{ "Event": { "published": true, "date": "2021-04-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-25", "timestamp": 1619395381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "02105047-c287-48ab-b012-bf0895201ad6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f09bc3-a583-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1619327121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619327121, "uuid": "e1a3dfa5-ac5e-4c18-8c24-ca882180cb03", "comment": "Malware payload (AZORult)", "value": "0409b7cb48e402847526d7a7914303a0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619327121, "uuid": "6dcfe294-6b76-4bf2-801d-3894242aaf37", "comment": "Malware payload (AZORult)", "value": "0004700c51a30c51443667e0ab7588e4299518daa3de057f9a56a6e3316c906b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619327121, "uuid": "537e360d-85de-4ea8-a068-787fc46517ef", "comment": "Malware payload (AZORult)", "value": "3e758f5054a5ab37bd2325d502a671bd687498b7", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619327121, "uuid": "4e222895-06d9-4563-80b0-32a06206a7e3", "comment": "Malware payload (AZORult)", "value": "f230ab9651e761d62812ac760091f80e1b93edfbc80b1c0bc7b541be295c475cb7c73dc6eb1bf55e1e813a79d0da3df1", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619327121, "uuid": "12ab97c9-925f-4228-b147-bb982824264e", "value": "D6B32A6EF7C19277D02408BDCD45A1B9907975302E391822F7E64F6CD8F96C2AA6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619327121, "uuid": "470877f5-a31c-4fd3-a88d-796a4336b801", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619327121, "uuid": "1440b04d-8cbf-4b62-80d8-e66225afa243", "value": "3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgiGq:faO1tme++wi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619327121, "uuid": "cfa3fbbd-2095-4afa-bf55-967ca5912ec2", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619327121, "uuid": "2d856107-0c16-4069-8459-f4864e3b5006", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619327121, "uuid": "62e7a87b-15ab-487a-ac3c-f823714d4165", "value": "0409B7CB48E402847526D7A7914303A0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4a9175-a594-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619334193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334193, "uuid": "5028430c-7c1f-46f2-8ce7-5d2a506ca52c", "comment": "Malware payload (AgentTesla)", "value": "4f5754368b139ce8773614e65d60ba9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334193, "uuid": "7ba5112d-73b7-4b49-8404-ce2dcb9abeb4", "comment": "Malware payload (AgentTesla)", "value": "034f779a5a2a0436348e9a12d33fc925c688300c26561d8f413ffbfa89dd6c8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334193, "uuid": "9d3275ee-8e24-426b-bb58-f3f4f0ff2e03", "comment": "Malware payload (AgentTesla)", "value": "2b07db9e524ee125b877a45900eb2df6647044ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334193, "uuid": "4d8f5036-5832-4bdb-b4d7-60ddfbf17de6", "comment": "Malware payload (AgentTesla)", "value": "3659b6753a9f26c17320cafcd5b359484a9cffd0513b64b45aa97dcdce335bc918117042517d816871e0ed2aad535900", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334193, "uuid": "60233ae1-e1de-422c-b284-1e37a9d79f6c", "value": "20A21F04B3ACABBBC5A641F108613D7943BA7D890DF1B62D356F33CA9D32186057ADB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334193, "uuid": "ac715064-533d-46e7-b136-16e7353f10e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334193, "uuid": "b30ba248-45c4-440a-b31a-44a1296e31de", "value": "384:0RS/tOX6Aut1NpH6q/H4FdtUU0obL4b4Q3quZ5biW:0RKOXxut1NpHmqw44Q3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619334193, "uuid": "6359c4f6-50da-4027-b46d-cd70d4e60dbf", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619334193, "uuid": "633ce406-7a48-4878-813b-63c81f254835", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334193, "uuid": "c18c12ca-cc6f-4df0-ad8b-c57a560c13d2", "value": "4f5754368b139ce8773614e65d60ba9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabd37e2-a593-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1619334028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334028, "uuid": "e882a527-3d68-462d-adf9-b3f105e7ff0d", "comment": "Malware payload (RemcosRAT)", "value": "242e8f8cf9b0c7e60d952073a3f6c3d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334028, "uuid": "5e411b18-fe8e-4c2b-8f7d-ec3bb9e1072a", "comment": "Malware payload (RemcosRAT)", "value": "075b0ee19107d1de51063e1ed8362107ce4b7c861bdef79a68f54f625e1b32bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334028, "uuid": "968280d2-1296-4fcb-b50b-e9d01339df05", "comment": "Malware payload (RemcosRAT)", "value": "d3ebbdb9170c4d9e989b0425b009653605f6bddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334028, "uuid": "a3a8f371-0d60-4adf-9ad5-3ef63117ebc4", "comment": "Malware payload (RemcosRAT)", "value": "972818cca46756065e3d01c798eaf3b51700bd133c2a5ffdd34f5772c43d4f6167ec89029bff2ef5e57a65a2551aeea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334028, "uuid": "e13503f3-4e6e-4e7e-81a9-e3acd12dce40", "value": "5C24A65378E0C901FDE5D8F7615D76A32D620C213192DD97838BAFAB98B44C394F613A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334028, "uuid": "3b92e6bf-2699-495c-9b18-4e4c5efd0e74", "value": "8844dc828d2c13902e4c29a56376ad4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334028, "uuid": "4f05ca7a-3c9a-4d16-a486-60198a472770", "value": "768:/Q1T0II0wtJskfaVrQsuyiEYa3HX34cWikKpj0BVQttotwSfKhPfom/9e:/QZ3HX340k4j0T9y1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619334028, "uuid": "0d89a5ca-261a-4807-83d2-c25c5452d002", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619334028, "uuid": "6845b628-4b2e-44ee-bf78-1b08be6d0156", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334028, "uuid": "13dc9efa-ba2b-4609-b695-06ba9bc7e5cd", "value": "242E8F8CF9B0C7E60D952073A3F6C3D2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6168d609-a5d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1619363003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619363003, "uuid": "9adb8219-945e-4b89-a325-42493859d126", "comment": "Malware payload (NetWire)", "value": "92b1d2dc4fad9ad9881a9c3411bce7ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619363003, "uuid": "a47f8fd9-39e1-4f8c-a21c-89f0c90c72eb", "comment": "Malware payload (NetWire)", "value": "09fca7615c3a077da0f8302e4675a71cb889ac1ab5c201a05593546a2a425111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619363003, "uuid": "a107ed97-773b-4284-8160-8bea2abe99cb", "comment": "Malware payload (NetWire)", "value": "dfc7d49d70eabb1d616b77fd056a5a65c640846c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619363003, "uuid": "f26d8cc3-6d44-4845-ace1-c86b42097f77", "comment": "Malware payload (NetWire)", "value": "8a0bc3c21840f0b3d2966bd54bd8fbbd90b4e766e769e11974e145ed60ee13f6c80eadd8d46f962c767542bae92e509c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619363003, "uuid": "42fc8a5b-e0f0-4092-8248-35edb2de41bc", "value": "96735C566BF80E25E0570AB11FE286755B33FC758B22CE0B31C5371D0E52E819D82B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619363003, "uuid": "ae71b591-572e-4805-b9ff-19c306771024", "value": "1536:29EjFctvSwmXCCvCXCqzsxObRQ52ISpNbZV:jedCvCXCHOVQ52IS3bZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619363003, "uuid": "1a58bf26-9a77-443a-8251-ccec0dd4dece", "value": 80515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619363003, "uuid": "865ea41a-f6a0-4cc7-8eb4-84d7d9c23145", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619363003, "uuid": "b1789a95-c378-4834-977f-28ce18f3452a", "value": "92b1d2dc4fad9ad9881a9c3411bce7ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f384ab-a594-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619334161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334161, "uuid": "6034c469-478a-4265-bf1e-4a1c78c8cbe9", "comment": "Malware payload (Dridex)", "value": "cf34bd6e3f3f3b9224e6690c05348e6e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334161, "uuid": "00cea308-cd01-43d0-aa16-d9c54b6b4b32", "comment": "Malware payload (Dridex)", "value": "126d93e7ddca40c743fac22376d2c6e5a654a9b0e3abcf3b42c1885f7c34029b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334161, "uuid": "05b257bf-cd49-4db4-8b22-e2016699f4ed", "comment": "Malware payload (Dridex)", "value": "3c07449b3848bb791e15210edea9e0816e18a59d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334161, "uuid": "65c49b8a-aede-4c81-9067-d98f777d866c", "comment": "Malware payload (Dridex)", "value": "c0bb8eb507f8162608807b8db01dbaa3ff36141e5b0348e0b9fb5836bb0c0ce8160c6214e11aad2f9aeef49dd83e1cb2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334161, "uuid": "e36ee2f8-92f4-43af-af6c-4ffa34056873", "value": "C6F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334161, "uuid": "bf655d00-f59e-40b5-99ce-f70bd931f611", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334161, "uuid": "40b632ce-05d0-404f-af88-26e59c16f85a", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619334161, "uuid": "cff4e20f-de13-4ff6-96d3-6a0f219e3367", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619334161, "uuid": "5fc74252-30a1-4d2e-9d86-908af923da6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334161, "uuid": "7adfc82e-69be-4e79-abb9-2af33a4fcad4", "value": "cf34bd6e3f3f3b9224e6690c05348e6e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8beae83a-a5a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619342888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342888, "uuid": "07d0c4cb-686e-423a-a618-2e754febeb52", "comment": "Malware payload (Formbook)", "value": "21b6126ca33e94b500e71f1bb39300bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342888, "uuid": "624c4a21-b831-49bf-ad4a-9e6ed85e56ca", "comment": "Malware payload (Formbook)", "value": "1416666c5e810ca861f2957356678266e742812f3dc29a8361e588af59b8478d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342888, "uuid": "6a008346-308c-4096-a19b-ad80e84b9b8c", "comment": "Malware payload (Formbook)", "value": "7b1f599694bc50b424b4f9297de09c78cf419c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342888, "uuid": "fb7073e8-4c0f-4be1-88de-14e1d187de8d", "comment": "Malware payload (Formbook)", "value": "bb23dbcea1cebc809561ecd0cb37fb2b6ac4f3c6681f78011f5e77cd122c7e6f5f67c86592050e679ce75d437d491f4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619342888, "uuid": "7f244a2d-9c36-4120-9441-d121bd2791f8", "value": "0AD4F13A33DC6B55D13E6BBD6460510603F1F417EB27FA4DBFAC906A0973B448A26782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619342888, "uuid": "f509cd06-ebf2-44f1-9908-965dd5802e3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619342888, "uuid": "37dfa3fe-7693-4ec7-afcb-508b94d2ecba", "value": "12288:IXeFr0zexJgZZFutzppWC35XQqIY7kPuGp7GS6RdqAx6K4Tr:yer0azWuB7SuZd1xKTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619342888, "uuid": "ea1893fb-8126-4d2b-b5b8-9384fbf0b4a0", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619342888, "uuid": "cc283cfe-31a6-402c-84c2-4a931d366e1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619342888, "uuid": "46e4669d-b512-4246-9c03-5b7f7d829646", "value": "INV+PACKING LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cb22cb-a592-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1619333422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333422, "uuid": "848f9afc-97d4-4bd5-a773-a53a9f3ad23d", "comment": "Malware payload (NanoCore)", "value": "1b575b0b1b996b1a6d6fe09a8a961fb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333422, "uuid": "1422c8e5-41bd-4404-bde8-bccdaea251ea", "comment": "Malware payload (NanoCore)", "value": "160ba8ceb1d0f9e0c1bc348f499dad3c131658691b8331e2a9ba1c5121350fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333422, "uuid": "a04afb52-f994-43c6-a5ed-bf0225853e39", "comment": "Malware payload (NanoCore)", "value": "6135d33e05303c89c2f804fdfc6b7c47c19b292c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333422, "uuid": "31d87584-36c0-4c8f-814a-80fda452dc43", "comment": "Malware payload (NanoCore)", "value": "f66b2dced6f2c3ae9d28ab2508f1c8770f2e50eedcfb8ac49c84162495b65f888016f806ddea7293e5966c27cdf56cc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333422, "uuid": "a2a321a9-3e6b-4f57-a171-21b582d674ff", "value": "1E54E2DB2E9486B3D79DF67404B3733C472BA93E6BC38E4E844B3D69573229C8601256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333422, "uuid": "8d22cf7e-46af-40fa-be76-02801af155fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333422, "uuid": "feda03bd-da44-4b5d-b043-35c95e281b6c", "value": "6144:JsTu6RaPez3/fWUa7cpPYIa1gJslEBqZfaOMb:JsPaPezPe/cpPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619333422, "uuid": "03edb3c2-7398-45d2-b9b6-c121bf0dd24a", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619333422, "uuid": "c9e30911-8732-4ca2-9a89-173970d9fea9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333422, "uuid": "153db759-39a7-4de8-829a-1ed2acdda1c4", "value": "1B575B0B1B996B1A6D6FE09A8A961FB6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1b8939-a565-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1619314218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619314218, "uuid": "a56f6222-3f30-41a9-9d91-abcb07df6a5b", "comment": "Malware payload (njrat)", "value": "a25a25ae0ab0d783c9abde71586546b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619314218, "uuid": "f895127f-bd10-4c26-b2be-48acfd72eab7", "comment": "Malware payload (njrat)", "value": "165e079e3a2dac4b6b928cb629714839eb75f132ab7fe0ba456ec5755912839a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619314218, "uuid": "a2d2deab-82bf-41ce-87e3-6dba1e049993", "comment": "Malware payload (njrat)", "value": "3a51787399d64a491129e6f5c7eb541b5f2343de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619314218, "uuid": "9760f03f-9961-4437-9776-a5937086d30f", "comment": "Malware payload (njrat)", "value": "8edafd2685930957e083a199704284820dd655d604b2c028e7949f0fa61274a7bd554561e2f460380394b6e22ea725bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619314218, "uuid": "e1fbc200-ebdd-4916-8d0b-9e5dd6640009", "value": "F413E74CB694E175D5FF8BF1B4A2B2890B71A017A902D30F99F114D94BB3EC0A611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619314218, "uuid": "b3565b67-da52-4fd6-b248-4db2da0489cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619314218, "uuid": "b25fadaf-6da3-4832-be7a-05e3cc50918d", "value": "384:nZywdFI1STss7yKSXfuGSOEdrpS2dzsIij+ZsNO3PlpJKkkjh/TzF7pWnV/greTf:Z3duk4smKSvupPrkYuXQ/os3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619314218, "uuid": "dd9049ab-38c2-4bf1-87df-3b12686427d2", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619314218, "uuid": "408aa412-3698-4eea-916e-232a82996b24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619314218, "uuid": "daeaba49-0386-464f-b42e-e08bf96b5eea", "value": "a25a25ae0ab0d783c9abde71586546b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2420c40-a5ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619345556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345556, "uuid": "30b72ea6-872d-4cf9-9eca-60efbc1566db", "comment": "Malware payload", "value": "69fbb37163b231020b8041be866f13a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345556, "uuid": "b9646416-628a-4ee6-99dd-0a7d06acae0f", "comment": "Malware payload", "value": "1a2a8493be747f95ae9b75bde24fc098fa7c83ec0c16be5c65eeedca264a361a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345556, "uuid": "9b459876-1ff4-4966-b9e2-876d13d33dc1", "comment": "Malware payload", "value": "b31e1d1d0c9ce96f9892d6ae91e6ffa5232cff7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345556, "uuid": "ab4efa83-7e57-4dba-a113-55f111088944", "comment": "Malware payload", "value": "822b7427ebd9f3110d9b572743647ae43abcefcfe64bf0ef01893ed0b5e7b5eb6539a2830d8a044235600d5a79301fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345556, "uuid": "cfc27d47-966c-4405-8517-7c05b91fb99e", "value": "2315F12619B84958EFBD077D68B2407117FABE827022FD0E2AD23D9D35B12818D176BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345556, "uuid": "fd58bdc1-a91d-4cc2-a8a5-ac326d5158d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345556, "uuid": "55584f04-1f72-48a7-a0d5-17fef28e5a61", "value": "12288:YPGKw1FxA+VD29Kg1ClZSzQsh2gbKU/IMUrMQIyxdnvv7VsrP0GKYVPEOsIINY2:4GT/xAiDrg6a2gnAM8Mknx8P0Gzhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345556, "uuid": "7a12f6cb-f2b8-4b0f-80e8-12f3b47c1979", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345556, "uuid": "fee34a59-6330-42fd-8e1f-489ce8440c03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345556, "uuid": "8d4b8f58-307a-43cd-88ec-cb11b76b35ca", "value": "HSBC TT APPLICATION FORM-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a1ab9a-a5a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619340326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619340326, "uuid": "19f8792f-dd49-4bcc-a8f1-388c463dbe81", "comment": "Malware payload (RedLineStealer)", "value": "562fa38d13cb3e8a2607256f91ec508f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619340326, "uuid": "c61fad52-37c3-4928-af54-3ea8568501df", "comment": "Malware payload (RedLineStealer)", "value": "1a7f103d468627513f69d93b38779ca2db2e306bf6a898658f29007fe01a3cea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619340326, "uuid": "35056dcc-8d15-4629-a836-29f533f40344", "comment": "Malware payload (RedLineStealer)", "value": "f15f5b3c918a410056041c1f9b7d20f5df187777", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619340326, "uuid": "e018fa1b-693d-4759-bc80-266f6c306c39", "comment": "Malware payload (RedLineStealer)", "value": "bc42da7498482abdd82514254b77ea1c38a1932b501529f10293111f7eba5693aa33738fc9fb3da9178ab06453de713c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619340326, "uuid": "2f56c218-42ae-458d-92e9-702b7ec40011", "value": "E694F7C6EA518584FD3A08F658386D802BF2BE67B5116A6F04CD705E0E7778312E792F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619340326, "uuid": "4c5186b3-5cdd-422e-afd6-e5631cf0adbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619340326, "uuid": "f006e157-4133-4391-bac9-0b0fac3dedb0", "value": "3072:JGN7UYczfVRLUg1lyeVV0vTMcr5OafU4ydVpVTjEgMIjrX9vGVtwr6CZ5S:JGnchjyeO3zs44l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619340326, "uuid": "dddcfac2-1302-49be-bef6-d4944161df55", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619340326, "uuid": "771fadad-9f82-43f8-b706-1d8fa77163c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619340326, "uuid": "a587fa35-275b-4650-ba9c-655cc5e4c4ab", "value": "562fa38d13cb3e8a2607256f91ec508f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b382775-a615-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1619389541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619389541, "uuid": "a5969a50-552b-45f0-ab91-a2fe7ebe54cd", "comment": "Malware payload (IcedID)", "value": "987dc3747e3343bbd1c10bbebf671258", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619389541, "uuid": "9bbf3132-f10c-49a0-b0c5-b61d8d3e8225", "comment": "Malware payload (IcedID)", "value": "1cbde35e66b6bd65a5db04d67929f0ec73c8d97fa418500daae997216075b1e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619389541, "uuid": "196403ce-a140-488f-96c0-1af43e71338d", "comment": "Malware payload (IcedID)", "value": "9d2c9776cc5d9bcba222d7abf4458741d670f1d4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619389541, "uuid": "5c6691c7-64a3-4ed1-80a3-900a2a0789bb", "comment": "Malware payload (IcedID)", "value": "3f640d9398b65c8f9c63bbe20219f49a1e8931d4e1a63763c565f8d92d505a27b93d832005c53f9ec56301dec1fab32f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619389541, "uuid": "f972e248-d2dc-4f3f-9c7d-40785c78749a", "value": "8FA32BA8A6484347FDFD50F3A1768E315662B333D6BE07BB91C4FB38811CA60E665216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619389541, "uuid": "839d4b70-5938-4948-921d-a037ea5787b9", "value": "ec2d6fd6679385943a8a71982087e8d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619389541, "uuid": "c01d277a-c6e8-4b61-a1e9-88c37527d1af", "value": "1536:id9bBHbBRYi9r39Gz9CUKJPL+Nkvbo0xlgUjW:iPbBHrxk9oWkLpjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619389541, "uuid": "d772f700-193e-4756-8fdf-c745f4579811", "value": 101907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619389541, "uuid": "de9783e1-c9b2-4efd-9c3d-9a7253cf340d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619389541, "uuid": "199d944b-946f-4ae8-8fe7-c081eaa62c6e", "value": "987dc3747e3343bbd1c10bbebf671258.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffed014f-a593-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619334063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334063, "uuid": "edf4ea3c-2499-4de8-adcf-971a07096e42", "comment": "Malware payload (ArkeiStealer)", "value": "c5d0d12b1887e4692f6b595cad5cad93", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334063, "uuid": "9ea2ecc5-1593-4a74-9c51-852817482954", "comment": "Malware payload (ArkeiStealer)", "value": "226c5a97c0f1493f1f05fb404c2201446f4d4e3df0876eafe9e56abe5524eeea", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334063, "uuid": "aacec3ca-590b-4fa7-94d8-93aca50d3f5c", "comment": "Malware payload (ArkeiStealer)", "value": "0b99cd05ec919e2ad7437b0bf40144fb12db8c0a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334063, "uuid": "03a86984-e71c-4147-998a-fabdf54b597d", "comment": "Malware payload (ArkeiStealer)", "value": "e7c7fc85d4374ac26c9d74df0deb0ebc4e984354011545e336122616ec94c5028c2207927cd3fb4062a163264b343052", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334063, "uuid": "d150bc16-061a-4258-bc39-4ba75de32937", "value": "55C4F121B640C532C446367245774BBDA67A9930FF4964B7A39BB92EDFB33C02631349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334063, "uuid": "18997bd4-77fe-473b-82b8-c5b071d7bae3", "value": "f54df06ae9191b8ea8abf425d761c5c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334063, "uuid": "2b87cc97-6ed4-4180-aaab-84528eb3535d", "value": "12288:wXjngki6WTZ8XBcE9D6xHMkbnSlqspmr67nhcuKcxKr5kR52SS48UxoOXg:27gki6WTZ8XNYHdbSlzp26rhcrYKd25s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619334063, "uuid": "c97d24d6-25e5-42b9-be4c-e7bac4c28b89", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619334063, "uuid": "e5497a32-a9de-4043-9c86-d481aeeeef0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334063, "uuid": "cdc2d4c2-82cb-4085-9741-fa7f2627623f", "value": "c5d0d12b1887e4692f6b595cad5cad93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c833d87-a5d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619362539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362539, "uuid": "6230d890-a8e8-40b1-ac67-ea7ad406ca87", "comment": "Malware payload (RedLineStealer)", "value": "ab6f38faa9221ef1b08a2d335630fd44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362539, "uuid": "aa852704-af58-4a9f-a5ce-e3a7a22314a9", "comment": "Malware payload (RedLineStealer)", "value": "22e2c68999bf67926c5020459fb52ef04dbe08642c711112bac2704a15c7561d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362539, "uuid": "ee7cd463-8009-427e-9551-7a3a19e4fb0e", "comment": "Malware payload (RedLineStealer)", "value": "1011a91f6ae31f0e7c5ce03167a050f7ad48e6c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362539, "uuid": "8da245ac-9e2f-4ae9-9949-11c59845a912", "comment": "Malware payload (RedLineStealer)", "value": "cc22ecefc762362af6355bd4235841c4449c868f36241b07fd4beec66df44022a8ef5cc62ee51ee789e1a1e6abcaf063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619362539, "uuid": "10474b4f-0c05-44d3-80df-2ed7189a4e46", "value": "E515BF067F60CF82D1D94672D0AB411C87F4DC453E32E22F2ED1B7AE1A726992D0A59F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619362539, "uuid": "41021429-55ea-4a33-ab8a-93119e4f4d35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619362539, "uuid": "fb0ffaac-b4b1-4ce9-8e3f-4ba6cbe71f85", "value": "12288:9FjANIfIrEiQvkSMzjG2oWCQwFR9qyf+8RMdv1qgJzg7JAW/vUFTVGW:7UIfmEiQ8lzjjJCt4ytDqMeW/vUFZGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619362539, "uuid": "e3a1cea6-4508-446c-8089-7c3bbd936591", "value": 875024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619362539, "uuid": "29cc1d93-0324-4528-ae9b-fe61c610a976", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619362539, "uuid": "b3546283-6bfa-4dff-a4c6-431c30d78677", "value": "ab6f38faa9221ef1b08a2d335630fd44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0fb50d-a5ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619345547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345547, "uuid": "1a9d17c8-c9a9-4e8d-80da-02f01ac04f9b", "comment": "Malware payload", "value": "52333ce7a08c4789b752ac127d50c5bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345547, "uuid": "e1f44289-b8cf-4eec-9c0b-b4439146401f", "comment": "Malware payload", "value": "28923e4a9c0a58473ee83f8ce9f09194bdbcf67d6e7ebae1151bf16bb4955f19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345547, "uuid": "85c42247-886a-4921-982e-be05744e7f98", "comment": "Malware payload", "value": "c6702e260c87209793dd3d1cdff0f8c56cc8cdbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345547, "uuid": "a71565cf-ceb7-47d9-b61b-b5a2e9c20a9c", "comment": "Malware payload", "value": "c1c372dde9e41f71066f1576923da01d5f1c6c5544420978f958a418f03cffb67962feb1bc39de53e77d92dcdf56a54e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345547, "uuid": "b5270b9d-2b87-40f4-81f7-94da29521812", "value": "8B05122655A8C655CBBE033D64B1401123FC6B436956FB0E3F52B4FD39E23868A2736E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345547, "uuid": "0af5815d-a164-4560-8fa9-086d7b74b30a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345547, "uuid": "172e155a-7bf9-49a1-97c4-d5e2cd00edbe", "value": "12288:pI7Kw1FxA+VD29Kg1ClZvzSaubhjkuRFI3AuNWUv/oe8aOxy4Saa22hYJ7hKmfoe:m7T/xAiDrg6G/HFtSWUv/oHNd7ILE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345547, "uuid": "37be4aa4-0678-4d51-9a29-9d0a1452a968", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345547, "uuid": "8cf68eea-3eee-444a-a6ea-d88745c84983", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345547, "uuid": "42eaa3b0-b37c-4368-ae7f-9021481c0601", "value": "ARAMCO PROJECT ETT200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd18c5a0-a594-11eb-abe1-42010a9c0039", "comment": "Malware payload (XpertRAT)", "timestamp": 1619334407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334407, "uuid": "e64fa760-b1a5-469c-a82e-2e6148e2623e", "comment": "Malware payload (XpertRAT)", "value": "1f609ed72b74f23379e8d7636b5faa13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334407, "uuid": "66b4aac4-6a76-41bd-b888-79e7abe04ffb", "comment": "Malware payload (XpertRAT)", "value": "29a4c9380a91012be5a2b3659f9a4c46d0eca15c689a95707f78ccde9cd11f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334407, "uuid": "332c90c1-9926-4c6c-8900-2165b33db32a", "comment": "Malware payload (XpertRAT)", "value": "439d50691f585b1a3cd674a0852834a97d9fc9cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334407, "uuid": "23ad5b4d-aaea-42e4-bc9d-69bbcbc9ebbd", "comment": "Malware payload (XpertRAT)", "value": "6f5c61f23c643c8f9f9e68ef998995010cfaeb0025e2d7163657f943e03f2d6a3b4922ebb197128fb267b220a5c1b4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334407, "uuid": "c44f217a-2821-4f11-8558-65d250643cfa", "value": "AEC2447276366919D19F30318C7132B4D47ADDB93ECB8743B2BD874D1B966AAE10CE02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334407, "uuid": "11791c6f-a309-4510-b87a-7a8a8cab70ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334407, "uuid": "296522b7-5550-4c23-8743-97d6a9a745db", "value": "384:jwNldKAeOMjd2DSLZK6U6NnETN+iB3vwClFZaQyaOtVjY8GC:2ldKzRd2DS14I06L3GC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619334407, "uuid": "1afe17ca-61c6-4e2e-91fb-964ef6a3c2ce", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619334407, "uuid": "09fa2193-f11c-416c-b25a-743563c0467b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334407, "uuid": "8303e302-8319-463f-8bda-824829dc241f", "value": "1f609ed72b74f23379e8d7636b5faa13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf52765c-a5ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619345551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345551, "uuid": "c05352ba-9358-47c9-9f15-5f835c688a3a", "comment": "Malware payload", "value": "00081bed91faa3c207dad0124c95f9b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345551, "uuid": "f55e92fa-d794-4503-b397-693f9090faa4", "comment": "Malware payload", "value": "3cdf63d5741d54b8749990c5285ed1c521d9e2bfffe61dbf596fb0a5534a0703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345551, "uuid": "a361ca76-49d3-40b3-a1c5-a022ef0ded98", "comment": "Malware payload", "value": "59bd162b19db86f67256fe95ed365d30489096fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345551, "uuid": "76180fdf-94a2-463a-b32b-26237ce16126", "comment": "Malware payload", "value": "28bf1563a0871b247f10c73d46b17b4333f629049835c48aea5bed3879f375c11fe8c8079ea12cd09ca510c1c8d051ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345551, "uuid": "5eb96867-b020-4251-b718-b0031e4bf707", "value": "4805023256A89245CBBE073C64F1410213F87742A927EB0D7E9578ED79E63D28E33399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345551, "uuid": "65de3df8-ab9c-4221-9410-6f1e1669af02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345551, "uuid": "327fe3e6-1bc2-4814-916c-610e610ad09d", "value": "24576:fJT/xAiDrg6zqO3sHXsmGTosngvNOOfw2buj:x/mib+55Qtngv0Aw2buj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345551, "uuid": "1688b608-866a-4e5b-8285-4441bc46d715", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345551, "uuid": "4e1c17c4-2c7f-47bd-8324-c732eefd3023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345551, "uuid": "f74a5865-74db-452b-810f-7fa59a2aca43", "value": "NCR Saudi Order confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a558f07-a5ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619344603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619344603, "uuid": "42548f39-7ac0-4891-8b12-a886785c7ae2", "comment": "Malware payload", "value": "199674e87f437bdbd68884b155346d25", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619344603, "uuid": "ac44e0a3-0032-42be-9371-bd9bbb5becdf", "comment": "Malware payload", "value": "4252c0b130be39bf2258c84c436c17babfd650b6d665ac6c4e050f87fe34e46e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619344603, "uuid": "4e7a7775-aa97-45d6-baa0-1fa32cc9c792", "comment": "Malware payload", "value": "e8ff4264da0e3b774dee6575ad7b57fcb883b471", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619344603, "uuid": "4e26ef2c-f7ef-4da8-bbc0-bf510cf7cde9", "comment": "Malware payload", "value": "66235366defb1d0ae54463c62843a36f06f47f200550e63adab04f61e994030c4fd81da3188b7d5f8af975b291f97e95", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619344603, "uuid": "d4731251-8a3a-4a69-a728-adc61b0583cf", "value": "86340127E241CACCC84F66715CA38FA8EF1302689E56D6B64E036D1FFD823722D9855D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619344603, "uuid": "22196cf8-0b7a-4887-b3c6-ea45599160b3", "value": "6144:Vf7tL43npwy7lrh1sBS1hLhZrVXdNoNJ8xszn:V5fQGo1hLHrldNSJa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619344603, "uuid": "f332dc6e-869f-49f4-9960-86c329602fe8", "value": 235569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619344603, "uuid": "b3188c45-315c-4713-b378-ddb639f85739", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619344603, "uuid": "4fdba784-f5a0-4eb0-96b1-bc9b6242ab74", "value": "4252c0b130be39bf2258c84c436c17babfd650b6d665ac6c4e050f87fe34e46e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4de1c51-a5b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619349936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619349936, "uuid": "ba0ae5fb-dbf1-4bb1-bbd0-59357f2d57ec", "comment": "Malware payload (RedLineStealer)", "value": "a965e0c05e934c97344d998d45ce6e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619349936, "uuid": "a3db221a-e5e8-4344-bed1-7c0181b6960d", "comment": "Malware payload (RedLineStealer)", "value": "4356808363315a0dba266a581c2b4779e732c7ecf4c51a1d3b01eb902d2ec350", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619349936, "uuid": "2fe6626c-7c73-40fd-bf06-798a3c303c41", "comment": "Malware payload (RedLineStealer)", "value": "8c7e41ca1fcb3a84cf020ef33da4b52b170d757e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619349936, "uuid": "c3b87cfa-6a7a-4ded-aa27-dad53e8ad1a8", "comment": "Malware payload (RedLineStealer)", "value": "52355ae7181e27b27e5bb18b004a265c658cbac70a230b9d34a57852a625e59f3eec8fc7c93c67608fb1f668ea255dfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619349936, "uuid": "6e46f577-3247-4110-aebb-c9ce68afcc99", "value": "C2847CA26228B15FC42A72B2DD31D43C363E1D7F7143C778A1E4F99C94B624590FAB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619349936, "uuid": "64d9c129-9d38-4930-9491-44fbb5ae4441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619349936, "uuid": "277e19a7-532f-436c-83b5-df4125214e85", "value": "6144:Bbbzu4NBeH5O48sw6yIUtn2MW/l/wzq1lWT86OED:QqdMBMW5N1lUROI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619349936, "uuid": "277d6a6b-c339-4cf5-95a7-d8237933bdea", "value": 387416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619349936, "uuid": "9373afab-63e2-47ba-ab9a-be40fecf60e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619349936, "uuid": "386a5711-1a67-47e6-8d8d-e8c1a57cae92", "value": "a965e0c05e934c97344d998d45ce6e87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6e7d65-a592-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619333364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333364, "uuid": "9b85dee4-3e34-4031-8e4c-d765c66c2416", "comment": "Malware payload", "value": "2f37bd2f85e05d8c90513b108b8f1140", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333364, "uuid": "b057c596-d94f-431d-9d61-9031d443d4ff", "comment": "Malware payload", "value": "4373850b7b61920594cf03b5358e4a00c8325bf2b4045b938e26cb0700e0e5e1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333364, "uuid": "ffb4a49e-f86c-494b-88b5-4885beb6d7e6", "comment": "Malware payload", "value": "4192ff86b65cf8cd7864647b3b1df34edd047b8e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333364, "uuid": "91f52686-1be8-4188-b2f8-a0df80104389", "comment": "Malware payload", "value": "be9e969df28242ddfb3b8ad2a90fd3e875ed8ae08fff3d4a59bbf599e3f32c50c1591f0cb227b6e1f0187340cd2994e3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333364, "uuid": "4d52b1bf-2ba0-4e53-9518-d937a64547d4", "value": "53118894D40CE0F60247FCC201A5956CB3AEC13BF23092564D20DCC3935B44FDAE69BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333364, "uuid": "838a67bc-07e7-489b-b9ac-36f7ec79668c", "value": "24:qv0vvvvuviavvvvi5DoER+LYKa8PbvOglaWD69cvvvvOgGHvQZIA:PDuL/3qGSTH0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619333364, "uuid": "b436e82a-120a-4014-a5b7-31c337eac13f", "value": 1015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619333364, "uuid": "eb5871cd-b1a6-433c-9917-ac0363d10c39", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333364, "uuid": "a3919fb9-68ee-4a43-a5ad-6f807ee644d9", "value": "HC64.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959a2911-a5a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1619343334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343334, "uuid": "a0289aa9-dfb8-46a1-b65b-1a88e217735f", "comment": "Malware payload (NetWire)", "value": "753ca915daa02a1160dd51be01fda71b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343334, "uuid": "2198f646-e699-45e8-8389-e9d32d0961d1", "comment": "Malware payload (NetWire)", "value": "487d208584345524ea7f594cf6ed7e39afadb99d542aefbd13693087669ba5af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343334, "uuid": "66429a38-452b-4e42-882a-6d80674f3b69", "comment": "Malware payload (NetWire)", "value": "aa29472d0968924ca8d04caad965e20b1738798d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343334, "uuid": "4e72ec1b-5002-4d2c-8957-3fa8e259e481", "comment": "Malware payload (NetWire)", "value": "7765cdb50de281a7f9d99c47b4f72d80fbc4fbad113064b5fa759fef2ddaa5a9438319a33709b7b16a97dc1ae9c78a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343334, "uuid": "dd55b349-a440-4ea5-be8e-7a1467a65f9b", "value": "A9F31718FA87A4F6FE0B1D31959BF33F0B757A01C130CE92EF541E85EA23D26150AA59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343334, "uuid": "df2d3bd6-9b18-4923-bf44-0e55ee7e1997", "value": "4563c74acbd357d386b177e402b96ce4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343334, "uuid": "ce39e941-691f-4a59-9ee1-7ef7086b0595", "value": "3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLv3YMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/3zQqqDvFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619343334, "uuid": "89eae67b-b994-48fd-b7c4-ddb81de5f19d", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619343334, "uuid": "b9795428-0e72-452b-b058-1a107a698b05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343334, "uuid": "2f9047a8-2861-422a-af63-ae6759019bc9", "value": "753ca915daa02a1160dd51be01fda71b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b90b1f-a5ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619345005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345005, "uuid": "bc0b470c-bad1-4b71-a6e7-8d74263bdf35", "comment": "Malware payload", "value": "334f499f7affcf993ed7bac78bc12d33", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345005, "uuid": "54a5b4a9-c5e4-41cf-ad34-f811c93c1539", "comment": "Malware payload", "value": "4bcfd731070ac7f07ce271f77cac73ed5d6d691efa185033df8c15dfda593fb7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345005, "uuid": "8a5a8564-21f7-4e87-a732-8b8f0d85dd22", "comment": "Malware payload", "value": "8dbba3a9b2f3ddeee144659c2a28ed96b1811279", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345005, "uuid": "0f747d70-791d-4eff-b32f-4b6b3e9c4447", "comment": "Malware payload", "value": "92a9601bf0b6ac15adcefbc3ad2adf925da662b89063eff1837dcd9422b5c37e532a590689d5aa571663e9966c4a6004", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345005, "uuid": "34cc3d07-918b-47b7-8b3a-eb857c4ece16", "value": "25F433F8CB602D09C6FDB588E15E29EBF7EB5404DCD5C0C7466252A52B04EA3C8E9E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345005, "uuid": "c6a81fc6-cbe1-40b4-b58c-2e430278c891", "value": "12288:DJVgdQVDALvoEdv+wSlsCSBJWZ/hK8Y/cac5+JkOfKBGVh/8MHHhLzQde1:DJe2DmQqGw8s3v+/hK85Z+JkwXv1BLzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345005, "uuid": "56c4026e-f7eb-4ff9-813f-363151a1973e", "value": 760412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345005, "uuid": "be6874b0-e3dc-4339-bd5a-21e3a93af0d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345005, "uuid": "ce8ab995-612e-40d3-bbb5-6056610e9197", "value": "BL -MNLA08005.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d8a246-a600-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1619380544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380544, "uuid": "647957a0-6ebd-496d-9f15-4fe114d73a65", "comment": "Malware payload (NanoCore)", "value": "087bda2b4760b72aa7e015e6f1f541cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380544, "uuid": "826aa707-3c56-42cc-a986-e9ae0dc89f04", "comment": "Malware payload (NanoCore)", "value": "5a72ed060f0c04201591256caff85cbdd4060db0cf777707c9347a5c8e0f6bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380544, "uuid": "ffe7c43c-3846-4cea-bc99-9345cd6f30e6", "comment": "Malware payload (NanoCore)", "value": "26fd2a1e9a35acfa74be845e6d9e7fdf29638877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380544, "uuid": "3c1dca40-ffa4-405a-8fa6-7db6ae87722b", "comment": "Malware payload (NanoCore)", "value": "76a81ed985e3417f12f820336866d07a033b1928a2e22bfbac5b9d824cd232d5fe14d577c8d44950c402975cb0df1928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380544, "uuid": "27a88aa3-96e7-4a65-9919-ec82d07e8ad0", "value": "D0F45FA932D6D129EFF39F3AC4D40118A590FC53E48A2E25B1BA774622BBF904137753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380544, "uuid": "020d5787-856d-4615-86bd-0e7902696521", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380544, "uuid": "29cff125-d734-4f85-a890-d61591c7d666", "value": "12288:/q+I0VQJFCivvG1EkAGky991MsH3HPCnb90s:/fIzFjvvGOkARApHfmWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619380544, "uuid": "341f5f1d-829e-4d9f-ad72-fe2f7749579e", "value": 749089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619380544, "uuid": "70e7a0ac-884e-46b3-854d-0d9c7557cbb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380544, "uuid": "3e518b80-33e6-4b1a-a61e-7fe432ba4d6b", "value": "087BDA2B4760B72AA7E015E6F1F541CC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a5e26f-a5a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619343139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343139, "uuid": "0eaf21fc-0ef7-4d4d-a40b-9b69d4c94098", "comment": "Malware payload (AgentTesla)", "value": "c85fe498d24b0a589ecd3fea9fc2a163", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343139, "uuid": "ee7cd5c3-b2d4-4d8a-bf43-2e267534ef0b", "comment": "Malware payload (AgentTesla)", "value": "5eb4b586d432be9a5f9e26f10480ccfcb204ab1225b4d5852aae1c66c6ee2211", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343139, "uuid": "9c160176-93b7-4f66-a4a8-8b078fdbd836", "comment": "Malware payload (AgentTesla)", "value": "d9907b473fd6c25b9894ba66dd9f832067532248", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343139, "uuid": "82470ca9-d93e-4722-82df-490a5bd626ea", "comment": "Malware payload (AgentTesla)", "value": "18b11a6990b802f5f2b6b128bf2a4bbd8feaf129f6fd7069957eab001048621f8aa7e5fae1325ff792882cff3148aeec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343139, "uuid": "96639d6d-f5ec-4136-b142-6bbe598785da", "value": "E6B4232C495DFBFF7B0266370294A565937CBF40F1A43A250AB0E168FB058DA463B277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343139, "uuid": "7817fabb-58a6-4c87-afba-ee4cfdf5af1d", "value": "12288:HmLW9REt8C+FCtUFi1vk5Nyn9f+3GR0DJE1TWsP8rRUyz0kba:HmLKDFCfREyOGRwJST3Iba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619343139, "uuid": "be58e012-b28c-4cdc-be9e-2f4ad9af2013", "value": 523428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619343139, "uuid": "b9111c23-87b4-4f4a-b719-1816e3c50e8e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343139, "uuid": "59bc3dda-27b7-4833-a69d-54dd96ea2238", "value": "Purchase Orde.pdf.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e9e596-a5d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1619362853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362853, "uuid": "b564a9aa-f659-4da7-8bc7-8be69619b2fb", "comment": "Malware payload (RemcosRAT)", "value": "374872083b769268ef5be044031e72cf", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362853, "uuid": "9dd3c28e-8094-46b8-b9ca-614f18f2cca1", "comment": "Malware payload (RemcosRAT)", "value": "5f06da67169389577ec237bfb0c3e0e9203833048f48081deed7b6201ad18c27", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362853, "uuid": "63417b2a-c0f4-41cd-8c99-d33215c59fa9", "comment": "Malware payload (RemcosRAT)", "value": "ccb15dd8642387523121e8c67bb8fa41b2b2f966", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362853, "uuid": "0c36a4fb-dae2-41ad-9172-3cba9a103b7e", "comment": "Malware payload (RemcosRAT)", "value": "676afa92e2ff3a0d38ff4c3c79ac0d78e87bec0660d5ab1a042401bf5a1c684a5433616fe03d438c06735c51dba8788d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619362853, "uuid": "d46c7416-3c2e-4b12-b02c-76066523676b", "value": "A601E113B6255F0E54239A0278717057DDC258C75677A229F2DC92B159DCFCF0618FE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619362853, "uuid": "a9c4480d-d8eb-405a-a3bf-94615b49f02e", "value": "12:jaiugaiuTfhUZDiwgAwrO+WcAtMXEhXY0LxvOFrhxFEbWFFiw/5JTxz/iuw:jpuwuTSZDirAwrOtcKMUhoyoFrhDrFFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619362853, "uuid": "7a14152a-78f0-4605-8e47-49cec29501e8", "value": 713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619362853, "uuid": "4917e3c1-67a7-49d7-82a1-4996e9527b36", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619362853, "uuid": "0dc480fc-9c2c-4011-b188-bbe0eea5e4f5", "value": "Appraisal.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5129ba4-a5ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619345561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345561, "uuid": "cc7eafcd-627b-470a-9f6d-d7f77eb39c5e", "comment": "Malware payload", "value": "6130c5d9362a0a16a133ef98bd8e1e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345561, "uuid": "40617bad-5a6f-4811-b848-b12373d47108", "comment": "Malware payload", "value": "62432e5c18aca2d5cfb32de2cba3d79b0de60b72d8930b31e450a8d975a0095b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345561, "uuid": "16cddf10-db61-4b97-a29c-8418ac55a250", "comment": "Malware payload", "value": "63c83861343d766e7a6fc3e9c4fbe26ec1944f23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345561, "uuid": "cb698f01-6f38-478c-aea6-e524d877c21c", "comment": "Malware payload", "value": "eba368ccd117c4b1aac3cd4a6075372956bdfd11dab691a288c9e65ec4cc4c299079e10b39f3bc692f394164a87ee79a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345561, "uuid": "46e8faf6-fa3e-498e-8f77-2ed5ee501623", "value": "2C259B032ED4DA8CF5E90A3D14FD00223FA7D9C2080EAFCA59C7B7AD15E1546F922A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345561, "uuid": "ab25e35b-e452-4fd6-aa13-434354f03101", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345561, "uuid": "9a359266-aa47-47d2-baae-688c97d72b1a", "value": "24576:XOT/xAiDrg6AJueg4U+0XwsQIuovsW6tJ:Y/mibAYK0XwszJ6tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345561, "uuid": "4181ec38-58b1-4092-8981-74808f7b41d4", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345561, "uuid": "6e8e10e8-bce6-4e7a-972c-8c03800507f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345561, "uuid": "fd46211a-8231-44ca-a19d-dd9630ce77af", "value": "Confirm Invoice RFQ-00032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481ae251-a5a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1619340627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619340627, "uuid": "bb37c2a7-1dfa-4dd3-befe-ebd28de4a0b7", "comment": "Malware payload (AsyncRAT)", "value": "586d855fd5b0ff4e6c3322466c5a6334", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619340627, "uuid": "9eb6676f-2e43-4c1f-80d2-8e5e4b015113", "comment": "Malware payload (AsyncRAT)", "value": "67cddf20b97b556dbddd093978096f2001a978a7139fd5fbb4daff2dcd98b1b3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619340627, "uuid": "ba551501-8fc2-481f-8f0f-e24b34cd85d1", "comment": "Malware payload (AsyncRAT)", "value": "b3c3e47cf4b5955197d6f5e2cca79ae1e4b9d891", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619340627, "uuid": "78984c17-976e-4fe1-8c3d-fede4d16a955", "comment": "Malware payload (AsyncRAT)", "value": "15d81dee47abc8b3f9a351609c6e107243c18bc8e7a06b6b17de8489c056d12422a93600235953732e8524b53559447c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619340627, "uuid": "059c388f-1ef8-4bf0-aee1-233d07bf1c4d", "value": "EFD2E65A2490724DE5A709702C65ED343B28B3B05C95D10EF866919CCF82BFE74EC9EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619340627, "uuid": "6e7e5755-4442-477a-a26c-d6a560e2ef25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619340627, "uuid": "ff3e677a-1f52-4155-97dc-c48d68ab142b", "value": "384:vbkT5dQ2gbXak8NYlyWV4wrw+fdy44HQVTogz9k4SpekJ+w2uaBp6ZTwL/miUg18:AdQ2gG3ayWVJrdv4wtG4Hw2ZBFeiL7hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619340627, "uuid": "5cac7bf2-c79d-4ba9-a7ef-e3442935b885", "value": 30576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619340627, "uuid": "9fb0044e-239d-4c4f-a101-397a4fa30273", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619340627, "uuid": "72e9ad9d-4416-4610-b142-b2fa2ab60162", "value": "586d855fd5b0ff4e6c3322466c5a6334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2d6172-a592-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619333493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333493, "uuid": "13786530-24ba-4391-8d7d-cba11d9b146b", "comment": "Malware payload (AgentTesla)", "value": "6807e31834bcbc1f20d1d1a55c5810ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333493, "uuid": "8caf9c82-6c17-476e-94a9-bc75e1686eb0", "comment": "Malware payload (AgentTesla)", "value": "6b53de1c0e12ab20d4d5cdaad00111e0b452a131fe41d257aa5d2779212d5304", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333493, "uuid": "d5042d63-acaf-46f1-bbf6-acb90689e21e", "comment": "Malware payload (AgentTesla)", "value": "56471f2938e23a7a5886030920e80b85fddba93f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333493, "uuid": "95f67db3-17a7-4f5e-817e-634536baed7b", "comment": "Malware payload (AgentTesla)", "value": "f0208df7432c65171950f20e60bf66d7cbc379728b419b6f16c88e694cff4aeb31fec9d0a062153a7aa964896ebdfa63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333493, "uuid": "317385a1-7e9c-4e50-916f-306235846063", "value": "150502275AB89605CBBE533D90B1010017F9AB82985BF70D3E4BB4FD3DE57418A2762B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333493, "uuid": "c40bc550-ba8a-46f0-ba71-79b9ff59e5a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333493, "uuid": "7495f8dc-440f-490b-88b7-ee73f1781699", "value": "12288:GvobM5Kw1FxA+VD29Kg1ClZt18G36NEzfGRVaOCI9dOw9R02MzTdFPTvnacAZo+O:qobM5T/xAiDrg6gGEp1zOwvp09vnz/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619333493, "uuid": "b953de15-321d-40ff-978f-a01aa5e0009b", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619333493, "uuid": "98fb6afa-2492-4e0a-9364-f51025327a1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333493, "uuid": "4ff74389-5460-4e47-b3dd-b5c4200270b3", "value": "QUOTATION 25.04.2021.pdf (113K).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2703f695-a5a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619343148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343148, "uuid": "699ef8eb-ffa5-4cac-bdd1-56efe3ae4978", "comment": "Malware payload (AgentTesla)", "value": "6ea76e1fcb4833c95a626f8d8a897d23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343148, "uuid": "7611e71b-3e32-4fc8-9582-e9382a60572c", "comment": "Malware payload (AgentTesla)", "value": "6bf5ccc83e6341f76dcead9f5b94dea9ebe33a835c60879daecf9ecce26b2ab6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343148, "uuid": "874f7291-b8c6-4b5a-a196-2f2654a72c20", "comment": "Malware payload (AgentTesla)", "value": "1f7721f90906c63791a690882f5a9bbe963a76ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343148, "uuid": "d2feffe4-5a1e-4c11-8de7-c4711349a88e", "comment": "Malware payload (AgentTesla)", "value": "abd9b958ddbf030f4fb1a06bebc5258a1fc0217127779fed6322912e35e4b91b91faebba9b9a01609afd07ee26dbd16e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343148, "uuid": "c29550d6-7e7f-4652-a601-bf44161b1825", "value": "7FC4014BA75E5708D1A9833FC0E9947580BA9C619321EB3F38F836BC4AB67DD0854B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343148, "uuid": "0bc06ae1-4608-4c6b-b2b5-6d0cd3ca895f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343148, "uuid": "503d9917-d075-4e51-917e-da9c8e792d56", "value": "12288:I2u9tD8m8VtUCV4Kcqu2QtQ0qdAH8FWzsi5z:I20mmUcqu2QtQ0pnzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619343148, "uuid": "70453638-1033-4ce9-9a3a-b8dd9da874cc", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619343148, "uuid": "5a60731f-9818-4562-803f-af3477b9ece8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343148, "uuid": "71c62db7-2e8e-4568-bb1e-10fc18d3d75c", "value": "Purchase Orde.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af89ddd5-a594-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619334358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334358, "uuid": "bc95a924-c8e6-4f7a-adec-9c2f195a21e2", "comment": "Malware payload (AgentTesla)", "value": "c2b231062cbe27b6a2b42637152c8967", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334358, "uuid": "3f0d9f55-8783-49b4-bfeb-f86f402b2acc", "comment": "Malware payload (AgentTesla)", "value": "6c3660bf20a2e8b08dd1419f6a1f12195e83d7064724e7de895d648d5063a72e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334358, "uuid": "43ae86b9-436d-4396-9e6f-2fe074845a6b", "comment": "Malware payload (AgentTesla)", "value": "079eba2add88c93c6f6168a04a2b0b32d2190f24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334358, "uuid": "9f31c402-10fc-4f87-ba6b-bb10ac4611e7", "comment": "Malware payload (AgentTesla)", "value": "7ec468689511b888e43f88cf9bdc4defaa2f405f5f12c171f2916c469b481532e0a1f7ced75531b9bf42cc15ce944dee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334358, "uuid": "a86dc4d8-d2bf-4462-ba5c-581c5e44825a", "value": "D0F2542EFF03B676C64651324CA372E05AEF43968935C75BF9EEA63449CA214095FF80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334358, "uuid": "8513fe70-e462-47a0-bfa9-fc2a500dd50a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334358, "uuid": "c31216ef-d85f-4df7-94d9-6acbbd9542d0", "value": "384:8JDr1xmVMrL9Drn37QzIPc7MOQs8XIQH/7ppl/Mm+l03RdJmXswe6bKi:891xmeF7Q0UQD1f333D6so", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619334358, "uuid": "c69b9618-6f2d-4523-ae7d-f252066f39dd", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619334358, "uuid": "84b06c54-8157-4d19-b1e7-0b39ab540e32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334358, "uuid": "90938839-5256-412d-adb0-8ae478b818e3", "value": "c2b231062cbe27b6a2b42637152c8967.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b517b534-a596-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1619335226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619335226, "uuid": "55f9d3d1-f806-4c9b-8138-8d07bf23e964", "comment": "Malware payload (AsyncRAT)", "value": "2d291801615a60835b56693d5c8072af", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619335226, "uuid": "61c50934-6af9-40be-8905-63c05ecb3f78", "comment": "Malware payload (AsyncRAT)", "value": "6ec16dea6d0df7a76c33895bf2e72253567f03eca5e1bdbe9b0a8aa328092bce", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619335226, "uuid": "200bbdf5-dfbf-4d47-b01e-0553dc19ede5", "comment": "Malware payload (AsyncRAT)", "value": "2d11add6c349bc967243d1d8c17f855af7072255", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619335226, "uuid": "fb813eb5-b937-477c-a4fa-e6b84b4aa59b", "comment": "Malware payload (AsyncRAT)", "value": "458cdd4205156738dd04298b1ef837df833130240f2a296462c382bb8d605950197dd0e453bd8ddb75d11dd5365d1023", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619335226, "uuid": "357152d5-b0e7-463e-8232-3bf797a015a3", "value": "B0D2E7AA51A0B415E9D70A302E75FD303B28A7709C84D20EE06A915CCF827F674EDDDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619335226, "uuid": "922826cb-fc50-4898-b924-5a8aa4076c29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619335226, "uuid": "0c6c68d6-1bc7-47a0-915b-7cf3388e03fe", "value": "384:FLQ4AZfchEByfV4sYWiV62BiedToNq98dDSbyDNLTs4/xyx/6qx5AThw:tAZ0hBoW4VBvT+SOL/ch6qzchw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619335226, "uuid": "1fdfe744-c74a-4c41-be88-06b320c5a29d", "value": 28656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619335226, "uuid": "1681d93e-7092-4e99-a30a-47f871c196b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619335226, "uuid": "cfa1a752-7ffa-47b5-8c88-f18cb2a786d0", "value": "2d291801615a60835b56693d5c8072af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a05aaf4-a604-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1619382345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619382345, "uuid": "a79fa572-4985-4491-9d9d-0c3781b815a1", "comment": "Malware payload (FickerStealer)", "value": "3bc84c0e8831842f2ae263789217245d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619382345, "uuid": "6237225a-b627-4a89-9b1d-9079c1e8b1eb", "comment": "Malware payload (FickerStealer)", "value": "757e7c2569cc52c9e1639fbca06e957cb40f775d5cb1a8aafa670131b62b0824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619382345, "uuid": "cea506ef-6b4c-4191-bf3b-70b1470b59f9", "comment": "Malware payload (FickerStealer)", "value": "d60b174c7f8372036da1eb0a955200b1bb244387", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619382345, "uuid": "e2d231c1-76a6-4924-9716-6e3ef65ace55", "comment": "Malware payload (FickerStealer)", "value": "6a016f603aef0100f1ead03cfc079c7f1e0babdc421ed03440763d7655c29e711720fc6875f5991de0a9b3fa49ac3382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619382345, "uuid": "d0940936-fa5c-47eb-8a0a-7354caa78ef0", "value": "65D34B01F0C3C4B1F061253527E4AF509EBFFCA18B2D6E57238612299E3859AD939E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619382345, "uuid": "29c86ad0-0674-4272-a8c0-b53481651c5e", "value": "e1baf4ab6685a606620fe187c276b405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619382345, "uuid": "6b245cd3-f808-4024-aac7-e09a14b189ae", "value": "3072:K3eaeYFHKui2oZGvH+2z+80ZozzhtYR2mdvd5tH8JLmwo:XEFEPX2tltYRPtH8Jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619382345, "uuid": "25db4b2a-399e-4960-a5d4-95b93229a50c", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619382345, "uuid": "3bb17dd1-e827-4ea4-8d0d-c73489d43a31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619382345, "uuid": "ffcf655d-6eac-4b08-837e-c5c87e439ad9", "value": "3bc84c0e8831842f2ae263789217245d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e18eb6-a5a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619343073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343073, "uuid": "29966563-c652-47e0-903c-42680b04e846", "comment": "Malware payload (Formbook)", "value": "c797fc48467257693a93b67c64ed2dcf", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343073, "uuid": "5d219ef4-4ab2-4f36-b42e-7d442e9f4637", "comment": "Malware payload (Formbook)", "value": "85ce611551377829b136b41ca0e67aaf83a27cd616f39e524dbeb715bada4667", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343073, "uuid": "9d6ec08a-7b93-47e0-bdf1-4c7861d7fe59", "comment": "Malware payload (Formbook)", "value": "6e483c8d30b66332f99f746378c55b5461a6a43c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343073, "uuid": "46ee8893-60be-437f-bd7a-a5ee89ce66b5", "comment": "Malware payload (Formbook)", "value": "f413721fe48d0302a16b52df6dd7402defc6e2c4abb7ae63c9093156f3e55f0798234b8183151464a623790e40e09157", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343073, "uuid": "ff13c57e-08b7-4737-ab6a-cac1e7bb847b", "value": "05C423C367503D19BFD4B80BD6BC724DC3BB0DFA5E6960FB0A409D1D54893D65E89222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343073, "uuid": "fa1c7d68-aa4e-48a8-b0bc-bd8d9aa148dc", "value": "12288:iP1EnQ2zWo/935eGA3SXOdsGl9OpF39O4mphhYWpGkL/cpy6jFjd:iP1EnQ69MSXOyGlU84UhhDp90py0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619343073, "uuid": "706a9690-161f-4101-a248-3cefb4710af2", "value": 571591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619343073, "uuid": "3b351199-43e2-4c56-8ec4-cd227b5a3214", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343073, "uuid": "646f3ebd-f50d-4eea-b40d-a5cc86f0b81d", "value": "shipping document PDF.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce003808-a55e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619311216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619311216, "uuid": "0a63a82a-ccca-4a48-ac67-5582d9de93be", "comment": "Malware payload (RedLineStealer)", "value": "a132eee008e8f86833d9d36f74657315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619311216, "uuid": "6e64e66b-f592-4d39-a82a-df9226081576", "comment": "Malware payload (RedLineStealer)", "value": "89f4f55bd21204bb1537bbee8cbdadc3a380143a07eac3d227bb971240c9880e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619311216, "uuid": "4694edfb-bcfa-4bea-bbb0-a971099f9bcb", "comment": "Malware payload (RedLineStealer)", "value": "53b72240acc79ea9208057f2ca99f3f756dd4b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619311216, "uuid": "7a871fed-034f-4e19-b730-50eb54cee08b", "comment": "Malware payload (RedLineStealer)", "value": "cb1ef5c82f3abe487ebd04cdd26a368920884734b1f9c61e2057f11357841ce4ec4ab2d92e7e0075424433b9af0df587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619311216, "uuid": "a227f23e-68d2-45cb-b13d-3a080641e77d", "value": "AD936D2E635D8E25F7FD46B574B0412507F0D1CF2012EB5E8EE5A4EE3E2A7CD26085A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619311216, "uuid": "5e1251f3-dfe3-49df-89e0-9598a3a6b5c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619311216, "uuid": "95404c9f-1fd5-460e-8330-75d25c8ebeb5", "value": "1536:+ZsoIiz0U2/Ldfuul4LMU+PYmtN7JjGFhJb3AFUT6oloEUywEdRlxchgExIUt5Cr:+ISqPYm1GFDeUdloZyvdRYhzxRtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619311216, "uuid": "e31321b8-aad5-4521-bf12-d30f8c413566", "value": 95144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619311216, "uuid": "7fa28728-793b-48fa-9e86-f91f8b0b64cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619311216, "uuid": "542b250e-85d3-4a39-868d-d0da18b635af", "value": "a132eee008e8f86833d9d36f74657315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40261e6-a5cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1619358444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619358444, "uuid": "2ff89f2c-ef76-4d89-9211-aa392549deed", "comment": "Malware payload (AsyncRAT)", "value": "ce51f3084457fb6dc951fc227876eae4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619358444, "uuid": "efe36d0c-60fb-4c55-adcd-69ec7b81187f", "comment": "Malware payload (AsyncRAT)", "value": "8caf62d462e50ef6d1d21a018b8c3f99ef7713af0353d7fa23660f6a6f04a4b9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619358444, "uuid": "4a992e27-2a44-463b-a4e0-e140655ba09a", "comment": "Malware payload (AsyncRAT)", "value": "d23747af1572531f22f53d04cc6af92c5ff4b58e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619358444, "uuid": "16de157e-81e2-49ea-8442-d64c22444c09", "comment": "Malware payload (AsyncRAT)", "value": "1a6041ec175b2d193f16f7ac26cd5292d6f9810baf9b1c91e44ad445d7405ffd87c7ae1e07d956ce4bb9c08f97b09bf1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619358444, "uuid": "47533893-48d0-4c16-922c-3d23bf3de0bb", "value": "9B232C003BE9823BF27E4F78A9F321458676F2677A02DA4D1CC442D75613FC69A425EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619358444, "uuid": "a38c04c7-ecc6-498a-a759-ca12b7edbf55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619358444, "uuid": "2e22af01-be81-4b6a-903f-ec317f71a477", "value": "768:euQaNTREhzxrWUXWm5mo2q7q3VZhksnuPI1f/MtihYCT0bn0RaTyLU9gtzA+425y:euQaNTR+J2dXnX1f/VyCYbn0M+AkA+zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619358444, "uuid": "98b49f92-06b6-40a2-9b1e-2b0741f76ca8", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619358444, "uuid": "9d875c4c-52b5-4fed-a87e-6a847bafe758", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619358444, "uuid": "2634e80c-4256-48c8-a324-e74ac81c53cb", "value": "9MMC9QsM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb4c3a8-a5a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1619343483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343483, "uuid": "595025d9-0929-4866-b448-0ebeb61665a9", "comment": "Malware payload (SilentBuilder)", "value": "b410380eee2661e27e61ee04f278df0a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343483, "uuid": "861b9ac6-5d36-4b0f-8e1d-5f8660f08b1e", "comment": "Malware payload (SilentBuilder)", "value": "8cd05deb5574997e63ba125d13fb3fbddbc1cbb41125102a2f6828f0f0e0bdb4", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343483, "uuid": "d2457e9b-0d73-4d1b-a09c-c8173b82ae60", "comment": "Malware payload (SilentBuilder)", "value": "775e87277e3d371658b5df81f16e75c4f550677d", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619343483, "uuid": "0b9ea8d9-d191-424a-81b0-61c83ce92fca", "comment": "Malware payload (SilentBuilder)", "value": "62f6ebe50b008372f9490cc919a9483753a84aee0f8794f036dfd861e3e8c6a638d5f4fde4cbd36db601bac9f9334a2d", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343483, "uuid": "063ae406-44f3-429b-8631-8471d8c2e036", "value": "8A54C3D2B112A164E1585F36E826417C42EBEEAA7B78F18B2C04F3B73B771D13E41919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343483, "uuid": "64f4f741-71f9-4596-ab2e-ca3ef420a853", "value": "6144:KcPiTQAVW/89BQnmlcGvgZ7r3J8b5IXJK++Dih:mih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619343483, "uuid": "39560104-499b-4607-84fd-36a61e5d7ad4", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619343483, "uuid": "b1669e02-a635-4c8f-885e-9fd18f28ea8e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619343483, "uuid": "d03f64ba-274d-45e3-a132-c9fe043aad80", "value": "Documents_1344549788_1549269731.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c0438f-a58e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619331622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619331622, "uuid": "1f8e233d-86eb-4ca7-906e-994d7fa4ce6b", "comment": "Malware payload (RedLineStealer)", "value": "a852b5b1a1ac01ac7e4ae43350ec5eef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619331622, "uuid": "4e117a67-74df-41a9-9f3b-c3c8ac515e2b", "comment": "Malware payload (RedLineStealer)", "value": "8ebb8055360c52836ac0381aaecc6eafdbd84092473b1fad730f2cced57225c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619331622, "uuid": "1108558c-608e-4e29-9abe-fa1f269926e0", "comment": "Malware payload (RedLineStealer)", "value": "5974005c5d2edd1cb2e1ab240e932c25dd16b320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619331622, "uuid": "5ca145ce-0970-4d09-9d85-2ba54142b3be", "comment": "Malware payload (RedLineStealer)", "value": "f42b3c3aacd92be74df0fd626d26f710fb5bae8758647269a74c7d59bdeb88f64891644dc1f86fbb2d5e5d8931d2518a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619331622, "uuid": "6dc66cef-e8d3-4bec-a2bd-86bf5b4d2a0b", "value": "99C5093137EE8234E6EB1B7898F741250131B8551A01EB6B9888429A5E9B7D04FB33F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619331622, "uuid": "94b0151a-9e65-48bf-9964-6354678dec64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619331622, "uuid": "c8bbff20-dae0-4978-b99e-43849867ffc3", "value": "384:P7UlYaiYmccuGsGapNKYbPNIKydy7la20igPyRbCSECp2/:TUGkm9uTPHy+gPSCUpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619331622, "uuid": "b32082d8-4edf-42e4-b30d-81d3bec5ba50", "value": 2521504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619331622, "uuid": "6d941443-6a76-4fba-9d9f-9d36c512540c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619331622, "uuid": "c4170c44-9b88-4255-b3fa-d6595c82b7c7", "value": "a852b5b1a1ac01ac7e4ae43350ec5eef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d50fa1-a593-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1619333934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333934, "uuid": "4290ca00-37ef-4cec-bc51-59fca7a7cf53", "comment": "Malware payload (Gozi)", "value": "b8bb6c8467092ef368e68446e68415ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333934, "uuid": "654531dd-8509-4ff6-aa1d-52bfff48d124", "comment": "Malware payload (Gozi)", "value": "900a62f1d821af1da2b5235e651057b062a9fd3c74002ac38218038f7e6b4ea4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333934, "uuid": "ddc0e178-ed7b-41c0-b536-8c2adb792203", "comment": "Malware payload (Gozi)", "value": "9d0588bd231af048ba576216a158ad261a41d242", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333934, "uuid": "9fa8bd1d-89c7-4db2-9305-d99f11ac9754", "comment": "Malware payload (Gozi)", "value": "08d15be88377c6406a0ada8860017fa1d4aa362580eeedc5e4ed00f419c7fceed896ae49cb81f2ab037b631db896dd58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333934, "uuid": "e5ee16f5-d2ef-46b3-a7dd-77df32aca7b5", "value": "CB15C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333934, "uuid": "c1210ae4-ee3e-4996-bff1-b17845c840c5", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333934, "uuid": "e911fd0c-7cc0-4910-b33d-0acdd47a7b53", "value": "24576:HQfpzjXPgfM8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgQJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619333934, "uuid": "c41ce0e5-e8f0-4322-a79c-6a61283260e3", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619333934, "uuid": "12f7aaa2-300e-410c-8465-0dedd215f345", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333934, "uuid": "3f93d35f-44ec-4314-9e14-6e71053da4cc", "value": "b8bb6c8467092ef368e68446e68415ec.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7ccdab-a5af-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1619345843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345843, "uuid": "ada11f80-96d7-4f0f-b589-ee5fc779842d", "comment": "Malware payload (AsyncRAT)", "value": "8bcb7f7c44330a4b20e3912225aef848", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345843, "uuid": "fd0f0ccd-5133-4079-abc5-bb6e1f42d258", "comment": "Malware payload (AsyncRAT)", "value": "96f0812b2f8c0589a04b40ea1a9438d41e901ef660ed493c3d5221c535c18b4a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345843, "uuid": "f8f8ab1f-459f-41fa-9383-d446e6c6d792", "comment": "Malware payload (AsyncRAT)", "value": "d149ab3a65a6273d395184ef61a6c687a53c32d8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345843, "uuid": "3b67029c-2c9e-4423-92c8-4256cde417e8", "comment": "Malware payload (AsyncRAT)", "value": "ff69f543449866e9fab41d849a64412f84394faa8dfa6eee6a85c9e59d21ca9b3e7da5214069ea7d9fd7bf04408b706b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345843, "uuid": "6e6ba5bc-e46c-4d86-a5c9-aa67f01571a4", "value": "21232B003BE9812AF2BF4F7869F261458A7AF1633603D64A2CC411D75713FC69A426EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345843, "uuid": "f91541cc-c23e-477b-b031-78c64beab6c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345843, "uuid": "23b4c8cb-fbbb-4d02-8be7-b1f55915e7b8", "value": "768:zui3NTdFHLBWUZiGrmo2qrk24slX6bbb4hYK41PImezjb2gX3idML2tLVSBRRBD7:zui3NTdBR2IBGKVme3bpXSuyWddzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345843, "uuid": "ac78d1a4-7e1b-43a6-bd17-79ac52bf61d2", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345843, "uuid": "f9cba66f-bf36-46b8-b9e2-0625bbba299c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345843, "uuid": "494ab90c-3657-4c83-9c6c-977c2fe17069", "value": "8KSEfJvz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba66d706-a5f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1619376037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619376037, "uuid": "e9041b5a-6955-43e5-b53c-e3296f5c6356", "comment": "Malware payload (njrat)", "value": "ad9071f2afc83fbeea157d241e8df82a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619376037, "uuid": "cf1eb8f9-a9b7-403a-84b4-f6b1155c616c", "comment": "Malware payload (njrat)", "value": "9765d205b8b16a05e807f239217a734f37a1d7b263a116ee336d39688bb2ce58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619376037, "uuid": "0a323972-a7be-45f1-9dc6-20a13c250cfe", "comment": "Malware payload (njrat)", "value": "518e5f25523f4e563dfea32b387ccd252ee094e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619376037, "uuid": "30897ced-7e64-4ada-9557-68d6f7c7e861", "comment": "Malware payload (njrat)", "value": "6fe24570c791daf2083092697137e5045f29126d502bacf9dd33f911f3228787962bd446394e7d50a4795d0208941bba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619376037, "uuid": "c0366d01-470b-488c-965b-789ff195c2a5", "value": "5F3533E396B6254DE907403B4BFE95113EDA63403D064E023F4C23DA5D9B8D4F2AF2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619376037, "uuid": "6283bea8-ef7f-45b2-90af-c29e6f4b6894", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619376037, "uuid": "bde67b90-e062-49bc-a1c6-f5c6ccc8acbe", "value": "24576:2myplCf0SgveDwAJL0CRRmP1Gs8omjxC2HWd7sDkOxsl9pdnOm7R:z2CfPFF10SAsedwDXa9pdnOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619376037, "uuid": "ea7baaf1-a7b6-4f24-b2fd-8fe84d1a5f68", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619376037, "uuid": "250cdec7-46c2-4d5e-98c8-e4ca62a8480d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619376037, "uuid": "d6afcb04-085c-4531-8235-6154c5e4ed9b", "value": "ad9071f2afc83fbeea157d241e8df82a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c577087-a601-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619381114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619381114, "uuid": "4dbc1de4-ccaa-4f7a-8179-905fcaa7e284", "comment": "Malware payload (RedLineStealer)", "value": "1b6248dccc98571475104ca2bc27e41c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619381114, "uuid": "cea8fbd2-2afa-44a4-9e89-780062f448fd", "comment": "Malware payload (RedLineStealer)", "value": "9a048c8436c448e99a3a7047781ddc5d14a323660bd69f9fd7432c316083e3b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619381114, "uuid": "74ccedc0-fcb6-47a5-938a-6eccd67104aa", "comment": "Malware payload (RedLineStealer)", "value": "1bb53f4a88ee6ac1480dd3c427d9f307726951bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619381114, "uuid": "0c436cf9-761c-4e03-a580-857296c7a9fd", "comment": "Malware payload (RedLineStealer)", "value": "49fc8d35f7ed11a15d15f54f72aac72073387f0437877d3385bbea35031f66dfb06b2139ce3bceb80c0f7710877b8c6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619381114, "uuid": "101c67c5-5d6f-47ce-846a-d0d0d7add74a", "value": "07C50824B3D8837AED9F27FD48BA42618A31F1624503E727C9D841925F57BC40EE63B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619381114, "uuid": "4a046fc6-2e1c-4ab5-a135-c8fc14115f0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619381114, "uuid": "0ad545e8-98c6-4c11-b8cc-9d2807212041", "value": "384:YiUOYaiAxCY5/YI4k07NAh36y8Uca2OO0Rz5/dSER6g:pUXMxLy7u6kO0T/dXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619381114, "uuid": "281285b6-7337-4659-9d47-c4caa39857fd", "value": 2520480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619381114, "uuid": "a4443d45-4d34-4873-9807-564e87c3bb2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619381114, "uuid": "909c8a72-a21a-44e3-82f7-a25d84e60cc1", "value": "1B6248DCCC98571475104CA2BC27E41C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff63510-a5fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1619378140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619378140, "uuid": "0e45801e-fa92-4aa3-b7d1-f13368de5ad2", "comment": "Malware payload (IcedID)", "value": "1571e6d3937bbc4664b10ca41d173b12", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619378140, "uuid": "c105a56e-001e-4830-a94d-d6d9d11232b5", "comment": "Malware payload (IcedID)", "value": "9d34d2afbaf1ccd0c67ace8507d481cd746c027cdb5c5c942e682162145ed45f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619378140, "uuid": "0dd047a2-c02f-4b6f-b755-d7ef7a5d17f6", "comment": "Malware payload (IcedID)", "value": "1bf52eb7e3bf16d5c325e091f0e7a62813177d6b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619378140, "uuid": "9af04ed0-8981-4ee7-94fb-5eb65c9df415", "comment": "Malware payload (IcedID)", "value": "b1e95a3a81a2c094abce14b14ee762d1ef89f00a971b9d6405c62171385d7bf5b55c20d9d515e8359c1d1daf5c436c65", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619378140, "uuid": "072d71b4-9c5b-4b7d-9724-ba4df5efb58c", "value": "66C3D71443909EB1F0D6B2FD6686C18991F973B161BC13BBA7B8DB74120CAD52EDB20D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619378140, "uuid": "176a9193-ffdb-426c-8f69-7d0e4f2a7aaa", "value": "8aaf6c7c49318697629b0e31513edf7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619378140, "uuid": "53c7e6f0-3a46-454c-8219-e84c745dd047", "value": "1536:VjIBk7aBi+hrQkJAzdJrD+NlCZpEFUSjbrvi74B5UBThOFnHv:xYBjhrLYT+fCZOF1bjFnHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619378140, "uuid": "7ea3c881-1100-42c4-b573-e6d83324df28", "value": 129033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619378140, "uuid": "5bf692f3-608b-44bd-9a11-ccc14f809c28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619378140, "uuid": "6e4b7afd-adae-4416-be87-b9974c7aa51b", "value": "1571e6d3937bbc4664b10ca41d173b12.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35d886f-a605-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1619382951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619382951, "uuid": "620f18cd-9975-4b9b-8b13-7acf44db2fef", "comment": "Malware payload (FickerStealer)", "value": "3fc8fbe821e3958ea65f6c2d27e4fec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619382951, "uuid": "99fe8955-7cb6-4412-9839-4d0930a804cc", "comment": "Malware payload (FickerStealer)", "value": "9fc4c09d4cb89762626fce008d9840abb128c99ec3cd162eed684c67418149d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619382951, "uuid": "4bda8508-02db-4c6e-bafa-a5d01fd82fe9", "comment": "Malware payload (FickerStealer)", "value": "fc3d706aaee158ead6974def1fe90f1146bdd853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619382951, "uuid": "ee6aa188-73b6-4fb1-a33d-7e89baae2c6a", "comment": "Malware payload (FickerStealer)", "value": "410d168b37b4e26b995441a7fbcb82ac4e6d4dab3f43ca40772351dd95377bcc98a59805939a138f9f564f1d1404ca51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619382951, "uuid": "bf29feb2-6dd0-4019-ab7c-9a9924ca321a", "value": "2794CF21F180C432D5B215728876CBB51A69FC65A71546CB6BD82EBE2F34FD1A73230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619382951, "uuid": "8ae969cb-82db-4edb-863d-5653d7ee236f", "value": "78a542efd0404760446cb0973ac981e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619382951, "uuid": "e91df571-5e69-45b2-a9f2-2b9960d279d0", "value": "6144:aiFiLF/x2t0EB5Z36xSynXlKMURcQnhrVR4xHpTmdRqk:aiFih/x2tH5N5MarVgHpah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619382951, "uuid": "f67a6802-ef75-4436-9f4f-9ebe1bd9cd96", "value": 439310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619382951, "uuid": "1b136d64-432d-43e5-b051-6e0195fde8aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619382951, "uuid": "c26a7f6e-cd8d-4189-b55a-a01af8670d82", "value": "9fc4c09d4cb89762626fce008d9840abb128c99ec3cd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac3a463-a592-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1619333491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333491, "uuid": "174041b8-284c-40ce-be2b-2060e03443c0", "comment": "Malware payload (GuLoader)", "value": "68de5a2ba4acda5f89df45bc9146627f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333491, "uuid": "eb5d2ea6-82f1-4f96-afd1-9a468123c0d0", "comment": "Malware payload (GuLoader)", "value": "a08077f017f27e2e2c353e5a5023d401db6e4f4086b630294bb0ce98575f1468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333491, "uuid": "7b43df2b-ff57-4ea3-a0c3-49f7173ebd62", "comment": "Malware payload (GuLoader)", "value": "aa8648319ccfc93b8d88eda20be40dc76ec1db47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333491, "uuid": "d0583d81-f9f1-43af-861c-d29efb1c9bbd", "comment": "Malware payload (GuLoader)", "value": "df2213d240e44b256265f63011d030514a71ce9999461b0f946064fc6d9db90d3f857670ddf730fef95bf31e0f4ac2da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333491, "uuid": "1ecf6482-7ee2-4214-b4b3-c6470e263dd6", "value": "2EA32722FD6F4D58EE00883265259A612946BC6D240ADF8BE705731C1DB47F373F2A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333491, "uuid": "64e6d806-5e0e-4b07-8742-e8c2aa7c0499", "value": "9072bc63ce57a3d1edec9bba02ce1770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333491, "uuid": "6a514b46-0d07-48d7-b637-a730fa53df9e", "value": "768:nxfmCdUHcUoxoiSib4pjq/yoinpo4Ytt3JJXim9bjRb48DsKsdPKw3x5bC4ucySJ:nBmiNx71bvGYttZJNNDZsdyw3x5+4uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619333491, "uuid": "05c307bf-156a-42fb-81c2-e2413e5d0cf0", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619333491, "uuid": "7d8c8af0-c1a5-4edc-899e-bef9bd45846c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333491, "uuid": "753f6351-0065-43a1-aaaa-bd1a0ff508c8", "value": "63635532_Invoice_Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1235bd-a600-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619380847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380847, "uuid": "0360ad4d-c13f-4a7f-a0a1-7d24fa38bb5f", "comment": "Malware payload (RedLineStealer)", "value": "20c10dddd2be296b0eea7e28ae1a2cc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380847, "uuid": "1db7a5de-4020-42d2-8668-18b85b0ac3c2", "comment": "Malware payload (RedLineStealer)", "value": "a0e27e9c690f3635e024021f5a106807511a035380a4af4441adaeb45f4f3189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380847, "uuid": "117c6c75-00b3-4e6f-a3f0-576166e88f07", "comment": "Malware payload (RedLineStealer)", "value": "adafc413a9099d39768266cfc7890546eda55611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380847, "uuid": "c1473f61-0e31-4c7b-98f1-b1dfbca48920", "comment": "Malware payload (RedLineStealer)", "value": "2dd27c8f6c17f678d0ac16c1674a1a0b3c60cf8be76979adc6ecbdad23101c1e0b19893e9d5e02270c6af18471a6874e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380847, "uuid": "a446327e-401c-4ebf-8cc0-ca775ca6a98a", "value": "2C733B6AA78C8EC5E2BC4FF570B1572943B0E3972552E7AACDC194B62E3678015037F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380847, "uuid": "054ace8d-c3d8-4c76-a2a1-aabc6af85741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380847, "uuid": "f7bf1810-c4a1-4e9e-9d41-3873351e7004", "value": "1536:MPrHi1icPSOVwGSNvXhQKYtnTPD7bZHAFUKn5uhiGkg:AHYv9SFXhQKITL7bZuUkEi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619380847, "uuid": "86a0c628-0e09-4395-8094-78c3d14dcc6b", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619380847, "uuid": "354def36-4178-4109-9286-205498a66933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380847, "uuid": "2b97b414-34a0-460b-bd92-9e7809a7b27e", "value": "20C10DDDD2BE296B0EEA7E28AE1A2CC8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05065cb-a592-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619333473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333473, "uuid": "0490c057-371e-4032-9214-bfe54b3bdeb8", "comment": "Malware payload (AgentTesla)", "value": "f871a2798edcbde2b4193b5a2fcc31ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333473, "uuid": "3fb1d466-e276-4fc8-af59-34a348d48b4c", "comment": "Malware payload (AgentTesla)", "value": "a14908b0d11d6602c585b370d9e84736fc4aa34d7120ca5595beb6407a18bf9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333473, "uuid": "24b24deb-4b76-4f4a-aeb3-d4931d966e12", "comment": "Malware payload (AgentTesla)", "value": "670f7486577d0b6a9dd9f5a9d7b32304a11156f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333473, "uuid": "fd0514c2-0455-4c59-8920-ac4e7d63276a", "comment": "Malware payload (AgentTesla)", "value": "e2cbc7427609c9fb96036fa2ba20d6fa3b9375bd4919978d92d5ebea3f0e7114b5477c50952c4461af9786f74702a76b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333473, "uuid": "ffcca71e-5585-401f-bb67-ae3fc171e393", "value": "160502225AF8861ACB7F077950B1010053F8AB4AA51BF71D3E8668FD35EB382CD1775A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333473, "uuid": "f4437098-bd00-4446-924a-07aa294f79dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333473, "uuid": "60ebc734-3427-4f0b-9817-1ee794aa6f40", "value": "24576:KS7T/xAiDrg641nVp6SVDdLmbva5heAlE:KO/mibuV/Ov0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619333473, "uuid": "4863969d-c04b-43c2-8d8c-7745b9607a1b", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619333473, "uuid": "6d34b623-6879-4aec-8d6d-f9dc20ca1ee2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333473, "uuid": "1415544a-81ac-43f1-8c0b-fac993c936b1", "value": "RFQ-000322021-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67004d9a-a61f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619393936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619393936, "uuid": "90c53394-65ce-4fef-bf26-50c67bcdc44a", "comment": "Malware payload", "value": "44842fa85b4ff61606bb2dca661374c9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619393936, "uuid": "93e3c2e8-d16e-4e9b-aa78-adc32b406967", "comment": "Malware payload", "value": "a14ae718bd486d1db0ac41a00f37ce34808fd267ee1286663a00f1baea7069d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619393936, "uuid": "d0f327ae-0a49-4e34-a985-ca3be260293c", "comment": "Malware payload", "value": "f7eca23cd503d889056cb95d4a6f3651892c261a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619393936, "uuid": "79f33ffb-2b4f-432a-82d0-7d7ed06fd954", "comment": "Malware payload", "value": "9fa6d599aa997250d7612f5e06f823aedddab40678ab2c18eb144a252de8fb641a8efbe9e349ed65bcc5ac95e7ac8515", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619393936, "uuid": "db1a649b-5a2d-4c7f-82fb-1af18e456c5a", "value": "F1F4E121629ADFA5E47D977A90244944C3F5FD2BE732E68D7DC9B0A90B73F804212B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619393936, "uuid": "ef8ef6ba-256e-4d94-91e6-fa5f517f3b7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619393936, "uuid": "07c462ec-c616-42d8-a20a-dd27f8664c60", "value": "12288:QdH5J0y0FtwnoFEbL7caQTvLV4O0PBxE+ofdyGzZl8kSAFgzc6:QdH5J0y03EKfaQTW8+opcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619393936, "uuid": "5e5d4342-a504-460e-a624-80d2247ef853", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619393936, "uuid": "b07ff7d4-9990-4d80-9b76-550b762a8d20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619393936, "uuid": "21e63a09-aba3-4049-bfd4-27757100c2da", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.CYQ.genEldorado.6066.16621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b853b7d-a590-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619332365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619332365, "uuid": "299bf7f2-fc3b-45c1-b0fb-16537a43d999", "comment": "Malware payload", "value": "43bd1c3be3b005a5bb3c2c676086399c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619332365, "uuid": "9bd4ab12-7860-43f8-9050-4221722099cc", "comment": "Malware payload", "value": "a1ab9d199000fa1cc28b8d16fb134eab915c2157e15feba41a669f49e5084421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619332365, "uuid": "8dadb637-5236-44f8-af3b-b8ba4395be63", "comment": "Malware payload", "value": "0cfefac25ce8f0de4dfeca5bde4e5c10bb83707e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619332365, "uuid": "84a0be87-8c1c-4e77-a075-8ab19401c1a8", "comment": "Malware payload", "value": "85193b2497da5080b1864f8288fb34ccfd356be251244880e9fb07a932c9ab44abbd9678e73bee64a68be5dcef19e9d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619332365, "uuid": "27ce4950-3643-4dc5-ab57-4e016221fa75", "value": "70252837FB006542D552103158AEF5E55429AC27B8127E0BB2DABF5F38762832DFA21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619332365, "uuid": "2e35f6f9-ddc1-4ebe-a138-75af94bce1e7", "value": "f68718630bf9914ac94a055db24519f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619332365, "uuid": "74e97ab9-c299-4e4d-a0a2-0967e6e5ccbc", "value": "24576:ReqADWybsF2IMJ1V3gmmrw0eNVkdBlx+RH7srv:jADBsFHMuxW0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619332365, "uuid": "31ba86af-487e-4d1b-8b0a-095374a19b18", "value": 1046355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619332365, "uuid": "7a7aa337-50d1-4c6e-9ad6-d2c4a28faa79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619332365, "uuid": "848bcf65-4e9f-48aa-9dd9-5546ae508637", "value": "43bd1c3be3b005a5bb3c2c676086399c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f416d94-a5ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619345014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345014, "uuid": "b9b24703-f812-4161-9d58-430c05471a70", "comment": "Malware payload", "value": "ff775790648d15babb23053e84292fe1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345014, "uuid": "8dd9e068-1c32-4a60-97b1-4acca4ddcadb", "comment": "Malware payload", "value": "a54e20931a26b860ec76f21d8b24ebc8a20afccc5be8abd5b9de43f120518e75", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345014, "uuid": "6c736716-4c6c-4412-b85c-a5615a65c509", "comment": "Malware payload", "value": "bd73507c3ce53766b2243830691bdde72fe42b64", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345014, "uuid": "fe9d04ed-9d74-4c7f-8588-a2574ff086c9", "comment": "Malware payload", "value": "23967aca6f78af35580d35ff1817067280ac86fb06a0007872bbc713dce238ce21b2ee8522cf4500c3ce48598d9f9ce9", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345014, "uuid": "64365f56-d0cb-4bd6-bba5-bc3a69f6a1d7", "value": "C915012E66A89174C6FE073854B1005127FD694F6812E70E2EB5FCED35F3285892F3A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345014, "uuid": "e4aea025-3822-468c-b218-a3ebfd8d3b4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345014, "uuid": "05f3abfa-72cd-43d4-97d4-3a244a5627e0", "value": "24576:esT/xAiDrg66Wec3Rc/pKu95+9k2zztCq:V/miblcwq5+z/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345014, "uuid": "d75ce61e-83f9-4c6b-a23b-e88ab55c01b7", "value": 948736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345014, "uuid": "938d8f84-73e2-4e69-99b6-62376ef3c44c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345014, "uuid": "38e41701-f4c0-4679-a3a7-22b754c416bc", "value": "BL -MNLA08005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb218f9-a5ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619380232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380232, "uuid": "7e83df46-a599-49d4-b414-56a25fa19311", "comment": "Malware payload (RedLineStealer)", "value": "36e9eff5f072024564d4b01db19ffb5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380232, "uuid": "f8092806-f67a-41df-bdf8-3de8e6001da5", "comment": "Malware payload (RedLineStealer)", "value": "a7c2a6377df88d4b4645dfa97aaf4dcef4239ca97de556f1f55962fada7f3d3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380232, "uuid": "ca8a3da3-2030-4a55-b936-69b29c8861cf", "comment": "Malware payload (RedLineStealer)", "value": "dfbd50cb8ca1f647ada50dbb006d2b1e5b593bc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380232, "uuid": "1fe95e84-e43b-4eb3-b451-9d0b27a9cf73", "comment": "Malware payload (RedLineStealer)", "value": "6ead387c154b3ed472768e40ecf332b66be44ec47987dcdc3514ba095a1630f01f49c4f52a4e0516820f9e03e7e7416a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380232, "uuid": "03550c4b-b38b-4e16-9aea-69a8c7aa748a", "value": "B1B49EAD511ADD16C2AB0BB1DDB1D56443390DB6B6D9D721F2ECA2EE8034BC9EC25033", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380232, "uuid": "1ecca408-71cd-4feb-bb76-06c7ba583055", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380232, "uuid": "c4409c5c-05e4-4610-a601-595be243bcaf", "value": "6144:GdAUjJVi6qLSjyEGmkLwsiiQFH0PupnV9aSbwhgLXtB9D7sC8tDO5dg:UjijOGmkz0DV9pV57StDO5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619380232, "uuid": "77ed6a9f-f07c-474e-ac5e-eb77e605ff0d", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619380232, "uuid": "1138761f-3e5f-4e07-9f23-0c71625e7804", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380232, "uuid": "c5898970-d252-4a58-aee5-a8350f649e47", "value": "a7c2a6377df88d4b4645dfa97aaf4dcef4239ca97de55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659358a0-a5c5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619355279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619355279, "uuid": "8309b70a-491d-4a44-b860-24dd73965fc2", "comment": "Malware payload", "value": "32704a3fb28508e3b15bbbd28716ec76", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619355279, "uuid": "8942091e-c92f-453f-a769-a9eec1753718", "comment": "Malware payload", "value": "aa13c3c4e80b7eb1b271ecb8c8ca7a804c0726e9008569780b600db799328b9d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619355279, "uuid": "c51279cd-d89a-401d-a524-59dd75fb74cc", "comment": "Malware payload", "value": "bf6f1fe910713c2376ae31bf085a44424b3ea199", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619355279, "uuid": "2b7e7572-4d27-44ab-8bf0-c650b1f28ea3", "comment": "Malware payload", "value": "a4bd487dc0bf95eba9604b46e8170bd7e5987de58fdbdb3545bb30b1bc6045b0547280f5a8799e24de13dc576f2d49ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619355279, "uuid": "099dd613-aa74-49b7-a47d-f6e24525f3e1", "value": "2F83F14BB7914569F26442BB0AFB4E1A6DACF0186312A7CB4721351E1DA73C4EC6B361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619355279, "uuid": "4cc70bb5-f3de-48c8-856c-ac2281400671", "value": "6583cbad022b0082f8e06a7c1132d93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619355279, "uuid": "1eae9cf4-f6c9-4026-a0df-3dcac4ebc7c5", "value": "1536:x9c9/bHYvkJN/yvMnHhQTPR3WyEESCSe5qaNIRrD64lG7MSo74:xy9/7YvqHhuRJ1SDtdV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619355279, "uuid": "3e12dca2-2ed2-4170-8f10-5be3fa3be884", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619355279, "uuid": "39fb55e2-fc7f-48c0-b9a0-895cdb2785da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619355279, "uuid": "cbbb5731-d6f5-4ff0-a792-b9fdf0c906a5", "value": "FileSyncShell64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03d91d7-a5e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619370920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619370920, "uuid": "e0203fb3-7e5f-427e-9957-d0489174ba73", "comment": "Malware payload", "value": "f4de8120e60d7568afd1d5bfc80ff669", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619370920, "uuid": "22da2189-bbc0-4014-9d37-6c81085bf117", "comment": "Malware payload", "value": "aa632b20ad2277447f58b7f91406fba310a054030ee42d8cf2410da3efcf5d4a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619370920, "uuid": "768eaba8-9771-4957-b824-e12db70c2dee", "comment": "Malware payload", "value": "fb77a58f429ca346c695b6b2b3f5cfab12bf653a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619370920, "uuid": "14b85055-67ec-4640-b697-3517c4a0de03", "comment": "Malware payload", "value": "927f9e7ddf3d29df46838ff3ef5663a44f6afc69be8b02e5ec982cc824bc1631584dfad3ebca6360c5a370f6ffc26e49", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619370920, "uuid": "afb376c3-8c6a-40c7-9946-9391aae8cd13", "value": "F6848D107541D236E8B30573CEFEDA6D867CA910071528E3B3DC1D2E8F76AE17A32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619370920, "uuid": "e0798982-45bf-4b9a-9813-27ef74e213c2", "value": "1c30d48b5f27710c12b3300d37520ece", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619370920, "uuid": "8d4284a4-72be-43c0-8d90-9d67da574fb4", "value": "6144:YxoUPp3Hf4YpJfuOY4gTmEHbnmIHASOCCADnoFPegBmS/OcGCAOND4:YxoUNw8JfuOY4gTmwmIHAnCQ9lb6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619370920, "uuid": "ded7a2a7-53c9-4e01-8a94-fe51282bb59b", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619370920, "uuid": "ebee16e6-b857-4824-9fc7-81034454a754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619370920, "uuid": "b434b7d9-58de-4115-8817-6c400218c836", "value": "PcUtility.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94cfbc3-a592-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619333488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333488, "uuid": "9e94e332-00b7-4cda-a04e-2a21863d055e", "comment": "Malware payload (AgentTesla)", "value": "ee9f44b6bcd6d8abf3c7a733dfe65b9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333488, "uuid": "54e093cd-e319-4610-bcfe-94de4709b3b7", "comment": "Malware payload (AgentTesla)", "value": "ac49ee464f1117364e1aa64febf68bd8c71031693806513fca52fdbc010be871", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333488, "uuid": "5b06a925-3b53-4b95-945d-7af50cf0be1d", "comment": "Malware payload (AgentTesla)", "value": "ac771f877e8568f5f9feea999a466975c882a2a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333488, "uuid": "75f8d7ef-ddc7-4700-b841-10d43f3fa873", "comment": "Malware payload (AgentTesla)", "value": "96090e01e161baa70862c4dd41283caa3fc778626fc6a6fdfaeb767f98d9c99180444aee50e38fc7df1e0c7e18be5a85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333488, "uuid": "ab87106e-1053-4d56-beaf-2933591ee47e", "value": "67A5B0D9B580A9E4C25F2F719BCB8C9082211F362516E51E473177FBAF33E231672A85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333488, "uuid": "952c325d-1035-458d-9255-4e8cf4ea1e78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333488, "uuid": "4bbf9a6e-308f-47ed-b478-93d6b9cd428c", "value": "49152:tKTOrTcEXhkTfqX+VTmsIVOsguKuBTf68IoRTXoKwjA9MSlHf3iwV:LhHOsguKDyjMSlPiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619333488, "uuid": "878c1097-a567-4b27-a466-3c2acbf32e2c", "value": 2180096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619333488, "uuid": "20b07d8c-44e5-46a7-9724-a4a104a96e30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333488, "uuid": "055f8940-f6fb-44ec-be8a-e9185d7dd689", "value": "NEW PO pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fd63d8-a594-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619334149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334149, "uuid": "8bb23168-97a1-49e4-b516-8f0a82461f55", "comment": "Malware payload (ArkeiStealer)", "value": "f92c91ae9720bea9518ebb9d9c949fb2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334149, "uuid": "88ea6ddd-14fc-4219-b920-8962fbd33bcd", "comment": "Malware payload (ArkeiStealer)", "value": "b9152b30240e7f0a2a14276fdacc79e6e106419d118423d48287df3c35cad766", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334149, "uuid": "1a907685-045b-42de-94d6-b52e1cc3dac1", "comment": "Malware payload (ArkeiStealer)", "value": "3a5883ade295a5ef095469769ed3d0078a33d34d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334149, "uuid": "a3e5dff9-3184-4b2c-9ac2-460913bde58d", "comment": "Malware payload (ArkeiStealer)", "value": "0c022be922b3bdbc6fbaeffe97857d2315b9be6fbc93cc718a9fe085169fd671f2cf4a719c8c7abed65289f0783584e1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334149, "uuid": "1b7c66a3-0ff4-4c44-8996-f02abda4a715", "value": "23D4E0107080C1F2F47725F28525CFB956E6BC652B1255CB67C93B7A3A247E2AF3122B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334149, "uuid": "86c4417e-ffa7-4e61-a659-3cabb6913b69", "value": "df45914ea3c58aebede022b50ad9ce6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334149, "uuid": "ffb5d368-b6e4-46cf-9b73-1abcbecb0f4b", "value": "12288:k7usHj70m0Qqz//MOJYQHkAEhSsAWlSTyY/CkwHzzT:yjjoyq7iQEfh/lSTyYszT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619334149, "uuid": "5223d326-2e01-4775-9288-0dfbb63395db", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619334149, "uuid": "85072acd-7541-4b30-8cb3-7384ab4c800e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334149, "uuid": "acbf2b0c-cef5-49ae-8abb-b7763941f27c", "value": "f92c91ae9720bea9518ebb9d9c949fb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3286e3c-a5dc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619365315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619365315, "uuid": "17a37299-f866-4835-8b27-8c6795204fcf", "comment": "Malware payload", "value": "69306be3104dd39865756aca729771b5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619365315, "uuid": "e0e3811c-b1c3-4aad-9878-67d273d79fc7", "comment": "Malware payload", "value": "bde6aed64e088830fe262d8cdb73b5aac3ebd807dd5bf09c39dbf1dcdeb93d2b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619365315, "uuid": "e9cebc42-e636-4e1a-a7d4-e4952308c9f7", "comment": "Malware payload", "value": "83bbab7f6b935bae67d0396d25b61535cd5662be", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619365315, "uuid": "6f0e5b61-20f2-4ca8-be42-31960ca8f018", "comment": "Malware payload", "value": "26bd74bbe49cb93ee373ff5ff5b7aa188f7cabb659b7a546f020b61c88b6f8a101799c7a3aa2eda77df2ecf3a8a26616", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619365315, "uuid": "8ead3133-dab6-4537-92a7-aa61ee5a1dc8", "value": "BBF1F74177EC820AF4FF4B351CB29B115639FAA38D22D71F188540195D32E44CFA2BB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619365315, "uuid": "5a4d8fcb-a309-4e38-aed5-7ab796f3e507", "value": "192:iQUOUCqNRn8UyP3VD3nAK1HvRG/hBeWu:i/fCyR8UkFbAcUeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619365315, "uuid": "4b59e246-c3e2-4ee5-bfeb-12625a0d1028", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619365315, "uuid": "7277469b-5765-483c-a7af-a7b5fec2168f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619365315, "uuid": "72010b30-479d-460b-8527-201e3eb8f042", "value": "sihost32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76455c9-a5a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1619342129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342129, "uuid": "bfd55097-5466-49c2-bfc9-ce11e138e95b", "comment": "Malware payload (BitRAT)", "value": "6a63926575b6333d3f06f59d1a9f5f8a", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342129, "uuid": "123bcb8a-2987-4b08-8a97-66ede4aeb5a1", "comment": "Malware payload (BitRAT)", "value": "bf75b72b9457bce40981ecf5bd09b8ef3416d0bc3169ee72f40e5a70a024d811", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342129, "uuid": "9686ee51-fded-4a87-b568-b259d1d42411", "comment": "Malware payload (BitRAT)", "value": "93dabd943f14e81a069780e8f8291b6567165b86", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342129, "uuid": "4f5bd8c1-dc2c-4979-8153-c9b1c7575978", "comment": "Malware payload (BitRAT)", "value": "f37ddeec68e1d816330ca874cee4087ba86c3077db2485a6f47f2b12e1cfdd27f04f2d95434cee8e26c33f30f6d3f425", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619342129, "uuid": "772fbce5-df13-434b-bc1e-f671df915c05", "value": "BB16CF02FA41C562D2670130EA6E77BA017CF5F14B3085C3B3946A6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619342129, "uuid": "95012c64-106e-4d8c-a2db-7b76395571e1", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619342129, "uuid": "fdd3b517-c47a-4d5a-bc76-a467947a7557", "value": "49152:fXUIEeZzdeh/c7p1rNdd+JNEj0ykdj21x1YhFlX4bA/Hg/11VzeLG/7wqNKB2VIQ:fXrEeZzdhjuV/gd1VzsGUqNKTHvQebU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619342129, "uuid": "9d9d3cdb-52e2-4214-8e08-34e00d6fa792", "value": 4227072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619342129, "uuid": "3e2c011b-a8f1-40fb-8f6a-4f8acea1d0fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619342129, "uuid": "aefbd3fc-766c-470d-ba4c-1f32ae9bb03e", "value": "6A63926575B6333D3F06F59D1A9F5F8A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d26828-a613-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1619388948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619388948, "uuid": "b9c4ab17-17cf-434d-b660-1ff33683266f", "comment": "Malware payload (NanoCore)", "value": "8d224fbf2afe7177d27fc3bd82a4d9a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619388948, "uuid": "1745a5c0-1d11-491a-b722-4dead6281e50", "comment": "Malware payload (NanoCore)", "value": "c279136eb629595c3faa3d1daa43ece2d8a52d8e31da89994d187f3dd4005c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619388948, "uuid": "4d23af3e-9cce-406c-a952-e4ec077d64a3", "comment": "Malware payload (NanoCore)", "value": "8745a63d8743052a69a6eef26ecf689dc9ee3d6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619388948, "uuid": "0daa0e97-c3aa-40f7-8f6d-5f9f53b4b37e", "comment": "Malware payload (NanoCore)", "value": "dc6f9d0f6f6a0291632765f5542753e5aeb7b7c4e515692174beeea98064387805e6d2d38558892ab40f110eddedb534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619388948, "uuid": "fc5a7aae-c944-4e9b-a159-b5050990b304", "value": "99256C93DAB47078D06BF97B2C5806C02FFCD64F11C1966DBA56EEB71531183AA0B0A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619388948, "uuid": "f97a9751-128e-4754-880c-3894d9c7fc10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619388948, "uuid": "25efbe90-e4b0-42e4-a373-0d60180af068", "value": "12288:U7mlz/+MGdVzRRRRRHv39jc4W67tpnyp0EQ0YEY6TpfrnLGRjMLa4FNLN4V:FT+M2pRRRRRJjJpn/0YEY8pDaWLat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619388948, "uuid": "b0934700-4310-44ea-ab94-ba35c3b455f9", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619388948, "uuid": "a49f4e02-e02b-4848-a919-18d785d0824f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619388948, "uuid": "ff5105b6-727b-4bfd-b9a7-b279fcbdeee2", "value": "8d224fbf2afe7177d27fc3bd82a4d9a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92de9f0c-a5c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1619356644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619356644, "uuid": "16af6ba5-8078-4069-b358-f8d01a56ed40", "comment": "Malware payload (AsyncRAT)", "value": "8e144bea9b99950599dfd2e3b9ee3cfb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619356644, "uuid": "1a269b1d-9cc2-409c-8af8-40dc3c9e2fb4", "comment": "Malware payload (AsyncRAT)", "value": "c64c2b5fd4c90ac4dd5c41b733d43669fd3dfa75342d98f29b7bd3178e6374de", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619356644, "uuid": "bbd69331-8fa5-4d26-be42-39affa3fa3e3", "comment": "Malware payload (AsyncRAT)", "value": "832e7ff6a3a19c5cfab2c418a63627e6af48f47b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619356644, "uuid": "a0485434-4557-41cb-8d80-0d5f10a1faa2", "comment": "Malware payload (AsyncRAT)", "value": "cdc5854b9ccb35142b5ca05b7cc1741bdd1c76eb44f1b9b3c9058fc1b8232f5b69c06c3db1f585564ce8a0450a49a18b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619356644, "uuid": "64ed0edc-3c68-4eb2-b1b3-346114cc7e55", "value": "FA232D003BD9812BF2BF4F7498B22245867AF1777603D64E2CC8519B5A13FC69A425FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619356644, "uuid": "f3242efb-6894-4d92-9812-900755ebc356", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619356644, "uuid": "a48ae923-d3ff-455f-901a-df5fe15bf1dd", "value": "768:aui3NTdFHLBWUZiGrmo2qrDorlPicPIQfgT95n0bsWHZdH2O4ETMrRZXHjBDZ8x:aui3NTdBR2hlPiQfgTYbsW5dH240RVlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619356644, "uuid": "ca6ae4a5-aa46-4fe8-8c1b-3155b7efc753", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619356644, "uuid": "b5d48333-971f-4a0c-943e-a72d5026e735", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619356644, "uuid": "444d70bb-2375-4591-bc17-c6397baf49a9", "value": "bhfwy0XM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f5c8e9-a5ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619380244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380244, "uuid": "588f3374-4cd5-434a-a723-091432642103", "comment": "Malware payload (RedLineStealer)", "value": "3b334f5be40db0d3591a36a7f63c768f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380244, "uuid": "835ecb9a-32ef-44a0-b5a1-c501e5dc99ff", "comment": "Malware payload (RedLineStealer)", "value": "c7d5dd0beceb52c4fff552eaaabea06762ef25df633576867798137dbfe8dc8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380244, "uuid": "d5d9f1b5-6f3a-4363-84db-ce548f54bd2e", "comment": "Malware payload (RedLineStealer)", "value": "3373642d7ddbd24ce5a4781874f3be27825cd3ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619380244, "uuid": "4ee54f1f-469e-4896-8bf2-5112c3049759", "comment": "Malware payload (RedLineStealer)", "value": "fb5cc57c50afc7ced3a56dc03b72b7544b9436ae647ad02bc71cbcf6916a50b02e8540684d7eb1f8f96dc859d4a7d2da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380244, "uuid": "3f60ba86-76e2-496b-8128-d1fd32fdb8ca", "value": "3793C6196A08B926CE5536347497BF37B068FE9A2573CF228674F1C4E8327C90E621DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380244, "uuid": "a65cb4db-99d0-4c74-933c-116800b49f61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380244, "uuid": "fa8d7a38-9ff2-4f70-a7cf-7056e2a58a80", "value": "768:Kf9DWx0STCvrDc0ZLYm8OTu7aIetah0CtqHRYy+iWQWz6YHyo25GnTw1:6DScPNq7ItCaHB+iOb25CTw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619380244, "uuid": "f476f404-8949-4027-8e97-1a668e219c49", "value": 94120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619380244, "uuid": "71ebe909-5688-4668-bf5c-8f6e73736eba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619380244, "uuid": "f67875eb-91c7-46c4-bc22-41e15fca8ced", "value": "3b334f5be40db0d3591a36a7f63c768f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6e7b9c-a593-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1619334032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334032, "uuid": "22c7a0ef-85c7-4cbd-9447-3d07c35d6190", "comment": "Malware payload (RaccoonStealer)", "value": "8f11ff1475a6994d43a18caacb46a36e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334032, "uuid": "59c22f58-d9dd-482f-97c2-717ad56aed97", "comment": "Malware payload (RaccoonStealer)", "value": "cb6ae4487a5d4a80e647c196c959e566611f3d3ddd82fc76ced53b6d65808ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334032, "uuid": "74363012-9341-42a5-a2da-ee5934dd881a", "comment": "Malware payload (RaccoonStealer)", "value": "80fa732d0617579910419120759598e085392cbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619334032, "uuid": "b3f9fa0a-5072-472f-b191-a175895079be", "comment": "Malware payload (RaccoonStealer)", "value": "7fd38435dbaef3d4fa0084a5dc9bd1f31525cf731216f2c1a62901f49971bde51e2221dcc29d5dd578d7e1e3e454d236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334032, "uuid": "ba5e1d92-2075-4303-9d40-2d0b19b138e1", "value": "EAB4F162F580E9F2F45B12F24868CF6581F9AE311B1465CBA6DC7B5B3FB12D0273124A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334032, "uuid": "e95f2212-27b7-4800-a6e7-834551f3ae0e", "value": "f54df06ae9191b8ea8abf425d761c5c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334032, "uuid": "4a184e33-27fd-4539-ba52-97ee1c8d895c", "value": "12288:aJoSdQBsnq5GI2em26eUrJpO3nAzUYsnsMKVg25xg/irhnTG:aHdQBsn+nfm9eeJQ4AJK682/iFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619334032, "uuid": "1284a8a9-8957-459e-a86a-8b0eb41236dd", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619334032, "uuid": "a73bf5f3-47c8-4d46-8e3d-e962ed8b60fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619334032, "uuid": "94add08f-55ba-4c37-82d7-98c33791bb1d", "value": "8f11ff1475a6994d43a18caacb46a36e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48048d25-a5d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1619362960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362960, "uuid": "83548217-41fe-49cd-b080-6d1c9710b3cc", "comment": "Malware payload (NanoCore)", "value": "1b429716bd21321e7d7ec076b3822fac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362960, "uuid": "00820b26-6125-4045-b984-c198c909dbbd", "comment": "Malware payload (NanoCore)", "value": "ccb120f7f64f3f353b197c9e5fa829a6f69133164df8f0de1f25eae0faea5615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362960, "uuid": "e83f8803-a397-49c1-bed6-13c449a76510", "comment": "Malware payload (NanoCore)", "value": "d1e5865291eb454cbcda43a3a4ea749d2ec67ee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619362960, "uuid": "904aa17f-f1c4-4468-aff6-56e3effd88fc", "comment": "Malware payload (NanoCore)", "value": "d6ab2942b9a77263384a7f0161dc105a6f090fdbaa562765d513826feedce63c1e571f81a35cd7b6914644b9c1ca4b4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619362960, "uuid": "1ec9b88d-1c24-4330-bf76-e081edfcde04", "value": "3175AF6AA342D0C4F65E1471CDA0FBF0051BBD6BCE0A6D1B114A3EC274BB69B5A3B147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619362960, "uuid": "a11f2606-c9f2-486b-81a4-680d8f01c02c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619362960, "uuid": "247bcdb2-8b7b-4bd3-b4e3-5aea4c7376df", "value": "24576:rPT/xAiDrg665j57rENUaYoj9ygZWtuYwHtLdPstOP4FO:X/mib6d3a/RtVd2usO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619362960, "uuid": "e997f02d-807e-49c1-b588-683b2fa4b0a2", "value": 1550336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619362960, "uuid": "2512b835-c208-4ca5-9c47-2e6e1c1c989e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619362960, "uuid": "111862c5-5ca1-4414-9fdd-6ac6d9dd2998", "value": "1b429716bd21321e7d7ec076b3822fac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db820de-a593-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619333872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333872, "uuid": "d753f1aa-fb62-49f3-8c5c-70f9aec14546", "comment": "Malware payload (Dridex)", "value": "88ab8738e53bbfab5e6c0106d6f0b24d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333872, "uuid": "2878a3f1-ca60-4836-b90c-3ceae13d2efd", "comment": "Malware payload (Dridex)", "value": "cdc71c65448b224c6c5c9f84c32ab7472ab4012bc94ef481d3ac4dc0187fca43", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333872, "uuid": "05686a30-11ac-48ea-9605-5e32d52045d5", "comment": "Malware payload (Dridex)", "value": "0dbec9440a0e88f2622064dccf227168305a258e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333872, "uuid": "e2f2f49f-df86-4591-a293-eff6b05bf74d", "comment": "Malware payload (Dridex)", "value": "fd2621c013a174dd4c4d5eeb919f412bc97e5840b6621adc4040d1f2115859e4f9661c8ecf27bed34b3689b48049b84f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333872, "uuid": "9e874af6-e235-41a8-aabf-a1ae8ec41092", "value": "BDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333872, "uuid": "c4a4b734-7dfd-4a0b-89d9-9b6f17a52f0a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333872, "uuid": "14277e49-bfa7-4a0a-9b8e-9e6698a1d980", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619333872, "uuid": "48ea0d3a-c795-4f41-add0-0591018b2d1a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619333872, "uuid": "28df3f15-cb9b-4a0e-bf83-9e857d4e7b93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333872, "uuid": "45c710cc-c395-47fb-97bd-1078cde74ca5", "value": "88ab8738e53bbfab5e6c0106d6f0b24d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad96b2c6-a592-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619333496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333496, "uuid": "1a3b1028-2a00-4264-9fa2-1ef01e85f29b", "comment": "Malware payload (AgentTesla)", "value": "3ca9ec6913e0c2e80423b9b6e23c23e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333496, "uuid": "f41af6b2-880c-445f-a8ff-16bb08cb9bb5", "comment": "Malware payload (AgentTesla)", "value": "d017a379ce5482bc2ef07f443009b8ec696030f6245f10bbc1d0e63df7e21bda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333496, "uuid": "f09d99b9-0f7e-49f4-8c6b-6af1abf2a85e", "comment": "Malware payload (AgentTesla)", "value": "6e4f82d3aa08bb8d7e1fcc1f218f02967f68450f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333496, "uuid": "2404f1ad-67b4-4134-a903-b91521eb6797", "comment": "Malware payload (AgentTesla)", "value": "7cc31d9ce7bd4210ec0c61c59496da6fdbbe7691add61fc2fc41116fd5a31efbbcb59ffaca39e1a2cbbf977f22600975", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333496, "uuid": "f33190f4-ccf2-45ea-b27c-601852d86f45", "value": "AEF428EC711075EEC657DC22A7CE1C1692202175A72B550B872303BE9E1FE57AF388DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333496, "uuid": "f9fa4643-68b5-40fb-ad95-52ce34cda3f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333496, "uuid": "f8f46c87-a8ba-4bc2-aecb-dce79c8bc5f1", "value": "12288:HyoLLoS60/K7yh0P7sYLQu3yrhImjwIYf77boN2rgMN26zj86PYzG7GcF4zDN0Ow:SoLAPwnu3yrD0IIs28+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619333496, "uuid": "89ad3635-0b3f-4c83-b9e0-d4c7672aa8b3", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619333496, "uuid": "0ea9ecd7-cefa-4264-a30f-77b51a003b6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333496, "uuid": "b1313246-173d-4b45-9994-5c1f2c53d2ad", "value": "Purchase Order #04242021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ab43b6-a5ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619345559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345559, "uuid": "01b95e2d-6f46-4455-bc61-9fdf9f8aa9d2", "comment": "Malware payload", "value": "1dc28fb422962e588ed0ec526120c9c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345559, "uuid": "694ba771-f00e-4933-8f91-1d8d7bd8cd0a", "comment": "Malware payload", "value": "d17375a4f18beb4ea9d4025561d47ea3cb1fdd1f83d636f6b4d5fffd1c4a0980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345559, "uuid": "e8782470-1a81-4fd7-bfd5-8039fa1439c2", "comment": "Malware payload", "value": "60e0fc656f5172f7d5269f058c3b7af9552a6d95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345559, "uuid": "49471358-bca9-4f81-82d3-0b3fe841f9a0", "comment": "Malware payload", "value": "3398592e41aa01495b719f56e60a58c46680f559b2d879d10117414a4631928786691e0fcd4e037dd950792fa565c8a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345559, "uuid": "5f5ed1e0-36ba-4537-a1cf-a3af98a457e7", "value": "C705022644A89114DB7E073860B1C03123F97F875816EB0E6ED2BCEF75F63968A23759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345559, "uuid": "e140cf97-a3ac-4c77-9744-1dbc9e6ec765", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345559, "uuid": "a7504405-383d-4460-914d-81e90580f48e", "value": "24576:6rT/xAiDrg6Vzvy7F7euYXJe6qVe1rx+gNBZ:8/mibGF7LX6qodx+gNBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345559, "uuid": "4b53a1d2-a5e1-4ca3-bc3f-1366df83429f", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345559, "uuid": "8393b07f-cdae-4cc6-93fa-04fd1bf00371", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345559, "uuid": "27ba766c-6c5b-42e4-9750-87bfe755d368", "value": "DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc3aafe-a5ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619345092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345092, "uuid": "6719cc10-0e84-4d7a-ba42-2f4ee7d34515", "comment": "Malware payload", "value": "13e4ebd118104aecc20af5ac544a4593", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345092, "uuid": "f4b67ba3-4367-42db-919f-2330d33d52b6", "comment": "Malware payload", "value": "d32d6337382ae655e091952291c03f13be611b859fe3cfacb18c803e964131e2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345092, "uuid": "73869e3a-5985-4b3b-959c-36099161f78a", "comment": "Malware payload", "value": "f63720964cd3715706011bb72d910738f3282f8a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345092, "uuid": "3163b5e2-7686-49a2-80f1-2b7e73493158", "comment": "Malware payload", "value": "93866409eb1602742c26cc4de7b6f3fc1e079f532bbf08ee3cb0b997d8e3907297624f744839e8588078ffb7c10e5ca4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345092, "uuid": "417b5652-8a3b-4366-a52c-9b0c162fcc37", "value": "B2F433F8CB602D09C6FDB588E15E29EBF7EB5404DCD5C0C7466252A52B04EA3C8E9E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345092, "uuid": "95afedd0-b3cb-4cba-82e8-5ac1ddf5b447", "value": "12288:AJVgdQVDALvoEdv+wSlsCSBJWZ/hK8Y/cac5+JkOfKBGVh/8MHHhLzQdeg:AJe2DmQqGw8s3v+/hK85Z+JkwXv1BLzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345092, "uuid": "64841091-a064-4032-8253-348646a15a90", "value": 760414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345092, "uuid": "3bef703a-8c31-45bc-9af8-720aa056ce09", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345092, "uuid": "29621879-76ed-473c-9c67-97a261f0fc1c", "value": "HBL# MNLA08005.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2309f3-a5ab-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619344229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619344229, "uuid": "e570ea6a-f65f-4c72-bb39-943caae7b5f6", "comment": "Malware payload (RedLineStealer)", "value": "8033286e1936fc166d5675b2cf6c51d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619344229, "uuid": "c190ab18-e703-436f-875e-e95e6ebf7e6e", "comment": "Malware payload (RedLineStealer)", "value": "d82b4ac6dc3e425f143a9af646afe383aafc0452f66d3d7e2a692a21a8e77624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619344229, "uuid": "979505b4-47cb-4211-b470-4f81668e4f54", "comment": "Malware payload (RedLineStealer)", "value": "2d6a796aa7de0ffe714ff9ed48e9afacb6efbd4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619344229, "uuid": "4baad13d-7198-464d-bb4e-a3f47f474b8c", "comment": "Malware payload (RedLineStealer)", "value": "ef0e7b818175ef93b9df819c42cbce5d86d9a609c9c349094d2cbce0cea5c08eb093dff37fbfa90519954bb590c33e9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619344229, "uuid": "ab601e5b-61ca-4792-a4f4-5a15bc4a3ee9", "value": "D224E95378E0C901FEE5D8F7A16D76A32D620C213052DDD7439BAF9BA8B908351F613A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619344229, "uuid": "204b7c7b-8190-41ff-a7e7-fe38f2495632", "value": "8844dc828d2c13902e4c29a56376ad4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619344229, "uuid": "ad3c3fe9-fef6-496d-9831-e0e9c6438d30", "value": "768:/B1TsKeKd1SMmM+6/jWmYbyucqwAoUKGqKWLLToifTe:/BayFYbN/wfTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619344229, "uuid": "a6f224bd-326b-415c-ae44-217b659e689a", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619344229, "uuid": "0bc56874-05e3-4d27-b8a4-9d926108f59c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619344229, "uuid": "63d9229f-cb54-4c41-be6d-74cf01b6b112", "value": "8033286e1936fc166d5675b2cf6c51d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcd4cac-a5af-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1619345733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345733, "uuid": "4c4569e1-009c-4c08-835d-741927da0063", "comment": "Malware payload (njrat)", "value": "8d9f39de24128c08ebea9f1516041d76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345733, "uuid": "c7673e02-dcd1-4d1f-a1d9-17486b026e30", "comment": "Malware payload (njrat)", "value": "d9872c836e684cbc44d9bae43909ef91052f15199035c57112a7aced2e61d55c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345733, "uuid": "814abb02-fefe-462b-aec7-2344ed33803e", "comment": "Malware payload (njrat)", "value": "a0e7a18e3268b9a0fc45cb899c4aee5c04f0ae31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345733, "uuid": "88338579-d926-477a-820b-c2199994e8f6", "comment": "Malware payload (njrat)", "value": "1fcc1680e4787551d94d9a149d43b31d69f420e494c5cfc69ff51d71701425ddef711f3028dbd9ebc48dda2159cd6129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345733, "uuid": "4bbb9f49-a793-494a-86a5-3e75f5a0cb27", "value": "094533F4F317B292C8A425F4352AB24F21DC51523C4F7D14AD8DBA1BA8F7F6CA0A2552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345733, "uuid": "bd67344b-e846-45b5-bb24-6ca4c75b1d18", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345733, "uuid": "2323a3ac-d2a3-4c6d-96a8-f09ef02a4715", "value": "24576:DY2cH8DfDtSu10cPXJk+p7cgR8o6WiKBgjuGRGOtxji1jkyTZFswAqXC:Ny8LhSa0iXJk+pIWibJtxjLytq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345733, "uuid": "6fd9d365-ce65-4710-999f-df8df9648f3a", "value": 1196544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345733, "uuid": "9e667f8f-a9ee-4bc6-969f-bd98bb9bedc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345733, "uuid": "eb38aba1-7116-4877-80d5-d8ec37605285", "value": "8D9F39DE24128C08EBEA9F1516041D76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ca3c31-a5ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619345554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345554, "uuid": "071e0595-3394-4b6e-ae62-2f6192da2c44", "comment": "Malware payload", "value": "9317c8b5b1193a9d98981003d58e20af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345554, "uuid": "a63b846e-5ed3-4eb2-9c4f-1a7df27c9f00", "comment": "Malware payload", "value": "def2ee23d3a774c09575c9918cf9f5783339850ff9a150bc2cedf81028107fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345554, "uuid": "de828a50-5a78-4300-9902-8b2ffabefeb2", "comment": "Malware payload", "value": "e1ab2d16755562db9009e9a07f43f583b6f32502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345554, "uuid": "3dc50a99-03ca-4a93-a053-c3805d776d40", "comment": "Malware payload", "value": "2e82282afeb59cc85f674ee95fcb32e02026cc497c35db46ce13c630039bb5983c0da98df68127a0494e230d67b890ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345554, "uuid": "4cfccf03-45bd-4413-8105-03a8dae9d5e5", "value": "4D456E66E742D0C4FA6E1471CDA0FBF0051BBD6BCE0A6D1712463EC270BB69B5A3B146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345554, "uuid": "8ee40e15-af16-4233-b1e5-9bcf902afdad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345554, "uuid": "fcd7ee0c-e67e-4734-9838-8cc8c1d36691", "value": "24576:o/T/xAiDrg6CtrYS4cIqFHBuwxPt+AEUWEujJV8a:C/mibGaInQXzTV8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345554, "uuid": "4cb3509b-9ca4-4250-81e0-f83236c0a0fd", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345554, "uuid": "bc788cd1-2cf7-48b7-9238-f2aa67ae7561", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345554, "uuid": "be4b9c72-9cb1-472f-8690-228831a246a1", "value": "1835034134.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74d6eff-a5ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619345565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345565, "uuid": "ff844a15-50bf-4024-9923-0168ad2214f5", "comment": "Malware payload", "value": "2e763f87a8f10168cba9346dafea4267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345565, "uuid": "8d421ed5-18cb-429d-8d87-ad90a3b425fa", "comment": "Malware payload", "value": "dfff6768cd44b788ebf3e6a31d5b142d6f5ff7ea2fe7f3cd31640ace304dda6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345565, "uuid": "4a4c7645-146d-4e1d-ad19-1fb74380fc9a", "comment": "Malware payload", "value": "bf8170cd80744942a14cd3fcf36ba872d7cffd80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345565, "uuid": "b05937e1-898e-4e3c-89ee-738e2867c54b", "comment": "Malware payload", "value": "aa9b4c55727cf407166cdb24f71c497737e42862c7d25894cd63467e4f87b6834607c26049112f017aeacbb53188bee5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345565, "uuid": "c01c7351-12c3-46ee-83ff-6087da82e534", "value": "9105122752EC9604C77F037C78B1401227FC67469956FB0D3E92B4EC39E6392892B76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345565, "uuid": "4f5b276f-d642-42aa-96ac-47fe6dff0238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345565, "uuid": "b523c117-f596-4a88-b59a-f36f041e87c7", "value": "12288:QriV6Kw1FxA+VD29Kg1ClZznmm+0XtZyu10yqVOETjn1B4J6ofp9vv8yaQvYzh5x:EiV6T/xAiDrg6zIoP1QO8j1BcbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345565, "uuid": "c5d059a7-ffb2-4091-b47c-aed10d911135", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345565, "uuid": "7164d442-fc85-4177-a161-b10ac553b5fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345565, "uuid": "d308d6ef-06f8-4543-b82c-ab0ca1d12ea1", "value": "Payment_Copy_00900097000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c52346b-a60d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1619386241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619386241, "uuid": "743daef1-4c8b-4446-90f8-786d7048c1c6", "comment": "Malware payload (IcedID)", "value": "46b72155496a52f4e09dd67a6068ea0a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619386241, "uuid": "e82d2b8f-4a90-421f-a1ab-aa44a86232d7", "comment": "Malware payload (IcedID)", "value": "e001ddff1d29e0dba0db4f427f036956e006152ae18bb108807bd37f64f5ccb8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619386241, "uuid": "c313df98-e5ee-4111-8b41-a20f8169dba8", "comment": "Malware payload (IcedID)", "value": "e9e1fa160e1a7b641f8ac9d23db05c35fcc53511", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619386241, "uuid": "06903c51-6b6a-4542-a3e2-cad2d8427034", "comment": "Malware payload (IcedID)", "value": "5231b95ca95f63bb601c08659802e5f67175894b9347aaf3a4f08eac4f0be11f9b6beceeada48487839b58077ce6ba6a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619386241, "uuid": "80d9022a-af4c-47b1-bf89-75c57e2fa917", "value": "0CC3D71443909EB1F0D6B2FD6686C18991F973B161BC13BBA7B8DB74120CAD52EDB20D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619386241, "uuid": "b29ab931-4623-4ceb-b188-34df6365a52e", "value": "8aaf6c7c49318697629b0e31513edf7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619386241, "uuid": "8fa2d5b3-2edc-4d2c-b5c5-6e7c168e2373", "value": "1536:VjIBk7aBi+hrQkJAzdJrD+NlCZpEFUSjbrvi74B5UBThOFnHT:xYBjhrLYT+fCZOF1bjFnHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619386241, "uuid": "bd77786f-e69d-433e-9f77-b8b76000ee12", "value": 129039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619386241, "uuid": "d18bf49a-37cd-4bf3-b5e2-284cb6ef9673", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619386241, "uuid": "8aa7bd2f-e621-4217-bea8-6ef3d5692ada", "value": "46b72155496a52f4e09dd67a6068ea0a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c58032-a5a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619342878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342878, "uuid": "9a26fcd1-7781-4872-b37c-c8e2f7577ac4", "comment": "Malware payload (Formbook)", "value": "39e343d80ab4d1e666174259ddace5cd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342878, "uuid": "c2946249-b0d6-4ac9-b00f-703e81984b7b", "comment": "Malware payload (Formbook)", "value": "e48f98656c4a21311cb99be0dc4066da0ff01bcce271339b60233945b7c8bb09", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342878, "uuid": "c8368f66-c576-46a0-a394-95645f66cd6c", "comment": "Malware payload (Formbook)", "value": "6fa4605bbb63e80f4d6b62c27eb9a1ec441b7e88", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619342878, "uuid": "81552cbd-859f-446a-9f67-a4b90657bb67", "comment": "Malware payload (Formbook)", "value": "2258f8fe5ec3fd65a17e1c7c8afda378a5bf35f4f355caebce0883308074dc8ddbc7c5b032514d4a4ff6fd38326e9e4b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619342878, "uuid": "b2ae6fef-a57f-42b3-824e-2dd59a73821c", "value": "4CC423CB605F62704C18866CCBAB76D16D4A7CC27EB14889507B4B703B53AC642BA7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619342878, "uuid": "de8d0fc9-7b05-4c51-baa9-2d540204b0ef", "value": "12288:QqglLM1mOJ4qaFExWKG0OCIAf7trQU8C9dAnXIW/gi85kV:QxLM1mXmWKG0OCztkU8C9dAXIWYiukV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619342878, "uuid": "4bf2c1d4-c426-4f32-8414-7d3207f21b72", "value": 543404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619342878, "uuid": "6656fe9a-684a-4b26-9c82-f205da9b6c19", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619342878, "uuid": "af908f0e-5d6b-4751-837f-0d0cc18576f3", "value": "INV+PACKING LIST.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9f07d6-a5ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619345545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345545, "uuid": "043bf29d-770f-4a6a-ba7f-29f942ed49a5", "comment": "Malware payload", "value": "16eaafe46ed937a4cde5651c1059a044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345545, "uuid": "09a33e7e-5a32-45a5-a0fa-bfbae8aa01a9", "comment": "Malware payload", "value": "e69749b22ac748db61a34128d613965a56d372d06228b8cbd0ad435c3e046f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345545, "uuid": "af276b1a-a00c-451b-bb59-d1e11803688a", "comment": "Malware payload", "value": "2d8a6553d5c9a80b0a6948d9e54e75942267fe4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345545, "uuid": "af16ea06-e767-4535-9801-cbf7c082f1c4", "comment": "Malware payload", "value": "56ef3370c298f8c77c562bba19633754f5d9b92ecfc8c485148d9dfbb7711f2a28484d8771310e300f1d80efe7cd4638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345545, "uuid": "68e49e39-d1de-4c2b-ad5c-3628a9358fd7", "value": "952502211964DA93D7BE073854B2D23407F87FA6AC41DB0E2EA170EC7BB679A4C17325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345545, "uuid": "5a4669fd-23e1-4eb5-8bac-e19b524f151e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345545, "uuid": "825f532e-83a5-4480-a3f2-9852df2519f8", "value": "12288:B6VKw1FxA+VD29Kg1ClZAr6QNfCyVJchq8HVfN0zeAxwHufY07Zz65IJXMjvLe:sVT/xAiDrg6APffVJclVfGKHVm8vLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345545, "uuid": "8fe7058b-6246-4573-b5e3-38f6d31e2c28", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345545, "uuid": "403e7514-d760-4f1e-b797-926d392fc591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345545, "uuid": "6b8e0f38-766f-4a8c-9912-df20d4025ecd", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351a91f3-a593-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1619333723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333723, "uuid": "ab84ec1f-b12c-4fd0-bfe1-0f48323fbc3d", "comment": "Malware payload (njrat)", "value": "212b91273eff72adfbb829521a5f0a30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333723, "uuid": "b9e787e6-ddfc-4f11-9bd4-64fad3577046", "comment": "Malware payload (njrat)", "value": "e734ac6c26b18d7af17f9dd4d54752c0159df8fddbc553d3d518b0d8c63d0169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333723, "uuid": "f8062acf-fc11-4afa-9618-3c38e77e8aba", "comment": "Malware payload (njrat)", "value": "a0cc7d127e2b52d1ad6f2133d26b0e9a21c15806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619333723, "uuid": "037baf55-dc11-4ecb-bb02-d4a50b818edb", "comment": "Malware payload (njrat)", "value": "0379a8116d54737e3588c34c29a4f6b94bb92c5b7a6ee25b9735f9620f0555bcf75d8930f1e4d7945ce3b1a84c0cebe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333723, "uuid": "317f4bf4-b657-4741-b2ff-48e9c8536df2", "value": "504533A250923317C966CBB9BB107CE50FA83B5054DDDAB86E83E4DAD5127881CB9F0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333723, "uuid": "7da7b92e-ea80-4cbf-aa04-5112aa49d34b", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333723, "uuid": "e3e4d3ae-cd53-43a4-9dab-618f3d3ca8e8", "value": "24576:Ug7KLIRoRgH/oZC12iYUNBXYRB58ozTgcJoNFHQ3yI6Sehielr:t4k0U2dkWH8oHIH3xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619333723, "uuid": "1817d6f5-a7fe-45ec-a544-3cfeeef45131", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619333723, "uuid": "eb0c016b-7d9f-41da-aed1-4b2c3994728c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619333723, "uuid": "6faa4c45-531f-40de-a31f-0f85669a0cd7", "value": "212B91273EFF72ADFBB829521A5F0A30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdc21d0-a5b0-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619346326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619346326, "uuid": "914ea8f1-b592-4a82-9c0f-7b732da4182c", "comment": "Malware payload (RedLineStealer)", "value": "98b8d01550ddd8bdd43b92ce048085d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619346326, "uuid": "b995e806-f838-4ebd-b1a3-b73f99b3c89d", "comment": "Malware payload (RedLineStealer)", "value": "e8a22cc13143b1e542e6789290452ed883ad070eb987146f656db78f0b7cbbe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619346326, "uuid": "4aff3d47-bc79-49e3-9c97-6e57064b0b0b", "comment": "Malware payload (RedLineStealer)", "value": "775afcd958d97851950b3fe3e1b360e7a914246e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619346326, "uuid": "3e684935-41c4-4649-b0ef-34450bca01ab", "comment": "Malware payload (RedLineStealer)", "value": "dc3282bcb010a88a6d78e0d5a0aa0a3cbbffa8b2be2d13ba0d7073d996c57edbf5200469e03a47aa561ad5d32682204e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619346326, "uuid": "3614234e-6d46-4525-9c72-31f19701c521", "value": "2CF35B186B98CE51F63E057AA070522107F0F8177661EB4A4ED0FCDE3F36BC16954BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619346326, "uuid": "2e39add7-9e77-4466-ae7b-5a718a0b4b72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619346326, "uuid": "2e858a1f-eeb0-44ad-b58b-d945da41adba", "value": "3072:AGN7UYczfVRLUg1sQejltzN7Mce5Laj24ydVpWRY:AGnchmQePll644", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619346326, "uuid": "370f1c42-c10d-43f0-b66a-cfc215a2e050", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619346326, "uuid": "7cb8d13b-b375-4752-9eab-a9d60e303220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619346326, "uuid": "7980f523-d70d-4e9a-912e-d9e17a5d5ab7", "value": "98b8d01550ddd8bdd43b92ce048085d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caff822f-a5e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619370911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619370911, "uuid": "9bbf72cb-5c96-4b92-ba79-6f5b6e9b0c6a", "comment": "Malware payload", "value": "db990a6351a427bf087361e64e33fe68", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619370911, "uuid": "8f37729f-c614-4a31-b177-2a7e93a399bb", "comment": "Malware payload", "value": "ea9d86beb709c1c69d280bbbe3a9717942dd7a6e6049d82819a11ef1a5ccd51f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619370911, "uuid": "842c848b-0b38-4bf4-9f7a-90ba325595b0", "comment": "Malware payload", "value": "ae9a80958863bb65c9bf0d2ebb9550b1b6f5d5ce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619370911, "uuid": "09c1668c-2fc5-4edc-8285-5e03a29612c9", "comment": "Malware payload", "value": "6255c9a5f1759228e88a0a0b830dc6662cc3b92b8382c8b8351eba853d46fa0b3a873546ce11d15299cb6e6446364095", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619370911, "uuid": "ba7b1d04-573e-40aa-ad4f-7b4fc717b679", "value": "2F757D227A05C470C58C52B06539EBAE966CB9751B7104CBF7C47F6BA9312D32B32E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619370911, "uuid": "225ef811-5070-43c0-8fa7-a0563a7eb836", "value": "60650dc86eb05bc25ddef947eb6c7415", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619370911, "uuid": "d0226ba5-d494-4da5-a2f5-1f2c81e38d6c", "value": "24576:0BWOngLeaSoEhBKVk42BbYc4bcbFI411/VO3+R53WarrMIThl9FGN:0BjnU4BD4w0TbnO/VO3k53DVT79FGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619370911, "uuid": "d63bafc8-eedf-4c81-9809-7f602e29ebf3", "value": 1605120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619370911, "uuid": "5626039f-8916-4d41-9490-68677459e9a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619370911, "uuid": "44ffff0f-80d5-4967-ab28-dcecd5f66cf9", "value": "libinfer3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69926da-a577-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619321914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619321914, "uuid": "a823ef21-70b4-4a6d-ba23-ddf39f74e0fb", "comment": "Malware payload (Formbook)", "value": "81b0bdef857aa70ba8bfe0cb6d02f727", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619321914, "uuid": "51eba031-5784-424f-98f4-58f093b42c3a", "comment": "Malware payload (Formbook)", "value": "ecc540938addc1a440ef6ceb7714a0b45153c04c28df4395e3de18181439341a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619321914, "uuid": "883d0db4-816e-414e-b625-c469fe1a0ca0", "comment": "Malware payload (Formbook)", "value": "328ce667e6d7fff59c3f27c0fcda338159c37c6f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619321914, "uuid": "085f9174-c9fb-4f1c-860e-a6d5140b2721", "comment": "Malware payload (Formbook)", "value": "852466d85daad2b02b9fd361bd1e22d8336f357e48c78b0cea58265eefe83b468ea9692790f6d56f602607ae37f88c58", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619321914, "uuid": "4081b236-3e14-4155-9929-ec139a147f5e", "value": "42050222A9A88515CB7E033D54B5000053F9AF86A957F31D3E87B4ED3EF6382892765F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619321914, "uuid": "5e1e199c-85e3-4680-bb46-00df98dd346e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619321914, "uuid": "0bc9b878-dd42-497f-abff-c515937768d5", "value": "12288:7oCiox3nKw1FxA+VD29Kg1ClZDfCv/eApYBeS89BtnAxO9cu0RzpYkgdxcmz:yox3nT/xAiDrg6Dk1lAxTRzSkg7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619321914, "uuid": "03d26074-72dd-4185-a15c-3c25f05e0837", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619321914, "uuid": "66864e9d-1a40-4d6a-9238-605eb44ac82f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619321914, "uuid": "bb1f16bf-cf0b-48de-aa34-a4293de8cb7a", "value": "SecuriteInfo.com.generic.ml.23755.9413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4667cb0f-a5af-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619345778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345778, "uuid": "3509b1f3-8505-4e96-aefd-21fa2f422bd9", "comment": "Malware payload (ArkeiStealer)", "value": "9053ac345c26fa19c729e46b8a416dd4", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345778, "uuid": "98496fd4-5064-48d1-bb04-0f257b1acd64", "comment": "Malware payload (ArkeiStealer)", "value": "ed035775e8b0a19885bf7edf064fc6715f3aada3b539348aa66e06f355b5ce0b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345778, "uuid": "e9369f20-510f-4b7e-bca8-1bd7bdfe4cfe", "comment": "Malware payload (ArkeiStealer)", "value": "f3ad78b94ac0c2aacf3590c3c6ccc6808c368440", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619345778, "uuid": "448da692-cb45-4ed7-bd8a-f3acc5afe73b", "comment": "Malware payload (ArkeiStealer)", "value": "468c0706367423e619aa26753fdbf8b1b099dabd34beb2c61fc2a07e839e9dc9dc9b5acf375c20aba158324af14ac358", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345778, "uuid": "76b890c1-f06e-44f4-8c63-981017557c89", "value": "81C4F161B680D7F1F06B06F14861BFA556E8EC303B66C4DB77C42A6ABE603D22736345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345778, "uuid": "33e25747-abf7-4881-a768-7dd06b5bb7e3", "value": "ce0071ac356d8d12f63e08e38e2115ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345778, "uuid": "35e94aba-1d95-4486-b4bf-6a34e4619d90", "value": "12288:/2nOVgn91ghrZfIdzodQG8yl5Qy9jjvK/tvL:uOVgnLY9qodMyPQy9jr6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619345778, "uuid": "6c061b46-278e-4f22-be3a-2544dbfb79ce", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619345778, "uuid": "2c421073-57f6-42fe-94ed-3e1684e0947b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619345778, "uuid": "02305591-4d5d-4a06-80c7-37a1ad8a2d7a", "value": "9053ac345c26fa19c729e46b8a416dd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb7d57a-a615-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619389649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619389649, "uuid": "53006d63-48b6-407d-a92e-abac9e02da9f", "comment": "Malware payload", "value": "c5e413f5acffaa4fb0d108391cbd5de9", "object_relation": "md5", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "HabitsRAT", "colour": "#D11693", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619389649, "uuid": "3dc3b069-8f93-4c17-b21d-0f731691b211", "comment": "Malware payload", "value": "f556c9b4e5bb463be84dead45a9aedcf8bec41c1c2b503ea52719357943750e7", "object_relation": "sha256", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "HabitsRAT", "colour": "#D11693", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619389649, "uuid": "4f44867f-1b88-472b-8c71-23998e8b768a", "comment": "Malware payload", "value": "421fb56bb53c3ed4ab76832ce9d6626d3b46dc53", "object_relation": "sha1", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "HabitsRAT", "colour": "#D11693", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619389649, "uuid": "d8c7fa94-fda1-4f84-8d0d-8092e6c87638", "comment": "Malware payload", "value": "b235ce2c5c8978aaa59eb496717123b8f2482ce929e7628785a9f86cca03c634e83987f7652a3399d0d2d18e1ed761ca", "object_relation": "sha3-384", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "HabitsRAT", "colour": "#D11693", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619389649, "uuid": "40f059a8-b2d8-4ba2-a6b3-73f60aad89f0", "value": "F4665C06F8E215FAC1BEF5348251D322BA7138A543317BD72F9496AB1666FE07A3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619389649, "uuid": "74823fa4-5cba-428a-bf42-13e4958b264f", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619389649, "uuid": "b5a19c0c-234a-4dbd-9cc4-5a87a5d958f5", "value": "98304:Eu9dmGmzjldkFgbLt3F5jyd34Htyq5oNfMw4:J9uzjldkWbLt3F5js34NyHfMw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619389649, "uuid": "483d3df9-868e-4a06-8a0f-0aa5f39c2e17", "value": 6680064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619389649, "uuid": "5fcfcced-2139-44c3-a1e7-ce2d64f49a96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619389649, "uuid": "8d61235b-c223-4988-adee-e8fb612f1d06", "value": "f556c9b4e5bb463be84dead45a9aedcf8bec41c1c2b503ea52719357943750e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53d7dca-a5d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1619360245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619360245, "uuid": "0b6ec67c-feb6-40fe-bd4a-5e0cc81b33c8", "comment": "Malware payload (AsyncRAT)", "value": "ee88817dd27eda5e6592f051be3a598c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619360245, "uuid": "c03a6b05-7328-40be-a729-19d7b44ca317", "comment": "Malware payload (AsyncRAT)", "value": "fb9bf51c0e56eace193c9c38ef65c297f5ec1bb0a0e2a3f05e9ec35efe094bb0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619360245, "uuid": "10909dcc-95f1-4125-b4c2-fc0aa7db00c4", "comment": "Malware payload (AsyncRAT)", "value": "5734f518981fb6a9c273f0ee31070de0c592a53e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619360245, "uuid": "24307049-90e1-425b-9f6f-e874788230d1", "comment": "Malware payload (AsyncRAT)", "value": "2c510fd509b370aa6e97fd77dfdc3003f32c8b89c8bde254cd80cdf9c2fc1eb2be9d6e060219062c97f079594fbd7452", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619360245, "uuid": "83a89388-a12a-4e61-8f68-30880de81494", "value": "C6232B003BE8C16BF2BE4F74A9F221558577F2233602D65E2CC4529B5A13FC296526FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619360245, "uuid": "748c725d-b4b2-4aa8-9d28-bd58efefd0a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619360245, "uuid": "03fc59a4-1467-4a72-ba67-39468fb6eae9", "value": "768:Ou+81TFNzX1WUVIfuPmo2qj10dcVPdKVKPIOyAmUNDkg0bFj0shBlWz6BI2S636G:Ou+81TFlq02YouoxOyA3NorbFj0+Th5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619360245, "uuid": "6380bf95-1d5e-49b4-8586-a51071bcaedb", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619360245, "uuid": "2dd9c32b-7576-41ea-b246-e493d28c1f73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619360245, "uuid": "19dcce03-8379-49ea-ba4b-1129759130bd", "value": "8F6hfhex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }