malware payload", "value": "bb4d97cd6a1f44197e517df0937012ac9ffc9d7752c0a6e9a631862561bdd80a", "object_relation": "sha256", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502017, "uuid": "111f07fd-d156-4c28-9227-311833c09823", "comment": "Malware payload", "value": "abfadb14bb78009a39772d206ea16ef9665ec97e", "object_relation": "sha1", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502017, "uuid": "1447f29d-f6bb-4360-a2a4-c1697243ff1f", "comment": "Malware payload", "value": "209041bc06666e1f671aa70b0d5d35a5946b0abc56449d808c3bec78d6953b611fa47449008be95e89d3bef9734db165", "object_relation": "sha3-384", "Tag": [ { "name": "LNK-sample", "colour": "#61669A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502017, "uuid": "0dd219db-93df-4dc9-bf27-0b6b59dd1b6e", "value": "T1591180C7B2DA5011C3EB7FA0BB8B91C47CFD56762AD84410E8D548D1BC27629B36F905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502017, "uuid": "f5c0809a-9d10-4eb6-b7b2-f2d8aa3c408d", "value": "12:AfhkOwNICDzhkOsNMBeDqML6f+bLVALv7DqMLvc40Ic45f+bLVA14tRkF2qgrfTW:WClBehmWbRALThDn7WbRA1A9hTVY72tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630502017, "uuid": "0d40e8be-5ccf-4d4c-bc61-4514cccefa08", "value": 882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630502017, "uuid": "cf944558-ed84-4ca7-8668-998a71e760fa", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502017, "uuid": "cfa4fef7-f3c7-4d6a-bea4-027dd102338c", "value": "lnk-decoded-4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510613e6-0b41-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630513570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513570, "uuid": "70335ce8-c986-46a4-a8e1-9c4a0b881da4", "comment": "Malware payload (RaccoonStealer)", "value": "852157fbd89ccae5baff8172e7bbbe6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513570, "uuid": "2262229a-40e3-489c-96b8-18023a52fd2e", "comment": "Malware payload (RaccoonStealer)", "value": "bf0c11eae9de14227141901dffc7bdbd1ecb9b0a2cb1e675f7d36ce5eff0679e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513570, "uuid": "41a2d8a1-0483-4b17-ab09-eb61d24fbc83", "comment": "Malware payload (RaccoonStealer)", "value": "493600901a6b74b217a5c886c403d9bedb3c126f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513570, "uuid": "3869bb67-6c6c-4c6e-8e19-796a553d3370", "comment": "Malware payload (RaccoonStealer)", "value": "ece99130f1477893dba5e3a522b0526ecf0324c9d1601e6aedb10f00cf48fe0a9b66a8a40e0f13ad7ed5a649e3c086cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513570, "uuid": "03e0dd1f-97cd-4b50-8cd7-da33b2b8e399", "value": "T10D3633B5B1658A6AD429C8B3677277EE2EF4C15312826728B3624E8C3F41501FC1FE76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513570, "uuid": "74e7bb9c-994a-475a-a0aa-fc061781179d", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513570, "uuid": "f6d9a47a-f099-4c79-837d-46d4dd2c89ee", "value": "98304:yXmTuJH5FPywbQ/zpgXGfVfhYB726W9B/VIPGbgKVZ13:yXmqRPYppdfZfVIPE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630513570, "uuid": "5504b1c3-076c-45c8-81c5-fbbe35d74594", "value": 4960311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630513570, "uuid": "24c66e9c-3174-4bb2-9fdd-5f44c5099b05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513570, "uuid": "39928949-1b0b-4663-8236-ca74996a1c5b", "value": "852157FBD89CCAE5BAFF8172E7BBBE6E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940182ac-0b71-11ec-8fa1-42010a9c0011", "comment": "Malware payload (LimeRAT)", "timestamp": 1630534298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534298, "uuid": "1bda1346-3a48-448f-bf6e-f53c3f740183", "comment": "Malware payload (LimeRAT)", "value": "0da6459b4a96fcbbaddd62302b6fdb53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534298, "uuid": "9663f90a-7b21-4ea5-94cf-58e046bc74a7", "comment": "Malware payload (LimeRAT)", "value": "c099fa2ba2c8b5ca61c360db0e77079a2ea3d60e810200d2efb65dcd4a718877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534298, "uuid": "cd9e2e28-08b3-446d-b068-e6e1b3381424", "comment": "Malware payload (LimeRAT)", "value": "5bc4aceb282b835bcc6366b6d39b73476e200f08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630534298, "uuid": "6d1646a1-2a85-4656-a5a6-74108430a106", "comment": "Malware payload (LimeRAT)", "value": "914ff64dcd46d23d761c2deb693a91fa5a13047d6060ad9f4b3813c007655f4ab25708a6bdf0bdda4813c4b607d717ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534298, "uuid": "a7913077-12d7-4bb8-81e6-88f9bd2f590e", "value": "T177D26C1077E14345D2EC1AB50F71A2550FB1EA0BA93BFB6D0CC550971E6BFD18B84AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534298, "uuid": "fe53c339-f653-4924-80de-e028e7de89ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534298, "uuid": "4a723785-a718-4173-ae9a-fbde5ceae2ff", "value": "384:NB+Sbj6NKQfA6h5AH9GduWeqDtGOwdvDKNrCeJE3WNgVYlrj219y3o9TWhQro3lo:npQI6h5w9+TGOwd45N3l3Y9y30Aej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630534298, "uuid": "bd438e6e-e540-43a4-8cdc-34424feed117", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630534298, "uuid": "5ffc1da3-eafb-4d68-9e51-7bf1c11d9dec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630534298, "uuid": "1ceb94af-cb5a-46d1-a277-4bd00d9b0981", "value": "0DA6459B4A96FCBBADDD62302B6FDB53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcfbbac-0abe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630457408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630457408, "uuid": "de734b9b-4efb-483d-a42c-ec54c21191f6", "comment": "Malware payload (Mirai)", "value": "7b583a2fb1ad5a01f27c94d571909394", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630457408, "uuid": "8463ce94-8eb6-4b1a-adc5-cf6c0bbbd86e", "comment": "Malware payload (Mirai)", "value": "c431687a18082b788585ecd5b03f479485a877936e746fd810e491dd5a868d36", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630457408, "uuid": "3a81b662-79a3-4e2d-9593-3645a15ea3c7", "comment": "Malware payload (Mirai)", "value": "793d108e24c990cf7a612caa69c2b3d992f80034", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630457408, "uuid": "4192863a-6517-4fea-9598-53dbfa9ec8d5", "comment": "Malware payload (Mirai)", "value": "bf7456debd11812905d91bdb334de46437232ae6c2b628aacbf88530af9c73519e1c01dd747b1b681e50f3d48daf5eb5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630457408, "uuid": "8ca6e78b-0fe1-4b29-a24b-1ae314a6ec94", "value": "T1ED435BC1A653EDF2EC1205B52036EB727AB7E13E2128D957C3E9A873ED42A43D11724D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630457408, "uuid": "7899df07-7aad-4e8c-978e-75af08252dae", "value": "1536:koP4V8eC6qDzurFYzEvJ1MBOEF/pfc5J2PVrIrISos:k9VFqD6huoJ1MBOEFBfc+9rGISd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630457408, "uuid": "4fcb9f99-0164-4dc6-b23f-a3334518cf9e", "value": 58592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630457408, "uuid": "2e8bbd54-c2fa-4d7d-a38d-4eac3836eba7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630457408, "uuid": "6196b463-b049-4149-8e4a-efa2884765bf", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae15f75-0b38-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630509935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509935, "uuid": "1f6a87a8-a818-4fc5-b93e-a7cf1f1b35df", "comment": "Malware payload (Formbook)", "value": "6a6119c0de7a594dc63fd62153812a39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509935, "uuid": "b86a51fc-e3fd-4cf9-8844-4469107810d3", "comment": "Malware payload (Formbook)", "value": "c44b1ee1b7cd66260ed15839ebaa8fc97be83e5b61007a14384f86e14ecf4a20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509935, "uuid": "b149264b-d432-4c8b-b62d-5d44c5eb7599", "comment": "Malware payload (Formbook)", "value": "f8eda2516bb91a32563c481040d7a25632be727d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630509935, "uuid": "d788125f-3b7f-49b6-b08d-9dbfbf6b0b5e", "comment": "Malware payload (Formbook)", "value": "662eef693fa54effb2e00d539053103ab652a6edb15d14a0a395543900e96e639e872f8b5220450ba7cbf60acd42a3d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509935, "uuid": "d762e5af-ea84-4b1c-b4ea-f7a38b68bdfd", "value": "T1D4B4E09D3650B6EFC517CA769AA41C20AB70B477930BE243A05315ED9E0E6ABCF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509935, "uuid": "0ea8e676-f303-4f48-8288-0ab7f463c7ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509935, "uuid": "d98aadd2-ad88-4727-9d14-f9792a67efb7", "value": "12288:5hSSNPSo0rY47QKzdx5E2oU+NuADyQGWaN3A9Pb9Wk42+QDbHTARftpYg:5REPQQE2Q2WzPb9W7x8bHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630509935, "uuid": "07c7f1ce-a4f4-4d16-b05e-203ecc38cc32", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630509935, "uuid": "3832ead6-a5aa-495a-a314-62292d3ab1e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630509935, "uuid": "0227d7c5-beaa-4453-be7e-8205eb9d5c33", "value": "6a6119c0de7a594dc63fd62153812a39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9687ca5d-0b42-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1630514116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514116, "uuid": "afedcf55-f035-419d-a908-4a4e548d718a", "comment": "Malware payload (TrickBot)", "value": "534ae3d02a470ce727a5eabdb751d22f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514116, "uuid": "d10fb635-50be-4a82-b026-24ed6727be17", "comment": "Malware payload (TrickBot)", "value": "c55623ca7391cbfbbcdd01a912b6de9893d9989775a4ae5845e2ef659375f162", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514116, "uuid": "379d8603-7690-4bea-81b8-b1ace37230ed", "comment": "Malware payload (TrickBot)", "value": "2e18cfb987fcf5e70202a50e94f919965ecf387e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514116, "uuid": "f7f96b36-c6c6-4e9a-bb6f-b753f3535fb2", "comment": "Malware payload (TrickBot)", "value": "d32b313bdf6aaedb684759ae5f484df442ca882d509973a0170575ed154575c4c697c500eb777476f9a61e1a58de5f6c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514116, "uuid": "85b0c375-2333-4d11-a8a9-f771907798c0", "value": "T1E57402317290C0B1C16E15322876CBB61ABE39129AF044DB7FF52B7E2FA02D15D7935A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514116, "uuid": "b8346738-ad6a-4c11-8373-540807377e96", "value": "9b1adb266f8f339c45ccfafdc830f22f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514116, "uuid": "a9139a88-006f-46a8-8ec5-e4b4190df4f9", "value": "6144:bsGb+3pDbr68feSS65+RH9IgOmUQdOfAZ3xirQAX57LIgbo:ov3p/rVfeS5+RtIxKWQA9jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630514116, "uuid": "89674e0e-9ada-4134-a8f1-f499c38eaf2d", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630514116, "uuid": "b317350b-fde7-4458-81cc-19ad6def9397", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514116, "uuid": "7bf1be98-e596-4cc0-b140-3addb8622099", "value": "readytans.png.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6301c0f8-0af5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630480958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480958, "uuid": "c69e2206-80e6-462e-b8ca-b772dcfc6d40", "comment": "Malware payload (RedLineStealer)", "value": "6df8e56887ef5c3a81dec8c2623df122", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480958, "uuid": "0b183185-4c46-417f-be2e-f5cbfdb7a206", "comment": "Malware payload (RedLineStealer)", "value": "c5749c5654d0508326fdf6a51dd8ec091724a6beb711654650c032ab618e9749", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480958, "uuid": "658fd431-adf6-4b6e-812a-a6e7200b1a1c", "comment": "Malware payload (RedLineStealer)", "value": "09b2d60e5d1750a670b134730130a0b5ebad5458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630480958, "uuid": "231bfd6f-595f-4068-9976-8d53df72f2c5", "comment": "Malware payload (RedLineStealer)", "value": "87e5111ee4379a253bac158aea56218c22ecdf9785a87df54b4f8237326290a997314ff85337961b365ddbcbee9064db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480958, "uuid": "e469139b-db08-4d0a-9d9e-200d7bd56c5b", "value": "T17734F02075B0C0B3C59204314C91CBD1A6AAE925A7BA41473F5B2B5F1F72FD18B2BF56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480958, "uuid": "5ea7f25b-4409-4660-a13c-5c7114593e74", "value": "eff27d48d68df0af1612601744441acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480958, "uuid": "903feb3b-4498-4717-ba38-54140e7aa66b", "value": "6144:lsRfwMUgiKERL8awZ1cnX583W9BPa8pgFnL:lsRftiKEidKX5v99yZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630480958, "uuid": "c5ded41e-b334-4442-ab80-89dd011c41fd", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630480958, "uuid": "b54da8f4-ecaa-4d36-ab37-a3da2ae02429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630480958, "uuid": "db01b4b3-9d67-4a5d-b4ef-828713f2c567", "value": "apinesp.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d693a4b-0ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hancitor)", "timestamp": 1630471902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471902, "uuid": "0e0e1b73-e79b-4509-8e0f-30f4efe8f310", "comment": "Malware payload (Hancitor)", "value": "3e01a8a619516bd010173ffe7d029008", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471902, "uuid": "0e95f5c0-0896-45d8-ba47-2d59b05a3d3b", "comment": "Malware payload (Hancitor)", "value": "c6bf9d0300b6989a4f5faf48aaf85cdd7aed278f70d8d291813070614bf45e41", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471902, "uuid": "c6086a98-ddd8-44f2-afa6-6d079bc14b43", "comment": "Malware payload (Hancitor)", "value": "862c2ad050d653f0c6faa9e26979fbb80312143e", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630471902, "uuid": "22f1874c-c974-41f7-a32d-79e0b70b7e0b", "comment": "Malware payload (Hancitor)", "value": "521dad63620b89a6cd48ff4ecea6e0ec27570bf329ded91d046a462752445ccf920e261d40e679b9e709025fa434a764", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471902, "uuid": "33ddf6c7-4fcc-41c1-92fa-ac8c8fe0f940", "value": "T1EB94E007FA55CE57E18AC7787FA2EAA92B69FC048E08B3C731653B1E6F752508C03615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471902, "uuid": "aad4d2ef-bf4b-49ee-b019-3ad7a4d022e4", "value": "12288:AV9iQsDr8N7ClDfKTFi1w06/vbOes1AOrk4X:AVXkr8NGNfKB30AOesog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630471902, "uuid": "3512d523-049d-4541-973a-c50150c81822", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630471902, "uuid": "4cde3e0f-9f11-4993-b954-e67133f64915", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630471902, "uuid": "580658f9-b8a7-4c98-b25e-5952f8611283", "value": "0831_3848557743.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28b9584-0b47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630516337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516337, "uuid": "719c21a8-da36-46b7-ba7c-d3a2afbdb66b", "comment": "Malware payload (Gafgyt)", "value": "8f6ec5bb744be1627b94ea39aabca9e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516337, "uuid": "26a9e146-a8b3-4924-b5c0-1dbb4284e953", "comment": "Malware payload (Gafgyt)", "value": "c77725dfddd46bcf43b41a4673d5e826c613bcf2f409751faa35fccfcaa218b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516337, "uuid": "ddb08646-2ad5-4cd7-bc29-7f383280c1f6", "comment": "Malware payload (Gafgyt)", "value": "3c2adeaae1c1c5abff0272d817fea01de87671ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516337, "uuid": "1b0ee46c-e091-4ce0-8901-972e93f426b2", "comment": "Malware payload (Gafgyt)", "value": "882f4de5fa598a99f0a427034237d5dd42e1bf5b426dbc9571079562cf56d9b8ad096f61fdbae2461a71584234600dd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516337, "uuid": "97b06cb8-93bf-4f50-aee0-34d19e219d27", "value": "T19D041B08D810572BC2D327BAFB5E528E77371BE867DB33219A345AB42BC176D1D39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516337, "uuid": "14af187b-082d-4d1b-8f64-9c90493e27ae", "value": "3072:zd0bOy/aN94a1wz68jdo5hUzpeDy+mB+acgN3mzQLnh0XCtB:B0KWaN94Vdo5hUMy+mHN3mzQLnh6CtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516337, "uuid": "c0242f83-8389-4127-9ed2-da92610aaf0b", "value": 174879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516337, "uuid": "4539e120-4b68-4aef-ba8b-30438a7985ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516337, "uuid": "5a6f70b7-e19f-43f8-9657-2162ff44da18", "value": "8f6ec5bb744be1627b94ea39aabca9e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2dc80a-0b22-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630500297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500297, "uuid": "20aa8b63-ae25-491d-8031-a8130c9b2c48", "comment": "Malware payload (AgentTesla)", "value": "5782ee3c10c5756c46d695ada0a424d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500297, "uuid": "7f023a30-22ed-4af5-b0e2-68a997edd706", "comment": "Malware payload (AgentTesla)", "value": "c7e5a4c22f94183bb4d0b37660892756cb34f755c58dd54bbcb14853fcbe959d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500297, "uuid": "ce6dcedb-17a0-4c00-aeec-89cf7d33106c", "comment": "Malware payload (AgentTesla)", "value": "63362c00d0a09ffb6b631bb76204302c88dad258", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500297, "uuid": "7b99547b-d8af-46f5-9e20-79e3eb5c3874", "comment": "Malware payload (AgentTesla)", "value": "3e1ac9c1784daa787c46e7459d2b4d74def935bfcb3c4533bfb34be69ee29bfbf789b5f78994cd9c1b81d685fe8906a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500297, "uuid": "6dbbb351-4b84-42f4-b66c-29282360a601", "value": "T1A8F40B7F19BDA1279175C6F58BE78423F0018BAF71206924B6D643164323A7AB5F332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500297, "uuid": "7a1a421b-c8a8-47c8-a7f7-8dcf1953dc30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500297, "uuid": "ec368479-db94-46ce-ae05-2b117edd1415", "value": "12288:qzaMBasIRHa/2rCzMTTHJvpj96mgAVKefQyUWG:quBsI8/2xTdp4p4KefQlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630500297, "uuid": "d5115f25-9b48-42c1-b6b5-e7864203bccd", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630500297, "uuid": "56077cfa-d9b2-466a-9565-676f34eaf153", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500297, "uuid": "1e159312-d93d-46ba-8e97-4363a582a795", "value": "Scan copy. pdf.........................................exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e13b82f-0b26-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630501861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501861, "uuid": "d2410fde-1dd6-4c5c-88cb-3f2b93ed350f", "comment": "Malware payload (RaccoonStealer)", "value": "df4af06566b11749aeccd17f1d0801f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501861, "uuid": "5bb061a0-e516-4c20-8190-0b7268bb16e6", "comment": "Malware payload (RaccoonStealer)", "value": "c8c136d959b8815ef99e16640525758e0ed9a5596275f056735752b351ae5972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501861, "uuid": "17e82643-e983-450d-9349-a3c8d86edbb2", "comment": "Malware payload (RaccoonStealer)", "value": "ae2d5280d92c8a8a1c74e3e1816aeae58f88c0df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630501861, "uuid": "40723705-d886-4407-9164-417a7eded896", "comment": "Malware payload (RaccoonStealer)", "value": "7493832a1846668ad419694c8d3ca1cf9dfc10b5f4736b9dc329b0f83f252dafa2123e64e4849dc967da5e0a31feb769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501861, "uuid": "17fbdf77-3938-4f4c-a898-18bc3de6915e", "value": "T19AC4F10B31A0DC3BC6B106714EB5D7F94A26BC699922C18777C5765F3EF4281AF2630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501861, "uuid": "1a3eed04-563e-4726-bed1-cf15c2509410", "value": "7449bb1bd2f7cf11b31b665cb048bd37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501861, "uuid": "1cb38de7-fcee-4f7c-baae-20d7865eda31", "value": "6144:/paP8LMxkVmCPGN3xTsRIObboJyEhKk4Ox8d5oXT2tGC7NQ5YrxbzChBNOiIanXD:/gP84xeaFh6EMOJe7258sKaX59Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630501861, "uuid": "38a646ee-b4c0-4a7b-8170-7797f6b6208f", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630501861, "uuid": "c1e47fd3-b622-4fe8-a322-078ae8449b1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630501861, "uuid": "9e49469a-9397-427b-ac41-2c18b02198ee", "value": "df4af06566b11749aeccd17f1d0801f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5142c3f-0b2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630505121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505121, "uuid": "f1455e8c-8400-4845-aa6d-8ca11fd0c35e", "comment": "Malware payload (CobaltStrike)", "value": "51f74345e238dc05d38380945e6b148e", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505121, "uuid": "cb9645ba-464a-47cf-87bb-c172bc21c60f", "comment": "Malware payload (CobaltStrike)", "value": "c964cfad2aec27cdbda404a6b5c08b7fbabd5a90d37bf9ad56b16837aad72496", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505121, "uuid": "401e91ea-7bb0-4176-8b2c-8226cbd91eef", "comment": "Malware payload (CobaltStrike)", "value": "ae1968a9a35ecdb7c9a0ce81792968137d45270b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630505121, "uuid": "3f283301-08cb-475d-9099-6979bc2feb54", "comment": "Malware payload (CobaltStrike)", "value": "e1e2a96269bfa2944c0d70e02d7b6f433fd7434f72c3e8af531402d26ddd5bb337369e505c3bab278d8c6bd06d601a11", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505121, "uuid": "d9609b1c-c6a3-4cb4-81b9-53a6f2bb9a91", "value": "T1D964393A3B95D4B5C5D585F26A6DAA18842C6B3C17A00CCBE3C07D6EE9F50C14BA1F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505121, "uuid": "50970be6-284f-4bdd-a90c-81c92b55b8e5", "value": "3b06bdb2bd9c293b03f5f6895108a59f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505121, "uuid": "f97ec800-cfa2-4e5f-8ed7-3f0365678a23", "value": "6144:n123oleZt8qLFxsQjJ1svZba6NVzh+JGO/I4tNlOYBGOA:n1ETG8h5tNMdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630505121, "uuid": "eb42d4c6-3955-4af7-845c-701f6205ec40", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630505121, "uuid": "07525a41-4de6-40bc-8ad6-06d6f7606642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630505121, "uuid": "849dafe4-e951-4c9d-8c13-3dae7495b90e", "value": "51f74345e238dc05d38380945e6b148e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e968f370-0b64-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630528858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528858, "uuid": "ca3504c8-820d-49c6-9a01-d9fc214bef84", "comment": "Malware payload (RaccoonStealer)", "value": "c96a14fc2ed46d98d7f42763977ae2e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528858, "uuid": "5634d485-1961-438b-9932-1d472f083c4c", "comment": "Malware payload (RaccoonStealer)", "value": "c9952fbf329b8a9b3400196c5bfefb8c48bdb7a8a3c8ff4176dc804aed898f1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528858, "uuid": "bf6d07e4-a8c0-43cb-8501-9e89fb9d2aee", "comment": "Malware payload (RaccoonStealer)", "value": "e4224ef7a0b911c5fb96987550beb968ea70dfdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528858, "uuid": "46eddc2b-9865-4411-a28c-bb50e2fff60e", "comment": "Malware payload (RaccoonStealer)", "value": "d7300c5d8a5fcc9c119a3ff22b2645a47ee7a7e00103775203947c587a6f3213669fb417d4339ff360fd1091dd18b14a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528858, "uuid": "7ad383f0-8923-4b80-bc61-470f751514ab", "value": "T1FF94E00B3291C83FD19445314C6AC7F96A2ABCA96D32C9473BD5375F5EF3292AB12312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528858, "uuid": "bd11a222-4bf4-4326-a7ec-bcb8d09d405f", "value": "6c24281dcaa86901b7166ae3ce878d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528858, "uuid": "c4986426-6e21-4d54-b5a4-a5538069e0cd", "value": "6144:dMdaLCs1rbtCQnB5ZPtSYkdjez09jz9YlKHfdrIanX59EPCmK:dQa9rbtCQBvVdkdyIRz9hfiaX59Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630528858, "uuid": "2233caaf-f1da-4d50-bf87-ffebca66d989", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630528858, "uuid": "057db60f-39d2-47d9-b8e1-553b9dbd624b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528858, "uuid": "acd0d863-e387-4893-95ad-57378319b7e9", "value": "c9952fbf329b8a9b3400196c5bfefb8c48bdb7a8a3c8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e97133e-0b12-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630493352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493352, "uuid": "cd139b0a-5172-4053-a6c6-e846f04afc90", "comment": "Malware payload", "value": "3dd1f137919bc0c5ea0f24b67bd1a79e", "object_relation": "md5", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493352, "uuid": "3cf2579e-99c5-4c18-b63f-345e4955d088", "comment": "Malware payload", "value": "cbae5afb602d7aab2b05d74c52e2477d381296053ccf6446fb983745ddcc08e7", "object_relation": "sha256", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493352, "uuid": "bbe0e907-b45b-4402-8d6c-79b3ae9eb3b7", "comment": "Malware payload", "value": "297f9bd46bbc19a8b431588d6dd4994c8774f447", "object_relation": "sha1", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493352, "uuid": "2580fe30-3677-469e-8807-c4d6b40fef4f", "comment": "Malware payload", "value": "dff749092431ecdf91c88d1edef900009489f7467efb8a3e8195aa368cfa8b2641d40a6c1189bbcf7fb6719fc416cfee", "object_relation": "sha3-384", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630493352, "uuid": "94a79c0c-6ce7-4a2c-bc43-dc96fb490737", "value": "T1EC82BF4ED2C3FD52C2179D38888C1B72E9853988E256D97A1C41B6AE2582B5F47C709F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630493352, "uuid": "c925c856-44fd-45e8-9e63-66a12031a189", "value": "384:AKl9Mwu/lhMqXJaLjtUI/XUIgLvWbRgfQITMaRk:AKlewudKY6jW1DaaYIg+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630493352, "uuid": "48e6be14-456b-44ca-b726-8bd4a0f3a862", "value": 18281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630493352, "uuid": "6cda9bf7-7e98-4194-a47a-95a6f881bb1e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630493352, "uuid": "17da821e-1f51-44d3-b80a-43f05d994f29", "value": "Cheque SUNU.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bb1855-0b23-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630500605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500605, "uuid": "368b66bb-6650-4ebf-8f0a-c78812cf342a", "comment": "Malware payload (Mirai)", "value": "c1e2ee7d4aa2e6d8adda442207cdb735", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500605, "uuid": "26e0af7f-7c38-42ba-8b6a-0fa6b4738952", "comment": "Malware payload (Mirai)", "value": "cbe6a4770c22e2148be8a878098900f76f04cae4adacb5b73c76c673850655d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500605, "uuid": "572874b6-dbe8-4e22-9e4c-3c1de7f7f4e5", "comment": "Malware payload (Mirai)", "value": "da6bf58bc190618584f1292c4dbcc4115878d63c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500605, "uuid": "50467aeb-1c32-4950-8214-14ff7b6c5c3f", "comment": "Malware payload (Mirai)", "value": "55d0e9669d739478aa8f74ec10a637eca38c837cfbc6aa9c2d43d83fb791c2f2ddaa5fdf28c3c2e54729cd74e27423fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500605, "uuid": "26795840-06c7-442d-95c1-095db4bf61d2", "value": "T1EA531795BC928A12C9D423B6FA2E518D372263E8D0DF3207DD216F1177CA82F0DBB556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500605, "uuid": "7e34ce26-d171-49d9-892e-a11e9dcbc31d", "value": "1536:5ZRaBPla/6jOXC/x620hrL2yBCECt5DOlf+xMA:5ZRMdaJBhvZCbD2f+x7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630500605, "uuid": "bd7c4b9e-d377-4b4e-8976-12cf0281e704", "value": 60812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630500605, "uuid": "15f00d74-f2c7-404c-917f-98c998169072", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500605, "uuid": "1187377d-dc4e-47b5-9f1b-89d97ef8581b", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77505240-0b22-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630500320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500320, "uuid": "892d3a95-7d47-492a-ba8d-28bc6c751721", "comment": "Malware payload (Loki)", "value": "53080aa5107f640aa3757b0a522b178d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500320, "uuid": "129052d0-3f23-4374-97d1-5ca76e129ce8", "comment": "Malware payload (Loki)", "value": "cc1bce033901ca892a6c3a9a8781d83c87e319bd923316d006e8de3b5eb205af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500320, "uuid": "4687ba28-bf77-4601-a0ec-6c96d305d12c", "comment": "Malware payload (Loki)", "value": "eacbc62c76f84d6671e7916679922fb1219f0022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500320, "uuid": "294f0ad8-f208-4eec-b801-e741f6061daa", "comment": "Malware payload (Loki)", "value": "ef3f2c745e65182a5c45fabbd03f28c467c84e921d23bf6d3ce954c478f5de8e0e653879a429260b421146dfc38b45cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500320, "uuid": "d08b5f4c-3492-4b34-a1b5-e522bf2b9edd", "value": "T11C94DF9D76A0729FC51BC976D9A82C20D720747B970BD603A45325ED9E0EA9BCF120F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500320, "uuid": "b9edd11c-c998-4c56-b009-615caee58a22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500320, "uuid": "41053b38-8204-495e-ac28-2b43386fc25b", "value": "6144:z63G6mHZDqMjofnjsQAsaisIKoYv3R3J3avznCeESSaHW1YJjOYUfkisqyrfp/zl:zTTwjkisI9E2zCeVnoYUgqyrfp/zrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630500320, "uuid": "03080aff-b0d2-448a-89eb-8d586609f880", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630500320, "uuid": "1e8fec31-4019-4b71-9441-b87c9590e9e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500320, "uuid": "13f184b8-34fa-4bbe-a312-7c6d8bf23ade", "value": "SOA_31082021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a833a5cf-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482792, "uuid": "0b0923ac-a446-4e1f-8463-9a80699171fc", "comment": "Malware payload", "value": "9874b8909941b51ed22850d7a76a4fa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482792, "uuid": "8ead8e0d-3e27-4f71-8201-808452bf448a", "comment": "Malware payload", "value": "cc8af5ca938a532ceca9bf12e5a720171efa4be68ade6a69b28fc048adfe6760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482792, "uuid": "215cf7c4-0eac-4780-9ee8-3b3f9f77772c", "comment": "Malware payload", "value": "9dc27e364f08a40267c863ffae057b6f3fc3f2a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482792, "uuid": "68f39d1d-ab19-4ab2-8a52-209bf20224ce", "comment": "Malware payload", "value": "88051f8701602a48a979c2512696f0da0c0a5554692247ebe64a35277c223f5142c13f3c1a79026c862eedb55ac4526e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482792, "uuid": "6f486419-13ad-4db8-9f6d-0c65f561f771", "value": "T1E4054B138D498B93D46887F8BD430E9D2F162B09E8413AFB305E1EDB7F612625C9E41E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482792, "uuid": "1c128e1c-bbad-4718-b196-bcf0ad996832", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482792, "uuid": "5f468d58-904a-4174-9755-d8f3a8a10bd3", "value": "12288:r8z29+WZLf0nvQUZ3xvKf+pllRaM9+f/peDzpdATkOGvO3TNn:k29+WZL8Y431Kmts6S2ddKDNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482792, "uuid": "3037938a-55af-49d9-81a6-a8d7e0e67d81", "value": 828824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482792, "uuid": "72866f01-5700-49c9-bb09-3d3ae552ff2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482792, "uuid": "9bc75ed4-fa39-413e-8cea-a1702189a729", "value": "cc8af5ca938a532ceca9bf12e5a720171efa4be68ade6a69b28fc048adfe6760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b913e5fd-0b47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630516321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516321, "uuid": "b69fa0b8-029b-4785-86da-fef697794de4", "comment": "Malware payload (Gafgyt)", "value": "dccba36e6700542e8fa883e8f766be6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516321, "uuid": "62e85933-7674-4863-89d4-cbc6e90ab57f", "comment": "Malware payload (Gafgyt)", "value": "cca28d3dc6b09867125ef082b565f65a6b48cbb17a66d353c92a91ca89d3d2ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516321, "uuid": "955b0e81-769d-47bc-bc99-5918fba52c12", "comment": "Malware payload (Gafgyt)", "value": "453412043d03d87c0aed157eff8ec57e1f11415f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516321, "uuid": "98d8401e-2338-4eae-b0a0-30304fc63ee5", "comment": "Malware payload (Gafgyt)", "value": "a9b1c1e7fc9126e315b13eeda448b731af17401f479edf57875030deee9a8218d5c341bad6c2a62cb373bf09711fc337", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516321, "uuid": "d62521b7-f939-47cc-9594-87be1f7667a5", "value": "T12714836AB7A19EB7D80FCD3306E94502118C959A46E92FAFB6B4C51CE38BD0F44E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516321, "uuid": "66d14ed3-b671-4e50-a650-cf1897393e91", "value": "6144:zBvc1Q1FJJxphZRJBbfAtrIU5hUTw0GoymKW6FhdzHrsKO:0Q1FJJxphZRJBbfAtf5hUEcymKW6Fhdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516321, "uuid": "36cb1cf5-fc62-4769-b799-9e1ac91e302d", "value": 200227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516321, "uuid": "82fc27c0-317b-44fe-9d63-8fbfdc95f741", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516321, "uuid": "808e1536-2ab7-4792-8869-73f59fd59eb7", "value": "dccba36e6700542e8fa883e8f766be6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187123e7-0b6a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630531084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630531084, "uuid": "9076daef-4810-4ed4-b427-8a4e021cfee3", "comment": "Malware payload", "value": "f61518bd5538db15ffb8b9c84aed2119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630531084, "uuid": "3006d092-07b5-40f9-a8ed-6960097d3740", "comment": "Malware payload", "value": "cdcf7dceec7c87b052fcab71f7cd3316b2eb1c61aac56cec27844bb679e84346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630531084, "uuid": "0772503a-cbd6-4a01-807a-659a89f727ef", "comment": "Malware payload", "value": "3ba8ba79fef8c360d076b8c2a8daa8de62d960a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630531084, "uuid": "72188c52-ed37-4ef9-804e-62b2044c6b8e", "comment": "Malware payload", "value": "a661049cd9a9f9fa58abfaafef1640e947f8f61c3fff0e904b8c879424196ae5aead05bc5c648f3f6e8cc9bc5bdf3287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630531084, "uuid": "87dfa91c-135c-484f-88d8-13df3de2cce9", "value": "T140F44D3E18FE23279176C7D5CBE08823F2D498AF3233A96567D743664316A4675C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630531084, "uuid": "30858a5b-8809-44d5-81f5-a96d5fda25ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630531084, "uuid": "675a422b-e2cc-4b0d-bb06-fa98733570c9", "value": "12288:lQBD8MwFEg+2FCL3rY7H6xJZ9LBhTc3LzXq:5XF3+2FCoShB5crq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630531084, "uuid": "e3a84baf-eb1c-41d5-a7c5-911bf5850a6b", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630531084, "uuid": "ca205d4a-7f74-4c04-91c0-b9375a755c6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630531084, "uuid": "dc77759d-9fa5-41cf-86b2-42c6a7a84282", "value": "scan_quoatation_2021-9299928928872662772.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4982c46-0b7e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630540017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540017, "uuid": "d1d03bcb-2d22-4ce9-8d42-9f6aeecb47c2", "comment": "Malware payload (njrat)", "value": "8a8edc8ff1844d994d977b703690e761", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540017, "uuid": "1fb55adc-f45e-41f5-a742-d0d396eca86b", "comment": "Malware payload (njrat)", "value": "ce3f49f552210c00b360845000a735879ec0e2e2a3abe6999d7ff0b6774530e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540017, "uuid": "acd502be-8704-4500-8f2b-14bab3a18b8e", "comment": "Malware payload (njrat)", "value": "a84081b23c13dc7e6be2dee4f016d1dfcbd72ef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630540017, "uuid": "c7e67c9d-cf5f-40d9-81c7-c4739ecae176", "comment": "Malware payload (njrat)", "value": "0dc06fdf9b4bca45bfa05ca16dff130471b95cb7993ecf685dc6c402e15886ca2d00d04c9ac4bbb589fb15ab21b1a598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540017, "uuid": "c86afced-44c5-4ed4-ae5b-084609c1d431", "value": "T10DE208067BE94215D6BC1AFC8CB313214772E3838532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540017, "uuid": "012d938c-5b76-4053-bcba-79aa16292fdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540017, "uuid": "4d361b46-e0ba-459c-b61f-aa09a61a07ce", "value": "384:/0bUe5XB4e0XEpOjfrw0Q0mS03AWTxtTUFQqzFYObb9:0T9Bu1j855dub9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630540017, "uuid": "65dff475-9962-4791-adc4-4f27a2ad9f18", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630540017, "uuid": "88f6e602-04bf-4f31-93dc-8b1b17a273d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630540017, "uuid": "eff1e583-bbe8-4bec-9f7b-1fe0cdfaed8f", "value": "8A8EDC8FF1844D994D977B703690E761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c429f1b-0b07-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630488651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488651, "uuid": "5a91f585-ea3e-4ea1-ba31-d0d0f5ce9ea4", "comment": "Malware payload", "value": "81830b6007b3fc185283ad06a88e91b1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488651, "uuid": "e5d90f63-0584-435d-8452-a6515059c905", "comment": "Malware payload", "value": "ceff988490d98c142e4430d0bd52e3bdaa5858f5d7bb4cea095b0e9966a570c2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488651, "uuid": "2e668b4f-658f-4ed5-b969-1d959b474bab", "comment": "Malware payload", "value": "b7d28ee5681f042f4b71d065ecf89867bee34e69", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630488651, "uuid": "e017781f-c9cb-41b3-838b-26854cd2c2c5", "comment": "Malware payload", "value": "de0310a43c3c3cee04a8d6534f92c185041201769924035abb2e5b0d45877feaeb4e46a097a2f19a29fba92a89ddde81", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488651, "uuid": "86d4f642-37dc-448e-80c5-1b0d03ce146d", "value": "T1F3833902B582DF02EA1A02312DE5D79533763D8D5E85AFC736A1BB1EADB8764401B3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488651, "uuid": "f37538bb-c928-468e-ba17-43c7f3f11805", "value": "1536:KANgNpvmbP+srVIEfJTjGQPoQwM+Fpj8+FC:PN5BJ9PRSpj8KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630488651, "uuid": "eb0fdb42-d277-4d76-b925-5b5879322e77", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630488651, "uuid": "ab5b47ca-10d7-409f-af54-27fe679bd48b", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630488651, "uuid": "f5de4d35-6ff6-4159-befe-8c3fc457cc04", "value": "bid.08.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1e1ecf-0b47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630516326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516326, "uuid": "fbd6fe6a-a4bb-4d0b-a50f-6a6ed9b5d0e5", "comment": "Malware payload (Gafgyt)", "value": "32fc4eed5997edb481f6794dcbfb6922", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516326, "uuid": "44479025-ad63-40c6-ba9e-f764d8cef071", "comment": "Malware payload (Gafgyt)", "value": "d028d0fc8c8c59004199ffe44cec9cb6cd50046a46e62980ff53c3cf47603183", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516326, "uuid": "10e13bfb-3ea5-49d7-8ff0-6be3fb62ffa8", "comment": "Malware payload (Gafgyt)", "value": "24e1592a978b7451c15b0cce3bb4d8be709010e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516326, "uuid": "106cd8ff-e884-4b5b-bdf1-2b748e857629", "comment": "Malware payload (Gafgyt)", "value": "761e22380314d267a567d64a4121f1b09e0b3ef895384b94ce5e29f25a804d435571f9bc2a3e3ee1de98bf6cb4b34926", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516326, "uuid": "045a3869-7931-4a59-8574-8879736e6eb2", "value": "T12FC36C86E703C2B3C8430AB2028BAA6F4A21F5BA4E2E8F45F7592CB4BF135C57115F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516326, "uuid": "b3483b76-6bc2-437a-9130-4a557e52397e", "value": "3072:xhqxySLVdmQMFVjjp5UnKSR8V92pnmtHV2AOzjD/AV8xIkAzw5h88p9fdGDm4EV2:xAVDhJszw5h8+fEDm4EVduyVUrFoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516326, "uuid": "72403e66-a210-436b-a11c-ac81e4e22641", "value": 123706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516326, "uuid": "4435b80d-7855-4473-8ce1-fc55ccd15297", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516326, "uuid": "f243ed98-125a-4750-ac25-37854013ff16", "value": "32fc4eed5997edb481f6794dcbfb6922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b915543f-0b7c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630539085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630539085, "uuid": "b269d89f-b5a7-4a96-b1bd-9fec6edbb1e5", "comment": "Malware payload (RaccoonStealer)", "value": "e14442163aa07516e4a8b242d64df1a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630539085, "uuid": "79314de6-be1d-44e0-9a03-81015bc82c28", "comment": "Malware payload (RaccoonStealer)", "value": "d2ceb877de1be0f55c3a9cdb218ff978066f87ae0caf4ee6bd6401c0272c3b78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630539085, "uuid": "ee526ac6-32c7-4565-a95c-51416d3ed6b8", "comment": "Malware payload (RaccoonStealer)", "value": "39a1df5ebe114db8873501eafd06ba5524ff5d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630539085, "uuid": "f0505c9a-6325-42a2-8f42-a6e00c3dec2a", "comment": "Malware payload (RaccoonStealer)", "value": "f6a6f4216725c9296b95531a6acaf7ec93b561d53a2465e07628f8cad05939c271866a8d5fae9327bc0850d7eda08ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630539085, "uuid": "65648bbc-234a-4b47-b2a8-a44caa76645b", "value": "T119B4E020BBA0C035F5B712F865B587BC642979B12B3060CF63C526EE5A346F4AD317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630539085, "uuid": "6bade3f1-503b-44fa-a9d0-a07b71e00e80", "value": "5c93c97e908d457a11b98f665a319008", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630539085, "uuid": "989d6b0a-9b2c-4e1e-8272-1e76e8db0104", "value": "12288:4cxYOWcLoiuQO0PA3vTWK+PWOVy1szok:dYtcQHhvTWP/VNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630539085, "uuid": "a0a9f070-b6fa-42eb-88ed-3921195a9402", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630539085, "uuid": "0cc034c7-18b1-4478-9307-b60fadd93dde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630539085, "uuid": "5f7d12a8-cfca-4867-9688-f7ecf1e3ef73", "value": "d2ceb877de1be0f55c3a9cdb218ff978066f87ae0caf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab084545-0af9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630482797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482797, "uuid": "72e88578-0597-4d63-bea1-82d773f9840c", "comment": "Malware payload", "value": "d47ad896890c673351569eaf95334854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482797, "uuid": "f3407547-dc2b-4026-aec2-cea1d1ab286b", "comment": "Malware payload", "value": "d2ddb3b216a6f13aec2537f159784b8aa971abbe24f79646e867123eb630ef14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482797, "uuid": "69421fa8-d98a-4577-ac8e-63c72e277914", "comment": "Malware payload", "value": "2783f4f9e0ea904f42756fdb1c92e6ff25daf199", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630482797, "uuid": "6524e53a-3463-4b8a-ab08-8e36737a8d89", "comment": "Malware payload", "value": "cd3f9657b3c5c1b48f6a5d354e51c5f17ca948033e03a4d482f1d607118e551c9bee72dd8062e7e3c0784c65e835407d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fubon Technologies Ltd", "colour": "#7280CA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482797, "uuid": "a8e80d37-0025-4dc8-a593-539222b71bf2", "value": "T1F9422926ABE8CA31DD7A4F3128F292440F36B651AC22CA6E554DD00A9F637514FF1BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482797, "uuid": "21718b4d-0eca-41b2-9ff1-62912657f6f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482797, "uuid": "face585e-a849-45f4-8773-a1205c529ea5", "value": "384:wO2EpZmmA/cL/LIIa1eLPLiLibPvbf6TleWBsZsHLsUw:HmbYzZDeeveTlesxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630482797, "uuid": "464142e6-cf93-4360-a06e-16d9da5f09b5", "value": 12592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630482797, "uuid": "49d661ec-cb62-40fb-8f88-f4e0f6a821be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630482797, "uuid": "0c15c556-d527-44f5-add1-7cc5a9002dc0", "value": "d2ddb3b216a6f13aec2537f159784b8aa971abbe24f79646e867123eb630ef14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89844e44-0b63-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630528267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528267, "uuid": "77b99174-0e5d-41e7-9c34-75ae3a901124", "comment": "Malware payload (DiamondFox)", "value": "a9296af40e2b6c379587350610af1e29", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528267, "uuid": "406b0bca-6018-494d-81e1-a288513d48d3", "comment": "Malware payload (DiamondFox)", "value": "d3381a72eea9537847b33b164d5a9da0fe99be82fee18bdae6df3bc44443c6e8", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528267, "uuid": "1474668e-7a3c-4021-8383-3461082132aa", "comment": "Malware payload (DiamondFox)", "value": "a22d771ec5d401e2867ba273b9a7700c3212aee9", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528267, "uuid": "6708b3b9-24b2-4f37-aac0-3ee7e82f0bb6", "comment": "Malware payload (DiamondFox)", "value": "d8be248736a2c9b578753ac0055b8687b79dc48ab370b342d40d26a9af920a504eee6f28b4cf1725cd0580416b0011c1", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528267, "uuid": "85938e72-019b-4ed9-a76f-8453a0ac8635", "value": "T165F53308EFD68442CF156A713F6D9B6A49AA2023DC79D4DF67F93A5C27E6160300BF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528267, "uuid": "66ad1221-3960-407d-a0d2-9f087d76f3a2", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528267, "uuid": "43e9c63d-971e-4314-adcf-4f8bc271625d", "value": "98304:y+f4v0FK2NGPQSwtgyuxdaa3k/YOoZvB3:y+f4MFKjoSGgv4PQzZvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630528267, "uuid": "b3625846-5075-465c-a602-b42959f09c92", "value": 3501215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630528267, "uuid": "6d3a8ddd-d77b-4f02-b13e-6af2f4a02133", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528267, "uuid": "1db3d739-16a6-4a88-8ac3-0d0b46f9ce5a", "value": "a9296af40e2b6c379587350610af1e29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f5447d-0b34-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630508147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508147, "uuid": "7214884c-774c-4898-a7ca-7cabb0c8435c", "comment": "Malware payload (SnakeKeylogger)", "value": "94f1636e94abbf28cf5adb44b1a778fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508147, "uuid": "28d42be5-3908-419a-87d2-0ce5058afba1", "comment": "Malware payload (SnakeKeylogger)", "value": "d33dac65118a88b15580c028deba8f4ecc95ff7d0a316259612264a0b6e06d11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508147, "uuid": "956076a1-f668-4fe8-94fb-1ebe235948ce", "comment": "Malware payload (SnakeKeylogger)", "value": "740476143af4798bc78a54caaa519eda190c9cb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508147, "uuid": "b303496b-4492-4251-89a2-b700d219441d", "comment": "Malware payload (SnakeKeylogger)", "value": "4b4487d33e1a66781d65baedda68a7bd77f35c2092ddd48ff6e4ca00cc6f80459654f93d522b1eae25f4c8e445e521d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508147, "uuid": "4932c587-553e-4ff9-9d70-47d14257f7f5", "value": "T1A515AD3DAD2626336FA9B17CD4D6194EE79414EB23714DE9D1E2B38C200B917B2DA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508147, "uuid": "9672bb9e-00ec-44e2-af52-bac79cfbad6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508147, "uuid": "126f54a8-2442-4b2c-9d9d-1438b679510d", "value": "12288:XC/F84DtPASSVdYiO5GpS4u6C5oWpf0y3k0Vb/AElj8iDxLBYR1p2Z3+Xf6Mei0d:XCfSYqYxm2ZXQLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630508147, "uuid": "3fc3d743-3d9b-4be3-82ef-da65b644a979", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630508147, "uuid": "1bf6015e-82e4-4c3c-aaec-d7c17ad29833", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508147, "uuid": "ab9d0f06-93e0-4eaa-a32c-7dc363dd3c97", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022c925a-0b2b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630503988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503988, "uuid": "d402b55f-e480-4705-98e6-2a28c175b19f", "comment": "Malware payload (AgentTesla)", "value": "c29b10eb9bb66d236536232dac080a15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503988, "uuid": "2f2482ee-141f-4bb6-804c-b18b4aa4c48d", "comment": "Malware payload (AgentTesla)", "value": "d3bb831e904ca390bd809788eea4f5c417e3bdb06ec6f0113a2083153ca4d7a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503988, "uuid": "035d0176-5975-4fe5-8d6c-bc8eae81c4fb", "comment": "Malware payload (AgentTesla)", "value": "168ad1d3024113edd088e8e6887d4d818d9be724", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630503988, "uuid": "3e90b00f-e899-462a-bb68-ecb574a8dd52", "comment": "Malware payload (AgentTesla)", "value": "69b3c71c3c07f7ff8e69b1b00f929e6c9e8704794d821c1c17f26d5da3db00dcb7c730d8d620dd38e0a85d57c9a9ec83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503988, "uuid": "76612856-064d-4601-8f66-79bd77642568", "value": "T137B4E04D725476DFC52BCD76C9641C60EA61B4BB430BE20794A326AD9E0D2ABCF061F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503988, "uuid": "0bd40893-cda4-4e4c-a78c-5b9a8a0583e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503988, "uuid": "23bc3850-55bd-40ba-8b1a-bae5bbe5a5d5", "value": "12288:b1vroW7QmIMvh1+0zhRGPvjCUjuDg0CZq0gcQL0E+1:b1lMm3RQ/wg0CZq0g7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630503988, "uuid": "5a3272c0-6221-4140-a23f-1ad5b9331fdc", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630503988, "uuid": "e2b15b96-2a9e-4578-91f7-66e2e1ccb636", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630503988, "uuid": "44a42201-47a1-408d-9223-d628e383a0e0", "value": "Urgent RFQ #2105031.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf691b70-0b6e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630533109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630533109, "uuid": "830fd458-0f2f-4e93-a581-8d3f596e7283", "comment": "Malware payload (AgentTesla)", "value": "d0a9ab9210d13b671164e15a85492060", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630533109, "uuid": "02b0fd30-d770-476e-a299-b70f6118d81b", "comment": "Malware payload (AgentTesla)", "value": "d4063ea8895f02a2e6c2ac34baf9bf6eabf2f1cb656256e946553d143d9d060a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630533109, "uuid": "65e9328f-a9b4-408f-8755-de64af2ade73", "comment": "Malware payload (AgentTesla)", "value": "9b13cf9c4438eafe08d3c8198ea680b0a52bc45e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630533109, "uuid": "6d59ccd4-6684-4082-8c4c-a6e11fd11384", "comment": "Malware payload (AgentTesla)", "value": "e1d1fe0410ae4f92f6c5564783681a373b0cd0721cc463398f2f203df8bb15a6dfd012692cfe8642a05fb6687b630ad4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630533109, "uuid": "06544c16-859e-4762-8ac1-c57391993703", "value": "T13615DF3DAD2626336FA9B17CD4E6194EE79414EB23714DE9D1E2B38C200B917B2D631C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630533109, "uuid": "6c6d8d5a-bab2-43ca-9f34-6e148fce4efd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630533109, "uuid": "2a0501c2-8262-44d7-8f5c-85ce31caa8dd", "value": "12288:bXz/F84DtPASSVdYiO5GpS4u6C5oWpf0y3k0Vb/AElj8iDxLBYR1p2Z3+Xf6Meit:bXzlIvRtqFaJxLrhzlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630533109, "uuid": "fd4ddb05-5324-4b39-b439-89028cadfaa6", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630533109, "uuid": "e07a02df-68f1-44a9-a506-0d25a7352fa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630533109, "uuid": "c7083c2b-f8dc-4a1d-8e4a-325a0836a388", "value": "L9d4lSc9LF4Yv1t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cfb86f-0ae2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630473009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473009, "uuid": "264f4c50-a6a0-4db4-b190-4674f5b87276", "comment": "Malware payload (AsyncRAT)", "value": "d276798620221712d8a0568c2e292346", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473009, "uuid": "e5f650c5-d46c-4907-abe0-83cf340d0449", "comment": "Malware payload (AsyncRAT)", "value": "d41f459f38552a3608b6825b2245c27105205d0688ae6f3838e94b2e11b6a980", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473009, "uuid": "e6a0390f-c7a5-4009-8888-dfc4d28c34c7", "comment": "Malware payload (AsyncRAT)", "value": "ddfd03a5b0e9cbd1d1c5769a40526eafa8b5ad8f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473009, "uuid": "6e42c10b-487d-4c74-9c75-309cbf1306c9", "comment": "Malware payload (AsyncRAT)", "value": "6605bd213d20cf71ee5ca6ae093530abc3720859ed6b00528f0af376a4508457873ebb9903a9dd0a72e71470dd083bad", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473009, "uuid": "a72ce850-2e0a-4e30-be92-8f04a9d6e91c", "value": "T10E84CF5D7650B1DFC52BC97689A81C34EB20B477430BE347A46325AE9E0E69BCF124F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473009, "uuid": "35cc00b7-015f-4c49-82c7-c5bd9e1bc4a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473009, "uuid": "2dd5eef4-6cd6-4f64-bcb5-2852e8f53d3a", "value": "6144:mfwPlEjoi9sG4T5fqXC1uG1krkdV50y4mc5xpJINqxKi:llEjvGGR2CrwKpxpJINqxKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630473009, "uuid": "112773a9-5f02-4959-ba2e-e677ea4b63a5", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630473009, "uuid": "70c2e0d1-279a-4c63-8bfb-2f7f06b9460b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473009, "uuid": "e2e2860a-bfaa-4509-bbec-8db05d006fbe", "value": "Confirmation Transfer Note MT102-Ref#0126170-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0238eeb7-0b35-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630508284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508284, "uuid": "c917d40a-ccf2-42db-aeb0-e09391d356a2", "comment": "Malware payload (njrat)", "value": "bda6aa1c44cb84f5fefecb0e2f421e57", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508284, "uuid": "a364d280-dbd5-4ae7-b9eb-41780d3fa095", "comment": "Malware payload (njrat)", "value": "d60845023b6f4924993a60e60e1db49c5b6cc9ede4e09560d3542dd5f1bee603", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508284, "uuid": "a09b8439-1f9e-4bd5-92f0-215cc06e2195", "comment": "Malware payload (njrat)", "value": "5ea8bd6abd7d1f78873cb641e812904375000917", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508284, "uuid": "0f7cd285-0cf3-429d-ad87-2a80e5653775", "comment": "Malware payload (njrat)", "value": "0e17ece5d649d11f30872732d3c35f51a2a45b956d0797df700ac2fb7ffcfed10cdfd2a7ec8bc857451a78bb28225297", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508284, "uuid": "107acb1f-d375-48a2-882e-d146c409e866", "value": "T1A4710328B5A8B062FDF608AD8758AEC35CFC002677DEC22327E3F65DD04C91B588D564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508284, "uuid": "309e7e92-484c-461c-b0a6-4d8d88543258", "value": "48:2iMKRkQYvcNzzzzzzzzzzzzzzzkt1zzzzzzzzzzzzzzzDQraKBAdOsQiL6dXJ2GD:2HKtqt2NBAdODgkJjWRZ2rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630508284, "uuid": "cc1d3cfa-eccc-41b9-a9b6-9d5c050f20d6", "value": 3574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630508284, "uuid": "a065f1ea-a102-4f61-a2ad-4df06ddf76e3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508284, "uuid": "9ec95f20-759f-4daa-9a5e-8a8b769aaf3a", "value": "Invoice#1096.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3efabb-0b3d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630511975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511975, "uuid": "9fc47be2-1aac-4210-8a2c-4718b7cc93ef", "comment": "Malware payload", "value": "1edf6c586b08af1a476e662d8de7d66d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511975, "uuid": "d3f9ced7-f282-4f43-a62d-1721ede93a10", "comment": "Malware payload", "value": "d60d78bff124eef29afea9a4324f307627fa46bbccd6fa65c8329b967ddeb82a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511975, "uuid": "56a876fd-fc31-4ad5-b324-d79b144058bb", "comment": "Malware payload", "value": "ee561912f98319b16eea42beaa3a91935f0c8827", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511975, "uuid": "3078ca10-5ee1-4aa9-b8cc-afb3c10bab8a", "comment": "Malware payload", "value": "3857192f390d90c6b4e5c9d0400fd6c09e4525c4068ce6f7bf2c97c130db9b90cd2b26f515cfd76e11b5769e16c5a4ab", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511975, "uuid": "1f66bc33-f78c-4fd6-bc90-715edc7c1836", "value": "T10B732A747396D9ABF88DEDB189D3D7A622667E504F41832738A03B4F1CB21B04E15E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511975, "uuid": "46bbfee2-5e92-466a-9787-9391a58f1972", "value": "1536:P27Cx4gD5VaOUQ5CjjGYJAUF5Qfyy33vPXQwMy0ta+ma:P27CxOIWjGYWI2fM7taha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630511975, "uuid": "8276679c-14aa-47ce-b79c-c0d6050a5167", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630511975, "uuid": "aa5aa00c-ec77-47d0-b8ba-9a7150dc7cca", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511975, "uuid": "8cc27201-8ee7-4b72-a838-da5e9b0549a9", "value": "direct 09.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a74541c-0b13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630493748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493748, "uuid": "96da96e9-0ac5-4034-8b96-1166412df7c9", "comment": "Malware payload (NanoCore)", "value": "9bfe0e80f06790313cffcf2dad525ca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493748, "uuid": "fd38a18f-b76b-4024-aa69-2d99de1d94bd", "comment": "Malware payload (NanoCore)", "value": "d66c53898bde2bf8cf77f63eec85bcd7ec3c61a6de05f85297eb4c7b292943eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493748, "uuid": "90b046bf-a1e9-4c3d-a51d-f55981173b4b", "comment": "Malware payload (NanoCore)", "value": "4f2889e1a8c89fb1678d59f5f74edb9af82bc876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630493748, "uuid": "c2202859-8a7e-4471-b85f-0d4ad19224d0", "comment": "Malware payload (NanoCore)", "value": "ceec34aa50f04b7a6e92ffebae8df957b0ab93576cdb46a283c2d1c24faae418f0e7fecf66d5e03f88504436db86a56b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630493748, "uuid": "b07c88a0-dae3-4bc3-8928-45ead7cde716", "value": "T1DDE4CE9C7250B4DFC857C8B68D682C20A660747B931BD30BB05326ADAE4E687CF165F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630493748, "uuid": "6b7a04ee-d627-438a-a653-a70233f31204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630493748, "uuid": "938bbbfa-e808-4063-bb8f-ac905ed55fe9", "value": "12288:zajrzbEOGUhQSsejAMWvb6UhflrhAPvsblqVn7/4LbJn:2MOGUVEMWOEflres", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630493748, "uuid": "84cfeee0-d609-4aae-bca8-decce13aac8c", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630493748, "uuid": "f72e98bd-ea5d-4870-aa94-8a8b47daa44e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630493748, "uuid": "4bc4ac11-0b4c-4dc1-b23b-89caa05a3aa3", "value": "YOyL4IK8TvZVE1t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f659ce-0aca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630462632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630462632, "uuid": "8999fa90-5272-4293-9489-f92451267e04", "comment": "Malware payload (Formbook)", "value": "99e84bd298ccb6717d194f7caf580062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630462632, "uuid": "e8f276a9-999b-4d85-bd32-ff6273af6658", "comment": "Malware payload (Formbook)", "value": "d99804145213694ea4b93c8acb43bf14d712b2043c247c703f88ebc97bf9c8d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630462632, "uuid": "77393199-34a2-4d06-99da-af40b35fc6ae", "comment": "Malware payload (Formbook)", "value": "1f1ae4137e469593d8ee726f5eb8c5abbbc95871", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630462632, "uuid": "7e76cb49-4c1e-4c99-8df6-87b34277bb85", "comment": "Malware payload (Formbook)", "value": "85f2b96b11669335eda894feaf141f4c7f36b4c8ea0ecf6411e91c9b0dba5277d38db81ad18c9255a68bc0e4d312f6c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630462632, "uuid": "5077177d-0c8a-4791-afef-cbb3241169ea", "value": "T142B4EF597790B09FC95BC976DAA42C60AB60B47B030BD307A05726EE9D0E69BCF054F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630462632, "uuid": "b8009a76-66a7-4588-a34a-7cc816f6673e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630462632, "uuid": "8b0d2acf-2325-4f2c-873e-e5ba333c7a09", "value": "12288:LJ6WScWmakTLG01xXwFc1W1jTLMoWZMhUzLXD:LRScWmakTqa1wFc8xTLMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630462632, "uuid": "f05e2f9e-d1df-4568-83e5-71d24ba3ecbe", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630462632, "uuid": "91e399c6-b0e1-4de2-b9f1-8abecb6f4c3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630462632, "uuid": "9874c5ee-1092-427f-a593-7308663bcba0", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afedcd2b-0b0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630492254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492254, "uuid": "fa29d320-8a70-4d8d-92f2-59c7d81206e1", "comment": "Malware payload (BitRAT)", "value": "41fc55dd170b5fe7120df08aaebabc4d", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492254, "uuid": "dbc33e5e-acfe-4050-a816-e619e85334cd", "comment": "Malware payload (BitRAT)", "value": "dd05e52bc134d7e198df6f57f147968ce91aded6e949b67d8ec9c24f31117954", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492254, "uuid": "dda6caaf-1165-4eda-bd25-5c8f0ab5031e", "comment": "Malware payload (BitRAT)", "value": "0d49c0ec9652c5be7bd8439d430951e24f6a0081", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630492254, "uuid": "94efb260-4610-4848-b870-ae999962a215", "comment": "Malware payload (BitRAT)", "value": "badbc22ad99e6808bc6b02697d03b71331a5e4f0199e84571063ab1a5b9e6dbcaee9927b82d9180207aa6255e14cf863", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630492254, "uuid": "4cd97ad6-1fd1-4f47-953d-d6fd8f2d612c", "value": "T11106CF02FA46C562D2570230E96E77BB053CF9350B2085C3B3946A285AB56D17B3BF7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630492254, "uuid": "54896395-f155-4ee4-b275-b7298f670683", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630492254, "uuid": "886636b0-aae1-4a21-bd23-aa4841d029fc", "value": "98304:X77Pmq33rE/JDLPWZADUGer7B6iY74M/bmlwXVZ:f+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630492254, "uuid": "54fd4560-c7a5-4e5c-9d3b-50cc23177c6e", "value": 3943424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630492254, "uuid": "31739d72-0620-4344-b994-96f5ad248667", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630492254, "uuid": "6baed1df-0e63-4319-8d32-a245cc1c0ff6", "value": "41FC55DD170B5FE7120DF08AAEBABC4D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a866611-0b76-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630536376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536376, "uuid": "965a53de-8738-490d-ab9f-c725bdc469de", "comment": "Malware payload (RaccoonStealer)", "value": "b2341d60db579377dcd9fb6a7b74b9c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536376, "uuid": "a8577110-eba9-4a40-bb7e-46caa8152f39", "comment": "Malware payload (RaccoonStealer)", "value": "dd7a1a0a97405ae9859b41bdba5c52397f8fb240ec2a3664e07453e34d7ac75d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536376, "uuid": "724de32d-fa56-4bf3-a506-55f2893eeae8", "comment": "Malware payload (RaccoonStealer)", "value": "5966e5b49aaf0a26183a3eb31e84dced1f41657a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630536376, "uuid": "3f09db82-ef2d-43f4-85cf-513d93b831a7", "comment": "Malware payload (RaccoonStealer)", "value": "7586d21f7a4fb1be14690de8379262c50d430003cbc8140d4edd30ea1d1d44fea4a2fdf76b2fc1bf67ebe004c0abf685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536376, "uuid": "207e8306-59c5-4b1b-95c0-b8a982b6d24f", "value": "T17A349D30B790C039F5B716F499BA87BCA5297AB01B3050CBA2D52BEE17356E49C31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536376, "uuid": "2160f82e-3dac-4958-8175-aa521b1a47d5", "value": "5c93c97e908d457a11b98f665a319008", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536376, "uuid": "db6f980e-3828-4f4d-9171-80f1ed9c0601", "value": "6144:VfEkUhYwovgR22s8XsPlCOP62lEe4JLh:6k4YwovgRV84OS+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630536376, "uuid": "a00a4f1f-d8af-48c2-a0b1-9542459d636b", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630536376, "uuid": "7d82ba35-944d-4e61-85cb-78ee637da182", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630536376, "uuid": "230ca0c8-6219-4f3a-9c6b-8ed28f570d4e", "value": "b2341d60db579377dcd9fb6a7b74b9c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c470818-0b47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630516085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516085, "uuid": "7c5c210b-a9f4-4521-b03d-3059c628ccd1", "comment": "Malware payload (Gafgyt)", "value": "0a76a66cd3fcbd49dc714681f3aaea1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516085, "uuid": "27a54fab-b50b-4b49-a2ee-b7641406994d", "comment": "Malware payload (Gafgyt)", "value": "dff23f858c8da6ca068702cb56e5e190e788c83b9d6f408259095fd24588bccc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516085, "uuid": "06c2e337-9878-49f7-ba9a-52566e21528d", "comment": "Malware payload (Gafgyt)", "value": "0be1eaa516e3c1381b1f2c21445ac297cea41098", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516085, "uuid": "6b8bdc53-50d3-4a1d-bc02-d3d254aa5bb9", "comment": "Malware payload (Gafgyt)", "value": "0b2541a9d7f531ae8e6fdacab46a38a5f64300ed3f31278e290cf93143bea598ef03d12dd64ca8ff34892d1a933e89c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516085, "uuid": "a22e22e4-1d6a-4b41-8f99-03ecc11e4bd6", "value": "T1DDF3F73B2B270F63C0D5143102E31232B9B5D78934BD93D7A9D06DAD6F1AA84345ABDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516085, "uuid": "c94c0d09-029b-46e7-bff8-d9064593786e", "value": "3072:uj+j/lhFkU7bXq/NPodlpharMJ+bgA6mLlFjXxvGcrsXO:w+jthFkU7T4lopharF16mLlFjXx+crs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516085, "uuid": "e51817d6-0167-4c9b-abee-3fa8689a3cda", "value": 162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516085, "uuid": "56032be2-0ed0-4fa4-aae0-c4ee3a4b9b7a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516085, "uuid": "89cd4941-f899-4363-ac47-6e63fab58b7b", "value": "0a76a66cd3fcbd49dc714681f3aaea1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6931a20c-0b27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630502443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502443, "uuid": "897690d2-77bd-476c-948e-22be9ed1a4f6", "comment": "Malware payload (RaccoonStealer)", "value": "71031e3ddcb293074cd825d58e6ab022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502443, "uuid": "e6b65e45-32e4-4a28-837e-e84e3fbad33c", "comment": "Malware payload (RaccoonStealer)", "value": "e04613a0c40b79eb6e846ee73e585aafa78236685eff5dd1ad2b0c5ccc9e6a83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502443, "uuid": "ef6c36bb-c88b-4fb2-91d5-4d21aeefbdf1", "comment": "Malware payload (RaccoonStealer)", "value": "7eca2da89323239e30189cd97fe9c09bcc012165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630502443, "uuid": "b517e33c-e854-42d0-b18e-ab3c937b1b27", "comment": "Malware payload (RaccoonStealer)", "value": "5fe51d1cd8f13819f20d2bc5891465edb08fde51f2c53850fe9a2ebfa99aaad6fec1093d0a2bfc45c443e2dafce93ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502443, "uuid": "2448ceb2-ea04-4ddb-ba2e-5491864f6fb2", "value": "T10AD4022C3BD61AD0E4F92EBDB8D1F2350B36BD5A8615CB163D55158A0C207CA6C4BF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502443, "uuid": "a5d5d0fb-0651-4944-8472-baee420a0dde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502443, "uuid": "c9b1b749-e56e-454f-b5c7-75b021eaafec", "value": "12288:IR4X+Qzyor+UNzjdc3Eiy+iW5mfeTdiydKIolBCd9:J+Qzz+UNzjdc0ZY5Hld9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630502443, "uuid": "9f93e2ed-daa5-4082-831e-adee3f215386", "value": 652472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630502443, "uuid": "a74571b9-1bef-4087-8224-d71e5f4065bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630502443, "uuid": "8a86a05e-887e-4ff8-9193-5954a367ae8e", "value": "E04613A0C40B79EB6E846EE73E585AAFA78236685EFF5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467dad82-0b3c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630511405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511405, "uuid": "908ca43c-6fb2-4597-9797-25e3307eca06", "comment": "Malware payload (Mirai)", "value": "58ce1645c2fb3d8ccd0fd70ce4c8b70e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511405, "uuid": "18280478-5742-41ef-b3b3-e8d9bb21e8b3", "comment": "Malware payload (Mirai)", "value": "e1882372cf965d40f83335d301e5ab611b7ce243ff371be046720cea6829194c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511405, "uuid": "34772abc-38c1-49eb-929d-60dea132403f", "comment": "Malware payload (Mirai)", "value": "46002bb48aa983389b88c1f259197f32147899f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630511405, "uuid": "0a6c9d06-d2e8-474d-a1eb-4ad02b573f68", "comment": "Malware payload (Mirai)", "value": "9af02c7bf5499bb90d16812b9fcba12285861ac997323ebd2786f91f9c0460af844a386bc9f6c6bd663c861e9b5244f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511405, "uuid": "eab43f6f-4e66-40ce-8768-9385f068e8a7", "value": "T109E34C86FA408A13C4C61B76FA9F524A3322DB55E3DB73068D185FF43F86A5D4E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511405, "uuid": "e6d9134f-5211-4084-9e56-81765c014719", "value": "3072:/ib6c5RgSQM5TJYqNkdjSQRh33maEAZ4aXWZ2M/96/r:mDR5QM5ZYSQRh33lEPaX9M/96/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630511405, "uuid": "487e14f7-cdd8-410a-b2b0-19317b488590", "value": 144111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630511405, "uuid": "88caceb1-f7f8-4b7f-b33e-097d39eef1fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630511405, "uuid": "68e7d14c-b9ed-4ad7-8c46-a1f56abf96f4", "value": "Anon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcac723-0b2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630504947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504947, "uuid": "9611c5a0-dcd7-4d14-804e-62c4a334348b", "comment": "Malware payload", "value": "209237ec553e195b86163f2875b70d5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504947, "uuid": "a31b8d57-43b4-4c97-9f88-0fa87624ee4f", "comment": "Malware payload", "value": "e27b17666cc8cf47b5097300b691c671a61cd7699291c9c403055d62b8be41fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504947, "uuid": "aecd6a0e-6eb9-406f-b75b-349bb9c8f4c5", "comment": "Malware payload", "value": "560dfed7c3714448cbd23d09aa135a574d10f444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504947, "uuid": "8dcb26b7-7039-456e-a5d6-2092546abe03", "comment": "Malware payload", "value": "af518d50e994d8a7d423f0056bb42b64c89d4d627eb9db2c232863ff6ecd96acc8b6f3650a573f5d519ee33e35a52d58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504947, "uuid": "aae13880-e69b-4063-af8f-707800c56605", "value": "T11FC5337AFDD65824C1859438DEC64C8493829EDCB68DB9774AD23B833242D1F1B7932A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504947, "uuid": "fdb3e343-c6f8-4360-9dca-6ce130ef2da6", "value": "b6b6c732372e598c3abc1f18c2585b64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504947, "uuid": "004a6956-c8a3-4253-a925-ea37307218c8", "value": "49152:sS1dYdJHvAuxnv0qMTk1vANe756ypaGwdLHKQI6aw4fQh/VwSv3hyqNTxWiWKFI:VdYd1v1x0qMTuoNyHwdLHBI6aw45S/hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504947, "uuid": "b200a978-c819-44be-8430-a403a719218b", "value": 2557952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504947, "uuid": "5709892e-afc6-4cae-8db5-af1ff9b4f1dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504947, "uuid": "3a537da5-6d43-47e2-aba1-a6e899d48f6f", "value": "e27b17666cc8cf47b5097300b691c671a61cd7699291c9c403055d62b8be41fb.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be7093e-0b48-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630516621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516621, "uuid": "b2b68760-1abd-46fa-84e2-723a2253ec6c", "comment": "Malware payload (Gafgyt)", "value": "bfe665ec1419302ac23ca600837e79b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516621, "uuid": "d83fe349-83b1-4a0f-8e6e-5a0a9f215b63", "comment": "Malware payload (Gafgyt)", "value": "e51617cfb17b08f68932dff1a9deccfcabfdd72e3f7e3603f1787b6e606bf982", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516621, "uuid": "fea1a4b6-8c44-4f9e-85e6-b0a1b692351f", "comment": "Malware payload (Gafgyt)", "value": "f55da78179e52a52c6d5a9abd7e54add75320399", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630516621, "uuid": "b12def66-13de-4d42-b1a0-9efb78dd5108", "comment": "Malware payload (Gafgyt)", "value": "689e0aec29644e9192a032e6018c2d9e91e42ab93aaa6d05e24e555780662c19bb3678477f91fe808f18f2a1271c4912", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516621, "uuid": "88adefa4-a2d0-43a5-84eb-e52db2441a54", "value": "T136D31897FC00DFA6F40AEA3604D74B24B370BBA24F521562725B39A7AE361D13827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516621, "uuid": "ce541e50-cdff-4129-a798-19b1ae27a8a0", "value": "3072:mt9hgQaSKGECyKWagAmCHL9IVWJ35AMZF2bVimClVybfvGcr6wO:mSgJECyKRgAmCrPJ35F2JimClVybf+c0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630516621, "uuid": "fac091cb-9b4d-4231-8424-dacc6c4c848c", "value": 142461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630516621, "uuid": "17b23893-7a10-4758-b5e1-533fae79f5c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630516621, "uuid": "ed4bdcb2-9650-4234-88c5-09438fc0d823", "value": "bfe665ec1419302ac23ca600837e79b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28d5a77-0b52-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630521142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521142, "uuid": "e2425c59-3a26-46a4-8718-0b3deb7c7e3b", "comment": "Malware payload (AgentTesla)", "value": "0ef8b825aa4cb3524e950ed29b7ab385", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521142, "uuid": "39960cda-d33b-4b3f-b09a-81069a616eab", "comment": "Malware payload (AgentTesla)", "value": "e8b020b127ad6e962e62fb0e896f7bdad3449249b07a67815dde796ce2577912", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521142, "uuid": "22753c92-adf7-4999-a80f-e9273c334efc", "comment": "Malware payload (AgentTesla)", "value": "a7461ef851832825d296da26614d067166b50067", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630521142, "uuid": "a9b8a19e-aa60-4307-a80c-497728242957", "comment": "Malware payload (AgentTesla)", "value": "18c89f2f557a120de4ab2f58439f45a391ae674e25ca146b6d3ddef322e05da4e847b3bd1a7ddd91d9cb1a0b4a18592f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521142, "uuid": "f217ad2e-7c0c-47f5-a762-f1c195918e59", "value": "T138B4CF39F7908D32C17B2A388CEAD1644975B7911E35F9463EE84C5C4A27BC2BD1938B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521142, "uuid": "f5ed0f08-8c70-4d63-b5e9-078889fb01a2", "value": "b462095fea3219e285e54ac0547eead6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521142, "uuid": "6460b8f4-44ec-4c8b-8ab3-135d50e0d747", "value": "12288:mH62zwMJz7bLg0EKsWmAhndfnZs8svfozjC:z2zXeQsWmAhBIvfozjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630521142, "uuid": "2fc2dcca-f3b8-40aa-a4bf-ff628507b741", "value": 532424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630521142, "uuid": "0a6b536d-3d17-4a12-b06d-2360752667e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630521142, "uuid": "c82aea54-affe-4097-b168-513d50b6e8c7", "value": "0ef8b825aa4cb3524e950ed29b7ab385.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa9d893-0b34-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630508271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508271, "uuid": "ea750bae-4a03-412c-b4fa-d9f792510ed2", "comment": "Malware payload (RemcosRAT)", "value": "ee35165feed0bd0e639e3719015c6803", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508271, "uuid": "c36ddb4a-aa3a-4730-ba1f-7e3c631f02d0", "comment": "Malware payload (RemcosRAT)", "value": "e909198f5ca355e38c8459bc7ae2028ee25f849fde5c37714f914b87a94b5182", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508271, "uuid": "d38bd18c-1735-45bd-b919-ce3a02270551", "comment": "Malware payload (RemcosRAT)", "value": "370fe972dbf6a532b7c109774e986087769366e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508271, "uuid": "ad0fab69-ff03-4449-b295-d399a289896d", "comment": "Malware payload (RemcosRAT)", "value": "2b71f2a23004f874872dc8888cdb6805af02583b5ee41e966f9d9ad36388b76327c7d0a58bf4e7291402c895fd2c42d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508271, "uuid": "759f21aa-4d92-4fef-b230-9a2e2747a1fa", "value": "T155A4B38E62484248F596FF70A89D81F903316C32AD76C44E17D9B13A0FFAAF59B17847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508271, "uuid": "e92f31c4-0777-4d18-be57-10f81df5d167", "value": "c4b3ef5cd2bacd05c5793b6be4b1aeae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508271, "uuid": "f53433ba-b963-4879-94f8-ee42327fd953", "value": "6144:OkF5cNRat3ZjyPt7Z3rfzwp38Pt7cjqJWa:55cNRatJuP5N7a8P5cEWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630508271, "uuid": "02264936-cf5b-4ad6-83a9-d00d4bb892c4", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630508271, "uuid": "450f2467-9c7a-4f41-a3e2-bcc7d5fff363", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508271, "uuid": "adbb3322-b7c0-4da5-abf9-d593ff34cbd7", "value": "ee35165feed0bd0e639e3719015c6803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da5376c-0b22-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630500303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500303, "uuid": "24791ae2-b29c-42b3-8670-8c7387e9f45a", "comment": "Malware payload (Loki)", "value": "0b663f4c96e18b1d6409a7d5d3b11bb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500303, "uuid": "b063fcdb-9f1f-43ab-b2cf-c2d04e47eb34", "comment": "Malware payload (Loki)", "value": "ea1a6d8cf9efab40ab84920764624cee64a3165e7a10a0cf8c238cb17e82c646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500303, "uuid": "3c0fc106-8492-4f3d-b0a9-11509a11f115", "comment": "Malware payload (Loki)", "value": "e4d9f875ed6b302514ac10bed669cafebaa6960f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630500303, "uuid": "879d53d8-6adb-4024-a409-a7241273bc33", "comment": "Malware payload (Loki)", "value": "518fcf4aa43a089b6dec159e06143c77337e461949535ceff1974ac7f139c68d8deffaa59495b3c2eb4f1d50dc1a1885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500303, "uuid": "500600ef-de5b-45d9-a75b-2c42cac0403d", "value": "T1A0E4B87F19BDA127A175C6F58BD78423F0018BAF31206925B6D643164323A7AB4F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500303, "uuid": "bd2f3a34-cc9a-435d-ad0a-612bf515a0e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500303, "uuid": "b1867d86-c240-49ac-abce-70e327fbbcc0", "value": "6144:GZHRoK0iIbfNogGmfdwCSNuikNCH1K/IgaD/AGLjU9eP0jKWRNu3UHm:oR0iI5ymrVSH1K/tlGLjU9e2RNiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630500303, "uuid": "acd0e3d6-aa57-4c62-a0e6-693f8a9091f6", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630500303, "uuid": "252157a6-64ca-4d6e-9e7d-21d1ea3959f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630500303, "uuid": "27ee65e3-831b-44c1-9f4d-82fd76d35399", "value": "Scan copy. pdf...........................................exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f38b024-0b63-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630528143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528143, "uuid": "56177bb3-cc40-4934-96a1-9e5afe850e34", "comment": "Malware payload (RemcosRAT)", "value": "cea347a30c840ed9c4e78ee28738cbd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528143, "uuid": "554007c6-d00c-47fc-8e30-4ed20a580488", "comment": "Malware payload (RemcosRAT)", "value": "eac230dd8a6ed40c405caf5e79b60cc7a4e96435873a2b28658c24bdf3550b42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528143, "uuid": "f0101fab-7f7a-4841-8c7b-0f24f1b1c8db", "comment": "Malware payload (RemcosRAT)", "value": "fce3ad4a22a47d803e2b052ff26f87ec52210848", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630528143, "uuid": "b1b0fda7-388b-4f1c-809c-b2970150536e", "comment": "Malware payload (RemcosRAT)", "value": "3f31ef3dad631054073c85b6e6d3cd210f0c213b6b36af85317ab3db206e7fcf7d295fbba301d0e03dc8ac6307d7779e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528143, "uuid": "a21125a2-3919-4265-9246-3da86cd0e39d", "value": "T167C422442AAC4D71E011077217D82EE8E325D4E96512CF8E18F8BE5DE92EDCD93F6A4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528143, "uuid": "fd6106e3-eede-4ce9-a56e-ae9791555871", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528143, "uuid": "73b40838-680f-4de6-9087-6e089fd4c330", "value": "12288:NpwQOVrWrgTb2/35BmCp/fyUp7/41/4Lb9U/LwtdaaAiMyfrFlXR:NpYV6rgTYrV/fyUNM4LbmLwtQwrvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630528143, "uuid": "1ff56fc6-0862-49eb-be83-0260f4f64c6e", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630528143, "uuid": "58d7e2c0-3abe-4ead-b8e1-67f984f01325", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630528143, "uuid": "f02e618b-f226-4c89-8cbe-9f8a802e5ca4", "value": "cea347a30c840ed9c4e78ee28738cbd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f08dbd2-0ae8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630475287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475287, "uuid": "c3101b6d-3341-42e8-9662-71c5a1c41319", "comment": "Malware payload", "value": "14a9fca48a3de86e0f6a708e3bd33bb2", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475287, "uuid": "84fcf935-a54e-43c4-8ced-f006cab784bc", "comment": "Malware payload", "value": "ebc492d6c0d24bdd0bcb84f6b3fe8bf5a1e47be052d57c0beb3badb921f7eb86", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475287, "uuid": "2dcc853f-c60b-40a7-84d7-5a107809b7ec", "comment": "Malware payload", "value": "d4eaf38e4f5e162429e052b8ff9fd02bac2122fd", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630475287, "uuid": "375fbace-6527-429b-8f4c-904361ee4c46", "comment": "Malware payload", "value": "4f37eafd28e0cd6adec34adbb59723d1e5f571d8aa6754872630377f68ef20d58d177a688fd0d922e5c0ab85a8d628bc", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475287, "uuid": "78646651-e001-4c0e-8d60-52c44eb4aa37", "value": "T15724DF5A880C349F9C62988B7A458AF1C28CA4DF0059847A0DCF6CFEC75C6994E5FD9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475287, "uuid": "1311e1b7-c63d-4487-a7aa-4a230c67b681", "value": "6144:nkSxotDaZXrOXhSOstfidqTuX7qT7YDRKk8AYF4sOEt1:kSxotDaUYv+qT6k7QRK5XFBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630475287, "uuid": "cd7ac517-75c9-4ba9-9cb8-060d70f0d245", "value": 211014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630475287, "uuid": "aca49081-ae12-4645-8f45-49517a2a78d9", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630475287, "uuid": "615767ab-adc2-4a40-977e-7546956230fc", "value": "x86_beacon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c3ea32-0b35-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630508404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508404, "uuid": "2b4027cb-4c91-4760-92fe-07eb4c257387", "comment": "Malware payload (Mirai)", "value": "bd7aa051210dd85f896bb2076797bda5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508404, "uuid": "ff6aa926-1c83-46ff-93a6-4158cb69c8be", "comment": "Malware payload (Mirai)", "value": "ec6d085cae0bcb85476d8948526e5a3ddbc7f367d2e3344014624795d21115b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508404, "uuid": "dd56053f-33ba-4135-b583-c3388f57bca4", "comment": "Malware payload (Mirai)", "value": "d2fe2afcd4f2f4bc17ca5db76ccf6b2209ed15ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630508404, "uuid": "5c31e315-0ea9-49e9-a27a-7b20eadadf73", "comment": "Malware payload (Mirai)", "value": "939deac05cdd0c143050982c504c4b743df9481f44c5577065b7985e02194d8e427e57d8d3767f8548079adb13529bd1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508404, "uuid": "911b66d7-3af8-47b3-8658-3ebde64f74b6", "value": "T1F3037B84DB43E2F4ED3B05B1E9A7A7B15731FA265459FE97C36908348C02112DB07B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508404, "uuid": "bb657a27-243f-4d58-8a2b-f486b0e658cb", "value": "768:iTruD3v1bmtIh79Vf8IcGM9phOfTjiQc0jryhrYH++T8m2:iTKDdt7bjVAnOr2R0jGyHsm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630508404, "uuid": "42a6a74a-3ee9-40c5-85a5-0f604a8c8b78", "value": 37988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630508404, "uuid": "ebdf1e7d-2a82-42c7-839f-6402ed9da8ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630508404, "uuid": "8395b5ea-0be6-4b2d-bc8a-d37abc798331", "value": "peach.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6743c7cd-0b43-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630514466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514466, "uuid": "654d2e26-f9ea-4bee-8d45-060e438a0f3b", "comment": "Malware payload (RaccoonStealer)", "value": "1e25784a4201e84c6624a3480a08fc66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514466, "uuid": "fcc9529d-8c39-46f6-a9b0-0894e9bf2217", "comment": "Malware payload (RaccoonStealer)", "value": "ee2a69a595644abf1c49894aaca322801c83a124cec7656a0a5df69ad29c10fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514466, "uuid": "fc7859e7-a5ec-4788-a3e0-cfdf68f8c0e3", "comment": "Malware payload (RaccoonStealer)", "value": "87179c0ef9978d5f989d8c5c87a4dbb33a568e56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514466, "uuid": "c58753a7-bcf2-4168-90f1-8f8b934d08b2", "comment": "Malware payload (RaccoonStealer)", "value": "36efcf73681ad30b9b422c5af252cd4decc71e7c869a7bfcff780a653edcecc0250c544515a82ee350808345f1d8d2fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514466, "uuid": "30d8a301-4859-40ea-b2f6-d151d35282fe", "value": "T1FFC4F10732B1D83BD16546B04C76D7F80A2ABCA99D92C58B37D0661F2EF1381BB22357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514466, "uuid": "31713d0a-7802-4277-b53b-31a1766aa2f1", "value": "6c24281dcaa86901b7166ae3ce878d47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514466, "uuid": "03477ee0-f2e9-4d5c-bcb3-925fdc928a71", "value": "12288:wH2JjEGg2qkg0ge+x4xs9SLWp3YoPItsp2OeaX59Y:lykg0L+Us95pOG2Oe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630514466, "uuid": "394258b6-b786-4288-b334-48c9e52ddccc", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630514466, "uuid": "00596dc4-89e6-4f32-9e6c-bc6ceab4d124", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514466, "uuid": "dcf6c9d9-c7f7-480b-8014-9fd68d275dc1", "value": "ee2a69a595644abf1c49894aaca322801c83a124cec76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ef51f1-0ac3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630459575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459575, "uuid": "ea4746c5-da6a-42f6-ad0f-082dce2d3177", "comment": "Malware payload (AgentTesla)", "value": "37ef0d25d599bc8314e904d3b7d0ad26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459575, "uuid": "c67f80d0-10d8-40f0-82f5-5d35ba620b81", "comment": "Malware payload (AgentTesla)", "value": "f0f4aecb098f92a033355c2058300583967a7fbf00c81ce2f3ba250b8ae3e277", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459575, "uuid": "ca27723e-1759-4c18-8b82-91df957e997e", "comment": "Malware payload (AgentTesla)", "value": "6c8fd89cb1082c5d2688a5eff9279558d558ab52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630459575, "uuid": "441c5108-07d2-4eca-a493-79088a9edd6c", "comment": "Malware payload (AgentTesla)", "value": "226d397d4ce5312c3ebe7a467e1d75f53cfa52a0cc411ad3f611f108afe67a3766b9b14766d29a20ccd0b098a02542aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459575, "uuid": "2c018c3f-a56f-4725-930c-73e171cbf0c2", "value": "T12FB4E05C7794718FC55BC97689A42C20DA61B0BB630BE307A0A316EDAD0E69BCF051F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459575, "uuid": "e22eb13a-1890-4008-9925-8fb706331362", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459575, "uuid": "cb69d3e8-5ff3-4713-b62d-369f0d7d3497", "value": "12288:Xwq0XK1hApxvbKH+jSgTY9MRIHACrADR7+U1+owChKh6V:H71hAjKH+jSSYSRIHdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630459575, "uuid": "01c48216-94b9-4fab-ae2c-4cddc35c09ec", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630459575, "uuid": "4b3de59e-9f3e-442c-9857-4295a347b361", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630459575, "uuid": "f8463469-a3cc-47bf-9a40-517816e7645c", "value": "387-1303.Drw_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e58684d-0aec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630476951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476951, "uuid": "946557e6-a6c2-42e4-98aa-36c745259f7f", "comment": "Malware payload (RaccoonStealer)", "value": "0e558853c845b34e1cd0d95bc68cc8e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476951, "uuid": "45e511c6-3db6-4431-93b1-13c7d4fc8b79", "comment": "Malware payload (RaccoonStealer)", "value": "f33f279fa9d8a9fe9b955d363bdbf03b706d091d66e2a9130e2a59d06cdb83eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476951, "uuid": "c9589e4b-4d23-4daa-b240-b9c4b3bf33c5", "comment": "Malware payload (RaccoonStealer)", "value": "83559cc6c5cbfbbdd3f74930d6a70902fd2190ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476951, "uuid": "b724eeef-d508-4974-9b5f-7f3a14387387", "comment": "Malware payload (RaccoonStealer)", "value": "da05f8ce3211c4d203415f14aba787dac954f5ce5cb9e2a53a57e1c4e10c869bd0c8b3de4c29f216902bcb1270dcbda0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476951, "uuid": "803b089a-dfde-4867-9632-08539c2e410c", "value": "T10EC4F10B36A0C43BE59105B04CB6D7BC4A36FCACAA12D58777D0676F2EF12D1AB22355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476951, "uuid": "e3db1571-3400-4312-9b96-50bc095bc2e6", "value": "66f6132807e59bfb21d701cc690ae848", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476951, "uuid": "0d8b03de-b011-4db3-b9df-34cf7a7ea860", "value": "12288:IshgwGL+cdyt2HXUB59RED9yEq4d7UwaX59Y:HGfyYHkrEJypGYw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476951, "uuid": "a512c44f-1a60-49dc-91a5-4f59cc0e3758", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476951, "uuid": "273c8b65-7979-4635-af52-5bf361efda90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476951, "uuid": "cccc0c7e-33e0-45c4-824e-1b0b472ce9af", "value": "0e558853c845b34e1cd0d95bc68cc8e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e01feb0-0b41-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630513565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513565, "uuid": "00a9036b-1bd9-40f1-9f5e-20c3d8c6fd06", "comment": "Malware payload (DiamondFox)", "value": "80f65788ca4a1874c2a5852050c39454", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513565, "uuid": "26b3467f-6107-4951-bc54-e249fa79dda9", "comment": "Malware payload (DiamondFox)", "value": "f3b142956509070653f79be7940ce14497ee3e9feef6eebbb522c1a88c5ff997", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513565, "uuid": "013e16ab-2018-4a8f-9d93-28d2a33c4ca5", "comment": "Malware payload (DiamondFox)", "value": "1a5bb1a99f71b0af8d9d5bf076382ab42c2ecce0", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630513565, "uuid": "b2b84e74-b686-4ae7-af57-ba3167bb60b5", "comment": "Malware payload (DiamondFox)", "value": "c09dc4a2d88cc7298c275c84f5213964e8b74f63e6896ebc28101faca258571ea6025ce565e5b8d575071a3256a402fc", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513565, "uuid": "2accea3d-dffb-4deb-aaac-6fd36d1cc632", "value": "T140163322B9C884F2CE8065318A90B7B354F962084F7A0DEFD74CDF5C5B3E5A691B6817", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513565, "uuid": "f6e0709b-bbce-423a-b3de-575842987a37", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513565, "uuid": "295022f2-e905-4455-91fa-5d97d7084bad", "value": "98304:xLCvLUBsgaM3xYSqe50LyGUX2neZ8vl91RxH4z3:xwLUCgaM3xCbyd2euvlTRi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630513565, "uuid": "d216c54f-4063-4484-a406-561b9c1c695d", "value": 4033776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630513565, "uuid": "eef0d67f-44e3-472a-9bfb-8de74053338e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630513565, "uuid": "7dd29869-e5bc-4e25-918b-6974c15745a1", "value": "80F65788CA4A1874C2A5852050C39454.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b030d55-0b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630504621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504621, "uuid": "c036f45d-2812-44e1-9e62-89c06ef6d7be", "comment": "Malware payload (AgentTesla)", "value": "79f22102b66701636eee15159aece176", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504621, "uuid": "8d44bf6d-4b62-468d-9e7a-e58e2af2b52e", "comment": "Malware payload (AgentTesla)", "value": "f488390aeb4b77fd23a6aa71567585ba34805a1c8aa36d142e262c4ee1b2abd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504621, "uuid": "d1f45141-16bf-4341-b80b-3ba13e11cd35", "comment": "Malware payload (AgentTesla)", "value": "5b40dd457aea5451d62f2ed96480b7f80da85543", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504621, "uuid": "712cf87b-0a39-4472-970d-e9c7cfbf7e04", "comment": "Malware payload (AgentTesla)", "value": "0c5ca0a6f41d9899fb53aa333f6bc8a4af98a10d9b4bff54b53c8471b22ec43daef39c34e14ddd6fc3464d3f7396631e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504621, "uuid": "0c3335b5-95e1-4c27-879e-4b4c362db46c", "value": "T1BBB4DF5D768071EFC51BCD768AA41C64AA21757B930BE303A45355FDAE0E6ABCF020F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504621, "uuid": "fd0d3dd9-756b-44cc-a477-d8141fe335a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504621, "uuid": "13232d7d-383d-4f9b-bf43-0259dffb3b28", "value": "12288:t3on0q3yhEbp0RZqjODQ4eYaZdBvqc2IAj:pO0kbaRAjOiPBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504621, "uuid": "1198a69e-4f4d-44cd-b55a-218b96f9fee9", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504621, "uuid": "9d305e06-938d-4f28-9b39-f5d79296062c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504621, "uuid": "bf8004ef-f7e2-458a-b53b-b745d3593598", "value": "P.O_345.77kb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40f4d1c-0afe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630485040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630485040, "uuid": "dcb234c3-f4a4-4926-abd6-eee399fb1681", "comment": "Malware payload (RaccoonStealer)", "value": "52c2f20abeb8aadefcc00589b5840e00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630485040, "uuid": "98494753-24f4-4b10-bd19-e00b2f571654", "comment": "Malware payload (RaccoonStealer)", "value": "f496b1e5f8cddecb0f7524d1d417142d4d70fa0d805672c92008e20e943b3a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630485040, "uuid": "ac120a31-eb40-4fe5-affa-351159f9e3e8", "comment": "Malware payload (RaccoonStealer)", "value": "a286c5c120d1084c617d2d22ed6639b2a740373b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630485040, "uuid": "5eec04f0-586c-4e31-bca7-a78d61ab0140", "comment": "Malware payload (RaccoonStealer)", "value": "5e735a0ec1feea5f9673106e088d8041888c63a2aa560389f81f86c4e45a860329f5ad48541147119241170de91db971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630485040, "uuid": "d8909f05-833c-4b3d-8513-0ab26215623f", "value": "T1C6C4F01B32B0C437D2B546714CA6D7F44A26BC6BD922C2CB37D12A5F6EF12C2A711366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630485040, "uuid": "6c074f1f-9a16-46b3-b1b5-ffb6afa40559", "value": "451c17c19158849d8a13a33ee740b7fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630485040, "uuid": "6a915881-b346-426d-8560-b5ddb7afa7c7", "value": "12288:T63MFlE2vzD3qndT1lHN3aF2dKLiGFPYPpDBKaX59Y:ThvSN1tNaFtx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630485040, "uuid": "d5b0bf18-32ea-471d-991c-d215bb42607a", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630485040, "uuid": "857c24ba-1104-4fd5-a0dc-5555c8bd66d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630485040, "uuid": "0516673c-0cbc-434e-89c5-3eb65ad39452", "value": "f496b1e5f8cddecb0f7524d1d417142d4d70fa0d80567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b856e45-0b7b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1630538498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538498, "uuid": "7f0b7b56-a1db-48d3-bb13-d7f3a202fcb2", "comment": "Malware payload (AZORult)", "value": "6b1db77aede2ac5b9a409b46e4389e5c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538498, "uuid": "0949bea0-db2f-4a99-a6a7-2d8a9df72208", "comment": "Malware payload (AZORult)", "value": "f5045e67b9bae79bd7ccb537c73a3013b4ed00a71ea8c6970a7b199965785d42", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538498, "uuid": "2b64bc90-1e98-4e46-ba6d-2ecd7d717f7f", "comment": "Malware payload (AZORult)", "value": "41a6fe50b280b3ec7c1ac2255a854f19535e94ff", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538498, "uuid": "56d5118c-c6e2-481d-a941-239bd700a1af", "comment": "Malware payload (AZORult)", "value": "1138c42e1caf74c4937219a2521543322d1ff8f4e16b4395db00c829f661f8e0f5081116f691f802c74722de94289c52", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538498, "uuid": "d9fe6b4c-ade2-4eae-b55b-550fb59f168f", "value": "T187B3197AF6C19272E02808BDCD46D1B6912D76302D3918B6B6DA4F8CD5F95C26E2C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538498, "uuid": "4fefd0c9-b5da-4e22-aa66-518be139e5c5", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538498, "uuid": "ba0cacec-5687-4d8c-8fb5-0cd79845ec35", "value": "3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEYnE/Wxg/:Zzx7ZApszolIo7lf/ipT/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630538498, "uuid": "bf1701fe-2e1b-4227-b636-378a7686cde2", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630538498, "uuid": "67c87525-be75-4fbe-bc32-6fac04d5573e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538498, "uuid": "4465c2fa-7300-4f76-a51e-77f5fd0ab793", "value": "6B1DB77AEDE2AC5B9A409B46E4389E5C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789d86e1-0b45-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630515354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515354, "uuid": "8f854e9e-92e1-43e2-a593-1bd70f9e8fd3", "comment": "Malware payload (RaccoonStealer)", "value": "d5e28c3200eefdb15eeef347d7939083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515354, "uuid": "16a2b62a-cbe3-4373-a653-c11c4a76e7a7", "comment": "Malware payload (RaccoonStealer)", "value": "f66d0bc563515675b5d2695fbbba2ca2127e6919bb82869f8a7748a6bb4f491f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515354, "uuid": "51d35e1a-0381-413d-bc36-074853f13c85", "comment": "Malware payload (RaccoonStealer)", "value": "975c2848b7d74b2bc101940269c296590acf8137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630515354, "uuid": "4c2d6a9a-cf45-46c5-a683-39be14434f9b", "comment": "Malware payload (RaccoonStealer)", "value": "cbe9c5383c36ce7701d13bac1eb8fcdd96a8d5fe849fcce70e1b66d2cc90fe41db2d4d27a4fe3054b52716d072d7dbc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515354, "uuid": "ec777638-a14c-4ae9-8b7d-d5a3a75d4e14", "value": "T105C4F11732B1D537D24546708CF297B8DA26BC699D26C1CB37C527AF2EF1391AB21306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515354, "uuid": "1bfc2a61-f434-4cd0-aed2-bfb698b4f9c8", "value": "7449bb1bd2f7cf11b31b665cb048bd37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515354, "uuid": "06dca78f-44bd-423a-a831-a47721c88daf", "value": "12288:n1Qe6x5k6Vxb6LTnc73vFo862Jn+pAeJYs0pyZQrGMKkraX59Y:n1T20cLe925EJF0sQrGMKQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630515354, "uuid": "61069f16-8aa5-4382-82fb-c781c5389abb", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630515354, "uuid": "18fa4828-8b22-497d-9a5d-2b04990b413b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630515354, "uuid": "298fd9ef-a7ca-4854-9ac3-c4f75ee6272e", "value": "f66d0bc563515675b5d2695fbbba2ca2127e6919bb828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749804c1-0b2b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630504180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504180, "uuid": "0ffc1d48-8706-4b18-9ab0-aee5faf94273", "comment": "Malware payload (SnakeKeylogger)", "value": "ce373836f2231775c4fdca0cdf947aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504180, "uuid": "be24dde0-e12f-4054-af91-13ffcd879a17", "comment": "Malware payload (SnakeKeylogger)", "value": "f6ace962af4ca3eb5ba467388fa623df88d2b088c0c9bed0a10c307391863b21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504180, "uuid": "c08d2c82-4e7a-4b5c-b9d8-59e0388fa39b", "comment": "Malware payload (SnakeKeylogger)", "value": "f448f7b3019e5c46d288719521b90d1f356760ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504180, "uuid": "b77041bd-2f25-42fc-83bc-df6d0cbefacd", "comment": "Malware payload (SnakeKeylogger)", "value": "d000e843b5fb1ac8574e51e0f784a80cee9b3f2430024d305d22714414b057720ad5286928fd31d349f798a791267b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504180, "uuid": "5a447914-6bb7-4415-9a7a-7411edee6025", "value": "T1FA351229362C7F53C93CDBF29486211253FE685E38A6E2984DC2A0D5217AF150F64FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504180, "uuid": "e3767d68-2c49-4295-918c-2c7c6ff1198e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504180, "uuid": "dfd17c70-968e-4604-adcb-29ef4b40be24", "value": "24576:xXZx2HjKt34iQTpXaTIU6DBz6QyuVmeDYmv6bTH+8Zsz2LDl:Px2DKpEVqTQdkuV1DY8sq8ZVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504180, "uuid": "2fa32748-407d-4f37-aa42-e65e9a21d68a", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504180, "uuid": "5467969d-6b0d-4503-ba85-ba74870e5309", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504180, "uuid": "c3b463da-da81-4ddd-acb9-597081178ce9", "value": "QUOTATION -PDF-SCAN-COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2ef743-0af5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1630481163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481163, "uuid": "47ce55bf-9968-4c19-ae1e-1e9d1b9e46c5", "comment": "Malware payload (Worm.Ramnit)", "value": "2a709e9f105dfbea32eb522272cb005c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481163, "uuid": "77cba333-1b1f-48c5-8afc-d9b7ca6be5bc", "comment": "Malware payload (Worm.Ramnit)", "value": "f86ef2eae7113c8938b4e429976b2e46da61ca05b27387f84555000962c4f909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481163, "uuid": "62733f27-f90b-43ea-9815-da57f1af6671", "comment": "Malware payload (Worm.Ramnit)", "value": "c6ebea9df5272f07726ded98a1eca132e58faf15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630481163, "uuid": "4dce6328-c99d-437f-b215-eb0e4ac7ab04", "comment": "Malware payload (Worm.Ramnit)", "value": "adc9734aa27ee64325fd2169080a4cdfe89211c96156c04248858f64ae9808dab422929a9b0f741395fb8204022accfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481163, "uuid": "cca2a350-a2e3-43b2-83b4-ba04ccbfe300", "value": "T1CAD43AA6E65385F1DE7706F10447F7FBA5308B098421CC6FD388DE99EBB2C12285E625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481163, "uuid": "8d25febc-2b01-4a88-9b62-22593efc0aad", "value": "1eb28686a8fee4adec96d600214b4fc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481163, "uuid": "41876d1a-2a97-469d-a762-8c25b21806e7", "value": "12288:o1ihveb/GBzumhHNGiNnh8ZIZ5gXby5NQt/+A2hX1R40oDSm:o1Mveb/GBzumT8ZILStmA2RM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630481163, "uuid": "9568e743-772e-408e-9876-fc4525d41cec", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630481163, "uuid": "9b7b3f4b-690e-41c2-9843-b0b5f5033636", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630481163, "uuid": "e031a960-622d-4855-a7e4-4ef4f2185456", "value": "new ency.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319672db-0b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630504498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504498, "uuid": "703abc7a-e8dd-4e98-b87d-bfe757f08f1f", "comment": "Malware payload (Loki)", "value": "3552282fd0c7e231361d44cc918c3ba0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504498, "uuid": "476653c8-c104-49dd-b098-9f77ca12b0c3", "comment": "Malware payload (Loki)", "value": "fb62d2ef00dc39a9d08e81cbccb945f956a5906e35b3ed94b08ff13f90def46e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504498, "uuid": "3c280089-49a4-42cc-9e08-b2cf51277ef7", "comment": "Malware payload (Loki)", "value": "d2bdb4b0ba264c5ae600f6243a124dd02340db23", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504498, "uuid": "96458a50-854d-4103-af05-42cd707b2dd5", "comment": "Malware payload (Loki)", "value": "001bd619c455973d04bb6addba6ce03d0509e83aed2a65b5a249bbe89f645717e9b9a547e0f9e07be5b3f8e6c20c651d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504498, "uuid": "8e58bc99-b0fc-41a9-8bba-612d0e5c6c2d", "value": "T111551290E8818F85F24B8A312E1D6E2C52B35F1FF126E0A3359676542835EE6CDFD187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504498, "uuid": "d771b596-9a41-41c6-9bcb-9d10b7eba0fa", "value": "24576:lQjtiOVe0qJAIImgUcpbhiG6KSBWR6TlSjcCXaQ7UBwWS43mCH:lQt/Ve/JAlmj6hztSmSlocCXaomuxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504498, "uuid": "072ed5e5-c786-4b3d-8f04-8368028ce53c", "value": 1350656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504498, "uuid": "f776d139-dc92-49e6-ad5f-d7e1ee8d4074", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504498, "uuid": "ebacc292-bd15-4e9c-a8f9-796fd57d9050", "value": "PDS20-218 (AC10) (AC37-1012) -Printed Material.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e138757f-0b2b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630504363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504363, "uuid": "2e11a3db-79a2-4517-bff4-bb4ee49ac63a", "comment": "Malware payload (Formbook)", "value": "48965f9726c19a324016839c0bfdad51", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504363, "uuid": "6eb1b0de-2528-4af3-a406-6f30068a1ad2", "comment": "Malware payload (Formbook)", "value": "fbadedecbf37e434f1d8e2363edee5dd3b5589e4606c76fec8ded6c56e5661fb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504363, "uuid": "3567f03f-78c7-4667-8d00-819d445a4ad3", "comment": "Malware payload (Formbook)", "value": "73c44dcdd1b1548597062f373522cd60e193407a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630504363, "uuid": "9981f5ec-8099-47b7-b36d-a4f38b3966a1", "comment": "Malware payload (Formbook)", "value": "e7b22a779971783d70d468358b678505a32438902deb7e4af59c66ba42e6456c6f1aab4c15f61a8a6bf487359c056540", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504363, "uuid": "202e500b-faa9-47e8-a138-5435f8ed2ae1", "value": "T15CD40255AEF69686C727CB3690F0FDF581059C8409A7E05FDAE0B0EA937C76946F020E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504363, "uuid": "acc612f5-0fd6-4cfd-8889-4e407af9a94d", "value": "12288:w48nbjUScgAvlTYiuufulPZU6KhvpUHE4aJipc9eRPSj8YxkcZTxs:jcISTg4lPShvvipoeR6n1ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630504363, "uuid": "4fff8209-9877-4422-acf7-d4957f59a5f5", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630504363, "uuid": "de1f2f99-1eab-432b-a623-c9b886c45455", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630504363, "uuid": "af49834c-c555-4c2d-935f-08fb7911078a", "value": "Niagara Sc Offer.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b2a7a2-0b52-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630520743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520743, "uuid": "a2dd275e-71f8-4c81-b04d-d47833f15b94", "comment": "Malware payload (NanoCore)", "value": "dc0cd529b6ddf536f8902a0d704009d5", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520743, "uuid": "64552a7b-f24a-47e1-a3f1-d20efeca26a7", "comment": "Malware payload (NanoCore)", "value": "fbcb3f482fd70d484038ccadfa95473ef3a0a010fcd51071787ccb875dde1ae0", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520743, "uuid": "41323e76-2ed2-4b88-881f-bcee536b8ccf", "comment": "Malware payload (NanoCore)", "value": "b52de705e40e1cb1a04a5c652835ab7f9d86d98b", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630520743, "uuid": "d208162b-bff3-46bc-8744-84fd7ddbcf16", "comment": "Malware payload (NanoCore)", "value": "0c34190fa832f9c1401e27aa29275825bf6d887985a1f7ef700684218bd4d7706a9b521484eb38658f8b084b135537e0", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520743, "uuid": "212918e0-906f-4c05-be01-2c16e0045db5", "value": "T119710368B5A8B062FDF608AC8758AEC35CFC002A77DEC22317E3F65DD04C91B688D564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520743, "uuid": "1903a407-b8ef-43ee-8371-0c35edbd1fc3", "value": "48:2iMKpQYvcNzzzzzzzzzzzzzzzkt1zzzzzzzzzzzzzzzDQraKBAdOsQiL6dXJ2G9V:2HKaqt2NBAdODgkJjWRZ2rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630520743, "uuid": "c6b43f1e-9674-4335-a450-16340b9108da", "value": 3569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630520743, "uuid": "f8914c19-4fee-4c58-81e6-e28319384066", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630520743, "uuid": "ef2ced80-e31a-4eb2-acaa-ae5d62b2f9c2", "value": "A6D8N25S_Invoice_receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3940946-0ae3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630473416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473416, "uuid": "3d31fb1f-5a16-41a8-b746-3e5111e3e8fd", "comment": "Malware payload (AgentTesla)", "value": "d55f0b019ff7ecfb5f19d2a68568ed51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473416, "uuid": "1d64f920-2610-4dd4-b8e0-2fea9f2cfa11", "comment": "Malware payload (AgentTesla)", "value": "fc9d60f4c0915d2327c2db4392e91f20cda62c7587dd0af400993f99c7c90caa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473416, "uuid": "d09fee07-6235-4193-9f30-560160247428", "comment": "Malware payload (AgentTesla)", "value": "b187df8f4c0c97d81f122deb3ff85f05f8b8118e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630473416, "uuid": "0ae3811d-a9ef-457f-89f3-7039843661d9", "comment": "Malware payload (AgentTesla)", "value": "45bcbeed2e5ee8be40fda0050b29d0b419ccce52ea1b539ae701b232d2b2fa454c4c41a3ede5b86c38b2725911072589", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473416, "uuid": "af366659-dd07-4c0d-bad8-22e12c53f45a", "value": "T1F1E47C85F64465ADCD1ADB319A36CC3092227DBE5A3A910E24DF3D6B3FBF29744110A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473416, "uuid": "0760dc59-ee1a-43bb-8b1a-6eca67d7ca92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473416, "uuid": "607c0e61-a871-42f7-9d3a-c7bfee158c75", "value": "12288:CzpAjzeZ0sF/Ry8at+E8ceHNinUtt+BRTgux0PzD+9iP7r9r/+ppppppppppppp7:Y02w6rNinUtYBB+1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630473416, "uuid": "0f0e2f4c-2f7c-4d2a-a23c-a8bb542c2154", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630473416, "uuid": "ba46c708-c68b-4bd7-b634-bb64ce359da7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630473416, "uuid": "d66115d9-b6fd-4fed-a0c1-dd3a9dcea921", "value": "Offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7aba45-0ae9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630476040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476040, "uuid": "f5c14c1b-9675-478b-9607-be46a3620d15", "comment": "Malware payload (Formbook)", "value": "1792f51357f5688ce61ae64ac971970e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476040, "uuid": "d0e96c96-6f63-4cad-b844-92d67fae55e8", "comment": "Malware payload (Formbook)", "value": "fcba214bdb4b5a80528aa7a07431c98587a63adbf37405f230e6f79e72e4fc75", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476040, "uuid": "d5732088-150d-4c07-bc7f-be532ac81d55", "comment": "Malware payload (Formbook)", "value": "e52dc4e359c683443892c53acd8fd1d881e295ad", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630476040, "uuid": "3509351c-3bb4-4ebf-858a-b2ba7352bd74", "comment": "Malware payload (Formbook)", "value": "a47b9604e3b77c4969c996a8843bba97ce978a872d24409cef16516e36482cf9ad2a221fc47652b17ac773817e859d5a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476040, "uuid": "2f8faca3-69a4-4026-8275-c2a983fd1499", "value": "T10DD4011AB2B28666F1138BF5C43A8EF3FCA57C10AB5588075BCDF11097B557E50B2E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476040, "uuid": "55ac414d-e269-477e-adb6-38a1e48389c4", "value": "12288:QKS/SeIc9isPc6zIVxqw88uVRcqfOHKZJKG//en2aOf152:QXdLis03VxqcyQ+QG3ewfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630476040, "uuid": "5c53c76d-97a1-40f3-98d7-51616da05240", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630476040, "uuid": "e16c0861-c3c2-4e19-a511-859fa725c92d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630476040, "uuid": "7cc4163c-7a6b-4965-823e-1de4fb654188", "value": "Shipping Documents_2670767360.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2bfe87-0b7b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630538471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538471, "uuid": "9761e48d-0998-4643-a4ca-524dbfa9718f", "comment": "Malware payload (RaccoonStealer)", "value": "d4b93dcedd4ce567b6f10c37ac09a1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538471, "uuid": "eeeecd03-ebd1-4193-9693-bffdc47398df", "comment": "Malware payload (RaccoonStealer)", "value": "fd0883f748efb5fdce5e83245d3bb5bf94d6c7875fd5147a2c87eb9a0c54b56f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538471, "uuid": "72554120-1819-4120-8410-aabf5fae00c0", "comment": "Malware payload (RaccoonStealer)", "value": "c16ca4eae3b422660f290f0e6fd5b41107a5ab1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630538471, "uuid": "3dcc1ea9-d8af-426c-85e1-f81113a2ea64", "comment": "Malware payload (RaccoonStealer)", "value": "8875f41c7c4c62e4fddd4e610c06a671ff894cfa7194ed38d05d76c26f60fb23112ad61690c85fdce454c9b9fc0a832c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538471, "uuid": "df0dd513-0cb3-4bd1-ae61-cd03ee0099a9", "value": "T1F264DF5B76A0ED33C4920B74593983F41A3BFC6D19A4C16ABA14371F4DF1290BB2636E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538471, "uuid": "a2aa33d5-c75d-4872-b1d7-c05bb31b7597", "value": "2bb955c2e0013cafc5696a8a4b50b66d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538471, "uuid": "5eb56072-0231-41ca-97f9-1bfcdc0fd98c", "value": "6144:PcrjLlJFa+AC5GV8HJJ8AfHabPmyHyZTIL52yItzy:krjZja+3588pe0HOejdIcZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630538471, "uuid": "26f0e65c-7b2e-49f3-9b5f-a12d95019998", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630538471, "uuid": "98c8fcbe-2af7-4e72-b811-dd0c7c7679ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630538471, "uuid": "1c778d5c-6b2c-448f-8ffa-3288084f827a", "value": "fd0883f748efb5fdce5e83245d3bb5bf94d6c7875fd51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5336cf8-0b42-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630514167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514167, "uuid": "71e7ada5-e8bc-4d76-8b46-c82b08623a14", "comment": "Malware payload (RaccoonStealer)", "value": "07152a70748b65015173e234f2cf119a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514167, "uuid": "9e91adbb-cb15-4e53-bc98-2c4f2fe69039", "comment": "Malware payload (RaccoonStealer)", "value": "fd5be24f8a05f5a97e1424b367ae6e0db88c55f7ee952392e66f94e17d16b903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514167, "uuid": "381bf8e0-b3f4-48ae-8ff0-8d9ee92b44b3", "comment": "Malware payload (RaccoonStealer)", "value": "470fcc551230be9c3d83ce0696249929058fd4e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630514167, "uuid": "1f7955d4-f55d-412e-b07c-dfe063a167e4", "comment": "Malware payload (RaccoonStealer)", "value": "a4ea4cee1ba58571b1d9c74e13d5cd8d5a026979741929b12479e5f9afe4bf25482460e060e7a352cb5e8c8500502824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514167, "uuid": "9a2ad278-340b-466f-bb17-34d71ecea020", "value": "T10A94E0573391C83FF19101314C55D7B9DA3ABC69ED22C28BB6E42A6F5EF32919B12312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514167, "uuid": "044b814b-1c59-4bdf-98fc-bccfb67b1f5c", "value": "80892f18aacf6a3ec193623c3a9507f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514167, "uuid": "0a2688b2-256a-4472-939d-4f9512df6f76", "value": "6144:SJDLV1YX5PaTKfdYVek3f60U+2qJnR1QSIanX59EPCmK:SpAXITIYDJnR1QaX59Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630514167, "uuid": "e24560b1-ddeb-42d5-bf72-759d3764e3fd", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630514167, "uuid": "33d16282-51e9-40cd-9e7e-ffc36d8c4e4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630514167, "uuid": "53ca0485-626e-4e79-ae13-57cef065019e", "value": "fd5be24f8a05f5a97e1424b367ae6e0db88c55f7ee952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e8b822-0aed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630477742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477742, "uuid": "e2903974-3418-431e-8d45-b51ea70edd9c", "comment": "Malware payload (AgentTesla)", "value": "ceed79fe40c1038ca78784cc26a1eed5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477742, "uuid": "ce38c9ea-9f83-4635-aab6-820a76030d25", "comment": "Malware payload (AgentTesla)", "value": "ff081fd18f74ca6a9e6110e62d4002cc2bf8db495c17ba255c8bc606a8360890", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477742, "uuid": "61328d5a-1b7e-401b-bc77-cc41ddce5cd1", "comment": "Malware payload (AgentTesla)", "value": "842b278b4939a371a363c61ad03c8d1fa7b3b4d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630477742, "uuid": "fbcae2b2-8ced-4de1-9ad3-2d5a4bd40369", "comment": "Malware payload (AgentTesla)", "value": "c74029d3baa454e1054c335269bcdef1dd1b4a4ae6affc9e7e3893f1b155e076fa3bd9bfcd2c58085de052d5b431c7c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477742, "uuid": "bcd267bf-ed22-4c6d-a5e7-a51e8bd87ead", "value": "T1EAF427067A68D844E429C5F0EBEEC2F8D665AD10DE26D1872FD67E2B797618C3D1F080", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477742, "uuid": "76cf301d-deb8-427f-9389-5b0bf4851321", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477742, "uuid": "cc61471c-a996-43ee-9257-d434eb0accf0", "value": "6144:zITgtZkjyVH2jgtZkjyVzgtZkjyVqIQZ/28SCSHXT69MoMKajwf:7tMyZ2ctMyatMywIO/2dHEMoRae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630477742, "uuid": "b0cb68dd-12d8-4fa6-9797-0af1f88d2672", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630477742, "uuid": "3f9b7da8-9ce7-4eb3-a61e-efd942097ee0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630477742, "uuid": "c0d14df2-8460-4f50-ab8f-fdf13ce3f4fa", "value": "ceed79fe40c1038ca78784cc26a1eed5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }