{ "Event": { "published": true, "date": "2021-06-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-15", "timestamp": 1623801782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "03303e79-40fd-411e-b2e4-a35073dc9668", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cb33b6-cda3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623738929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738929, "uuid": "76e26c92-1a1c-43b7-9aca-75f142058207", "comment": "Malware payload (AgentTesla)", "value": "b645df8d36a8fe283adb20061697c457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738929, "uuid": "a4e03895-dc39-4ffb-8598-297900c03f99", "comment": "Malware payload (AgentTesla)", "value": "025520459a04813603425329129f22a3498902fe73138b567c4ceee9229c547b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738929, "uuid": "3f380d7e-80f1-48a1-826c-26ec5f8bd0ae", "comment": "Malware payload (AgentTesla)", "value": "a5ed070a380ab8e603322202e499a181c1c599a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738929, "uuid": "ac2be49f-559a-4bfb-9f0c-b5d60ad34697", "comment": "Malware payload (AgentTesla)", "value": "dfa2ebeabd7bf6c9948b5dcf368c8b5194b9fdb0c97e6d3de4f35c69684aa6940bcab02ff5998e201ab46cb210383a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738929, "uuid": "bffc386f-76b1-41d8-805d-8bb28f624157", "value": "2C254A8C7655EF9EF4378A3185549C10E617ACAF8217820BA353B67F6A7F3C78E041A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738929, "uuid": "6b51dd8a-8e82-4e16-bf02-62da8462fe7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738929, "uuid": "c1aa3242-c145-42ca-91ed-284b45a0ef53", "value": "24576:YodmJbF0UEoArvgvZQ3NM4QqcPaMbzTYIFW1:PdM50HoArv6Q3NPQDtbYIFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738929, "uuid": "4bed5586-dd11-4f4f-b6a2-c618b72c73ef", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738929, "uuid": "86d27c6f-1d88-4991-913d-7816f14c3c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738929, "uuid": "7e903240-4971-44da-b625-5a7d8fc0ca98", "value": "RFQ-566888787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f12c14-ce04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623780621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780621, "uuid": "278b7d28-6a3e-4300-802a-0b115cb8afe2", "comment": "Malware payload (Mirai)", "value": "668c6b24761e77d50a7373b0ce193e44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780621, "uuid": "f15f92a1-c3e6-4d9d-a313-9c46a6dbb633", "comment": "Malware payload (Mirai)", "value": "034fc55cae7d30afc2cd1c61b184134cb028cd97c8dbdc3c7ab15465fa9b56d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780621, "uuid": "c0abdf97-7cb1-4d95-a97a-18594b83b797", "comment": "Malware payload (Mirai)", "value": "24d7f07291dfc71780cedbe49a2c18242a657b30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780621, "uuid": "1727d49b-72fb-4254-aa1b-e6946862a342", "comment": "Malware payload (Mirai)", "value": "6f51a035d6a3ff15011039dc6aca25df2887ab2c743c679aecc5900ce0ac8b593640127a9db5d173f3c057afdf382a2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780621, "uuid": "7d7c1b49-5a87-4468-bdaa-9bc1b52a7f2d", "value": "E9C2D041658AAC32D2712834FA2E8ED6B96703BDA1DE3253233446F418C9E3755BF3D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780621, "uuid": "d5d5be20-4027-47d3-85f3-90cbb2717122", "value": "768:q52oEcM9/zR5ane8zc5y9ou/iMSp2OUlhs3UozL4:joE59/TEekFw2flMzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623780621, "uuid": "da25f258-7904-4246-82b7-75224428a41a", "value": 26300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623780621, "uuid": "df27fcd6-618e-41a4-8579-f9914bd5848c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780621, "uuid": "d99536af-3b19-41cd-b225-4ae5aad1e2c0", "value": "668c6b24761e77d50a7373b0ce193e44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a39369-cd95-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1623732898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732898, "uuid": "1d5b879c-379b-4a6e-a87c-d01e3aff506f", "comment": "Malware payload (Vjw0rm)", "value": "55ca022040169e327a6c8c590033cbfd", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732898, "uuid": "4f141a6a-6843-42fb-aa3f-aa35547535d9", "comment": "Malware payload (Vjw0rm)", "value": "03f74b80e60f67278fe7fcf235621b02e4f9a5ce4a9f342380b89af4c76e6c51", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732898, "uuid": "b2d5e731-ba87-4d96-9fc0-eb1d77c50811", "comment": "Malware payload (Vjw0rm)", "value": "8c8710eb6d47c81271038c8868c597d97f10dcbc", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732898, "uuid": "f30366d9-48fa-43ab-9adc-ea35692eea5c", "comment": "Malware payload (Vjw0rm)", "value": "4444a8dca47510ee6bacb1b35335a7f177cbac8860ba1ec080ccd043af43c27dd01c675eddb338db9fa53719c0c4b9c5", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623732898, "uuid": "39652eb4-1942-4ee6-ad80-1c77075e3829", "value": "AE636E47178998B2E124CA3D45FB731A939BB44586FD7B2832EFE1124F9B716E224708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623732898, "uuid": "d7d3f851-ce07-415a-a9fa-a260ff84992d", "value": "192:mP2FNPKshhOt6atrUlGD5jM8F9YUddIV6ZuKryPS7vzAf+p:aOSset7qUTFOU/NZuKry67vzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623732898, "uuid": "3a8ca1df-5ef9-44f0-9dba-0fc2d4b3f99d", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623732898, "uuid": "4218e225-4348-4852-a6c9-0f6978a25391", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623732898, "uuid": "1f2e81db-8dda-4407-a8a2-19131fb2f581", "value": "1ZNMAOPMAS.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2c7f2c-cde4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623766678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766678, "uuid": "4ace5642-cfe0-4e5a-9844-f3301c36dc50", "comment": "Malware payload", "value": "9d8a5a9e34c8f63ac46cf64dbfef0dc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766678, "uuid": "c8370de6-49b2-43dc-913c-2d9639a0f933", "comment": "Malware payload", "value": "04acfe31e7bce18de3f9418b74bbe50bb7b6756b76beaef0d73e6557ff7b73ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766678, "uuid": "6d510d92-c7ed-4f96-8c34-d9979eb685ea", "comment": "Malware payload", "value": "e3f179d9d5f279504406ef095652b2e73a614dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766678, "uuid": "c42f0ddc-4e19-4cd7-a7a9-5fcd3ff2725e", "comment": "Malware payload", "value": "992c6f10cf91f1c4fef2d4b9e537b88b75092ede1c0e4cadb4cf3e1feebd7e9cd2d4314c6625b3da390973bd7ce34db3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766678, "uuid": "84f35e6e-ecde-4b4a-85b9-998f973a50df", "value": "AB05BE522E98AB89F4F95B71BDE0832603F77D127B27D7C96E8471CD2863E808761742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766678, "uuid": "44df787e-317e-4806-9455-53913f7e1f48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766678, "uuid": "403d63f3-c4b5-4229-b1f7-ada634865794", "value": "12288:EcPc9EuzXvFmWJfkN++ACO7BRuOJ7AiDDkaOQSwYSXMqhYR8Y2mXjLGdT0cV6Zvk:EsOqOfDkTyrXMqh+AT0cV+quPHpVa68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766678, "uuid": "0a6e7606-1dde-4f5d-acc7-b21b2d2d88de", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766678, "uuid": "8be708b1-9167-4505-9050-b73a78ac5055", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766678, "uuid": "c6ce9b9f-5526-4222-b197-d5545f81c7bb", "value": "PO #900864.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96cbb231-cde1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623765434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765434, "uuid": "32410329-3a78-41d4-9575-538dfe231a0a", "comment": "Malware payload (SnakeKeylogger)", "value": "745beb09e92ca71ae87e821d8045c1d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765434, "uuid": "b8a26637-c39e-4717-b650-d023b5dacb3f", "comment": "Malware payload (SnakeKeylogger)", "value": "058d5fa44050ac0a0544a77a57785ea08fa963b205a0cd9fae4538f8f4cc0ae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765434, "uuid": "bd35596a-c42e-45f6-b557-112457df6f68", "comment": "Malware payload (SnakeKeylogger)", "value": "73d02c39700961d3dc54e2535bc591b831efb0f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765434, "uuid": "eef99f81-1f33-426e-9678-e0ebcb7c9dd6", "comment": "Malware payload (SnakeKeylogger)", "value": "3e8b81f20781831076b10d7714d4f69e39498b6cac39b5e4293ba584815adb28377ece94648a3c78325a453c44c081b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765434, "uuid": "93525d17-4ee1-4cf1-9767-d1780bb12ced", "value": "D405AE522EA4AB89F4F95B36BDE0832203F77D127B27D7C95E8471DE2853E808761742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765434, "uuid": "5ee611ee-b600-4f2f-9379-bb56dc8492aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765434, "uuid": "bcb5e8d0-262a-4f65-930e-425f3a565912", "value": "12288:EcPc9EuzXvFmWJfkN++REEX7B1eZ2i7U4d2VlVpz1ZJVyIlzcgF7YO6NvquwaHpR:EvEX+Z2D4d2PJwoMquPHpma5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623765434, "uuid": "ead88c57-d053-4933-870f-024b471ad926", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623765434, "uuid": "849fe6e7-6e7b-4419-9f8d-30a7741d9d51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765434, "uuid": "e4e2cb3d-43d1-4f32-afc8-9289f4fa5e91", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a2dfac-cd78-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623720122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720122, "uuid": "4bcaa280-8673-472a-b791-6706c31b8c80", "comment": "Malware payload (Mirai)", "value": "9ab65f89c1870916ed64ff8daf1281cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720122, "uuid": "8be1f245-6064-4310-8145-d2efb3fae27e", "comment": "Malware payload (Mirai)", "value": "05c2ab2624c1c1d8cbbc0204903635036e291ed5ca07e6dc45b479455dc189f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720122, "uuid": "0d2eb060-a5d5-4024-a2d0-1525b5db7a1d", "comment": "Malware payload (Mirai)", "value": "9912562099103c8ee81d483e92ee29a816c6a1ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720122, "uuid": "6749aef3-b638-4f3e-93a6-f151af5323b1", "comment": "Malware payload (Mirai)", "value": "fb137b482badff964a4e467fac62a64fe4f4b8331a351076165f41ec63ea2a5b6e29f660d3481403bd9a94ef64c4ffa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720122, "uuid": "124e1c8f-4aec-4254-804e-4a7ebd36b8a3", "value": "6BA34A839B43CDAFF9AADBF84B635EB453C110A735A6C453F2AC3D0987215954D0AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720122, "uuid": "7472a8e0-4baa-4490-acb8-e079816dd9a5", "value": "1536:mYjvaw/NcVBg0JIHthMLwjIzVxqzd6tlOCBscsN1dOX9oTO32Bnxnci9NvwdaHuh:NlGS+uwLw+xHLsMoTBxcMx7tl4kSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623720122, "uuid": "33985976-75bb-4c84-a2ac-617317931692", "value": 106536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623720122, "uuid": "6c6f4586-752a-4bd8-8f51-27a7a83bf2d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720122, "uuid": "ce1f6325-70a4-45f3-aa4e-2b1892616b1e", "value": "9ab65f89c1870916ed64ff8daf1281cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d30f1a-cdca-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623755312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755312, "uuid": "541fd230-f96c-4942-a3bf-a605b363d69d", "comment": "Malware payload (Loki)", "value": "25c18c15efa47e7501464f111bea0dc6", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755312, "uuid": "e6d6512c-4802-47a8-ac11-1b7fb56c4582", "comment": "Malware payload (Loki)", "value": "06d0462d16396cba8ea8bb7eef235c324f9a9a54a2cc690f1d67eb90a5ce96b7", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755312, "uuid": "61d789f5-aa69-4432-871f-f4c22f4e79b9", "comment": "Malware payload (Loki)", "value": "b0f18b0de6c07499229b91857e0a953e612247ba", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755312, "uuid": "92b2311f-a785-46d9-94cc-5ccad76a3ac2", "comment": "Malware payload (Loki)", "value": "6eb6956ee8f641df05cb27237d7d05732ebfeb0bc1293ffba91308c222c4b62b14bd275796d6be3a7c5924f7d1ad7345", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755312, "uuid": "a62b3391-ed37-4715-8af3-8c20bf152b0c", "value": "DA942363E4BEE15E6E19A4C78A92DFC0FD3983650523F5F9600681DC9BC513A1BBFA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755312, "uuid": "964d74a6-bf05-4e74-9393-a1e000e91097", "value": "12288:n9atTG4E+K+H61Mgfbw/cMzX5XEIj2AcYVw:94TPEBMgfFMXjHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755312, "uuid": "4fed791a-edb6-44f0-866d-e0058b27353b", "value": 422727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755312, "uuid": "dfbe8b06-7202-4c18-862d-74310762df76", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755312, "uuid": "f4fb084c-a867-4e27-be19-f84f1e54a072", "value": "INVOICE.PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249bb824-cddb-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623762666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762666, "uuid": "fedbf4ac-cff0-4c29-a92a-6610a0d0ee00", "comment": "Malware payload (Loki)", "value": "e6e2adadf32f734a80e8e8b8093a5e8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762666, "uuid": "22129467-5dca-466f-9044-f923bb4bd1d1", "comment": "Malware payload (Loki)", "value": "072bd5a94f8b5ac064311a5005243038e7851123321fe309a1b8320aae64030a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762666, "uuid": "30394b1f-c218-4afd-99ee-65c30d1e3d14", "comment": "Malware payload (Loki)", "value": "375bb87fe569a45a43b6b89f0f0197ec839692f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762666, "uuid": "fd188a0f-9401-4df1-9f99-e532946b8ed3", "comment": "Malware payload (Loki)", "value": "edb8b790bdf77dac23ef0a78b4177e8bd29ca5507a75fb1febeb4aa1f56203677e300a731d8e79e66abe2898af0e804e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762666, "uuid": "3210f7ba-e51b-4940-bcb0-257ce7a3fddd", "value": "C914CF6A5E990CBAE4829D3D9436773981ABAF3E3F0441C7335F3BFAFA3A0611519105", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762666, "uuid": "a13b824b-e488-45b9-9747-74c0c8645534", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762666, "uuid": "c93b2e05-c9a0-4b6f-80f5-64423109661b", "value": "3072:jLk395hYXJtM7jeabE1mp9TW2iTfzazIj5/U4slBe44/3fF4J94lt:jQq87jea0Kii2/U4E4fNq4lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762666, "uuid": "8b877ade-9a9b-455a-a294-7084f18a5d57", "value": 197983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762666, "uuid": "fbfcc09b-4000-4695-96c9-6e412b9dd12f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762666, "uuid": "d7896589-69c5-4f0b-8512-c93439ca739a", "value": "linkfuq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3209c88-cdd0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623758207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758207, "uuid": "17e08d66-efc0-4b5e-aafc-e4be90a99f8f", "comment": "Malware payload (Formbook)", "value": "9781d72e85449c801fdab473f3db7073", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758207, "uuid": "018b676b-05fd-4ee5-9adb-1fc617940463", "comment": "Malware payload (Formbook)", "value": "07e52c80192cec0ef41ce46b3b13c3bba758a0d7c5431d6f72b1983a5b92c2fc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758207, "uuid": "dfe477b5-4434-4b7a-be24-6478fba85261", "comment": "Malware payload (Formbook)", "value": "8c41aabd65323a45d80300ff82f41be933ded3be", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758207, "uuid": "4881777b-db30-4b52-afb2-4e2c1dd5e99a", "comment": "Malware payload (Formbook)", "value": "1e737b92ed88a1c6f7a08b50e67094078e741c63d2391a4ce6229c658324c8062b9994c45869f22714c496a63e6b4641", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758207, "uuid": "52d5ab97-1803-4425-8251-52baf28b5de2", "value": "2C5533CEFF9DEEBAA728CA7467F0ACCCCA45C4D8A42945F02D65C6612027127DFC1562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758207, "uuid": "4d741396-2a48-4897-81d1-c04793e9f49d", "value": "24576:K3Mf8x6eEM8bY5HjChOcZE6GnU9/huubk8NxmTguGPKz4JsXNDCuKDMfo:2TlDOhbvG0hu2h02/edMDMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623758207, "uuid": "4344f385-07ef-4b5d-8b9e-525cb1c52acf", "value": 1314699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623758207, "uuid": "9efbca02-0fc8-49ca-8b33-c1eed94274c5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758207, "uuid": "9a7cb8c1-47f1-4eef-a4b7-b3f265c12478", "value": "RFQ Products.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bbd3bf-cdc5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623753250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753250, "uuid": "c2608d89-d917-47f0-8b4f-c4f90f8b9a69", "comment": "Malware payload (Formbook)", "value": "61d46140f64bf7b46b90918f474e615a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753250, "uuid": "5d68a75a-57ec-4902-9738-8a6e3aaf2aa7", "comment": "Malware payload (Formbook)", "value": "0881127ba3ada84a8259b0e923fb8723a89016ae555bb59c44a9b372bba7daab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753250, "uuid": "9e4babae-5d70-4202-b0b4-5a712b9898ad", "comment": "Malware payload (Formbook)", "value": "6c197527a7fa7c6a613f195c8e25743496c32b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753250, "uuid": "aa8d07af-e041-43d1-bf6f-306c8cf99329", "comment": "Malware payload (Formbook)", "value": "e695d1743d67d0e05bdc59a84f751cea5c6f07e237e5299f49bb81057c548122b5d179f223d981a5f7ab94496a529e21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753250, "uuid": "91c54ec8-407b-42a2-b44a-750fa2ed6c25", "value": "E534120575D40CA3E96783304FB69F39DB77670638305B8F2B6D1FAE69016C7A606272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753250, "uuid": "8439a7a2-c63f-460c-8dcf-a50f2f3f5816", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753250, "uuid": "11331af9-79ac-4eee-b20c-5af15a05549a", "value": "6144:cQqHFEF+GpQmRw07ouG8N4hCycOV89N1Vt1HotfeSgUt:mFEkGpQEN7meACFN37smlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623753250, "uuid": "a7680cb2-de85-4618-a2b4-b6c4e352f139", "value": 244543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623753250, "uuid": "79b41a66-85f4-4faa-a51b-faa29ed099f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753250, "uuid": "1144466f-fac5-4d69-bcc0-9d07c4a0386f", "value": "ORDER47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfc08f3-cdd2-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623759111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759111, "uuid": "712db655-02e8-4bf7-a61b-3b7ece1e139f", "comment": "Malware payload (SnakeKeylogger)", "value": "5aae7678e7481b754bbde77c71283ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759111, "uuid": "0a271a7c-94a4-4e62-afac-379329471668", "comment": "Malware payload (SnakeKeylogger)", "value": "094bda1c0b93706b59e76f6d1decd6c824f6640f663cbab3b9c4449d60825915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759111, "uuid": "9a546145-29c8-4bce-b838-e4539e4e4dcc", "comment": "Malware payload (SnakeKeylogger)", "value": "fb29bad660557abc53e143033058dc35508e528e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759111, "uuid": "6da5bc2f-20bf-497b-b21b-ef762766bbdf", "comment": "Malware payload (SnakeKeylogger)", "value": "a7b6e7e66a0d0254769682a5968217ada84d2da5834b452751b7153bad6f6ded4f55ca47781edeab9c79fa32d0bc8edd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759111, "uuid": "d0248e29-72f5-4560-b57d-6581d60463e4", "value": "BF15BE27334C9B0DE27D0776E4B5053083FAAF075615EA9DBDE4BCDD09A0BA892217D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759111, "uuid": "7fd0fadd-fc8b-4186-b8f1-18b0e4fa6f45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759111, "uuid": "697751be-9a52-4ceb-9785-640cb9eeb011", "value": "12288:Tox6lgCaqTLMjUijkynYkD3/QUzlQhJgyRLTdIqxJkI49VCZ6vKHBj:ThaqTLMoijkTU3/PazR3dIoFkKHBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623759111, "uuid": "cb913358-e408-4aa1-9eec-e6f18a428e3c", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623759111, "uuid": "b3e8b6e8-6bec-4bc5-8efe-bdaf709deab0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759111, "uuid": "f7faaa2a-868d-4f02-9c1a-8b2f8067fc62", "value": "Payment Details..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9dd897-cde3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623766249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766249, "uuid": "98fec5c1-e4be-46be-9a93-f52207ba1791", "comment": "Malware payload (Mirai)", "value": "34c6cefceb535f3da21ec71e2efa8aca", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766249, "uuid": "9397c585-5c61-4615-9737-a079b9797f35", "comment": "Malware payload (Mirai)", "value": "096e1f631f7ca72fa8176cae6258a77fcbe4ecd471e9b295eb8fb1c41ca681f9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766249, "uuid": "06964569-8b48-4037-bc0e-d934f5ec831d", "comment": "Malware payload (Mirai)", "value": "83958a50587f552bb117918c8634e8b09f7200c1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766249, "uuid": "dc2ea735-bd92-4d9c-8c15-a325569c1ed3", "comment": "Malware payload (Mirai)", "value": "4a8392e5415a747b3be999125ca90d0f24863f6655b9d80650eccf1ae1438f8ff0854b788b46c343697573a12137113b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766249, "uuid": "377c3f40-6a79-44b2-b8ee-5d69ac65dde3", "value": "23C3E842F8C189FDC089D034076FBA3AD865F1ED123CB2E76BD4AF16294DEA1492DC59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766249, "uuid": "e76bbd6a-52b5-4a3b-9abc-f1b0e290c947", "value": "3072:3OCNkqw9XGLGiTYCCHcia9+k3BBK7rPZ/Mf5PSrIuMF1dbtD3FwCiY1Y1:3OCNkqw9XGLGiTYCCHcia9+k3BBK7rPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766249, "uuid": "dbb840f7-0ac7-4af9-9638-f950e6844866", "value": 123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766249, "uuid": "eb838add-1046-4ef5-9a7f-3026c4928a37", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766249, "uuid": "dcb5bda7-2132-4239-b0e7-58f2599b45fc", "value": "34c6cefceb535f3da21ec71e2efa8aca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac02e2d-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736879, "uuid": "7e3a910a-0d68-470f-b1d5-efcaa3823158", "comment": "Malware payload (IcedID)", "value": "658dd952c9d0de0dad862e591637746b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736879, "uuid": "d658c720-bfd0-46a8-8604-ec90f2fb72d8", "comment": "Malware payload (IcedID)", "value": "0a2ef710d189cb3b5e94a2f38de3950a20b84c891cec6dbfe83e2394fdabc113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736879, "uuid": "38533efe-752c-4b3a-b4cf-e24c01374a27", "comment": "Malware payload (IcedID)", "value": "5eca9aaa845f283ac0f0150ddca7706004d43040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736879, "uuid": "78241a8d-b587-464c-833a-a5c1a862fdd8", "comment": "Malware payload (IcedID)", "value": "d4b86c699b5d6f241ee22495a388d715763f92a99039e3ad68f562e295cdb45a3d59ac09d3a7619a66f2c278e9d6e721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736879, "uuid": "455744d2-3f34-4d18-9832-972305c34723", "value": "21B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736879, "uuid": "7a5c9d9f-ec05-438e-ae45-acd28e4f87eb", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736879, "uuid": "8ecd38f2-5fb0-4e6d-9f1d-4f20ecd44a07", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8/:t082TLrbNGoVMjPR5DxDRoFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736879, "uuid": "8d9a8d83-fe99-4e36-b638-0714a83ec370", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736879, "uuid": "45baf747-0938-4bb9-874f-e955040c14b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736879, "uuid": "f6e8f951-f3ea-4865-9f35-e3896c1cc789", "value": "0a2ef710d189cb3b5e94a2f38de3950a20b84c891cec6dbfe83e2394fdabc113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dee9201-cdc6-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1623753662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753662, "uuid": "d1b427b9-5f48-4fd2-82e2-39af5253c22f", "comment": "Malware payload (NetWire)", "value": "93be4e8635658672664174442020629d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753662, "uuid": "97663ffe-5d1f-430a-aa1d-b55a823ab536", "comment": "Malware payload (NetWire)", "value": "0a48820d9dc0f47e3c20c9e4d6df81592011b85388bbe22530ce8fc14f1fb93d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753662, "uuid": "24dd0578-4a71-46d8-b529-a80b43e78ad2", "comment": "Malware payload (NetWire)", "value": "2e8d87389ec5c4518be3f4618cceea6f3fd50ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753662, "uuid": "aa104ead-3a9e-4150-83c5-bc89a8c6a698", "comment": "Malware payload (NetWire)", "value": "463b9af13c4b648df56cbb08dc1b3a068f487a80148cb55a89312ec169a362b8273f1196313e70a0645c07e69dc96cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753662, "uuid": "0ae07d59-f944-44a2-8a58-7304143bb1a6", "value": "F07412F7D878A284EC4B4EB47F9760E9BBB9F0469CD2036B1B4C3DA468353D41543682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753662, "uuid": "8746eddc-aef9-4fbc-9005-bec1fe074105", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753662, "uuid": "17efc693-4c22-4f98-b147-1f51366c46e0", "value": "6144:kmz2zc3X7vWnghX+GcV8Qy0IusG6aYUKqYCkslTr3/e07I903Poog8ff0MeCOt:7XWCuGcVtY76p3lf3/Qma8f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623753662, "uuid": "02d61851-bbac-442a-9363-062f2a5cb30d", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623753662, "uuid": "b70134c9-a09e-4dfe-a2bd-28082d6fe379", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753662, "uuid": "d08cc569-03b5-415b-b632-8254b6540aca", "value": "FIR.SCR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e17753d-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736885, "uuid": "19ea9870-f98c-4227-8b6b-9e9b0cfd97d4", "comment": "Malware payload (IcedID)", "value": "2856d4278b13e15a4f8b935914e69105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736885, "uuid": "0bf5f6dc-dc95-4568-b293-3c3c9a75b8f1", "comment": "Malware payload (IcedID)", "value": "0beed2974fe170f251ab25ed2c404848742e33cbb1d1df024ef62fbd7d98c675", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736885, "uuid": "c3c40b2e-3532-4b1f-ac12-e6331c82cd03", "comment": "Malware payload (IcedID)", "value": "3f5b6c72dfdd35802a02983f3d23a1746926df0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736885, "uuid": "df081b5d-4365-4fdb-b4b7-eb04e686d3e7", "comment": "Malware payload (IcedID)", "value": "77e1d60c3001c242b3a927533241ee043aded2950cf2225b62002e4676afb8609e4de8df2c96fabea53e1c57794f4e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736885, "uuid": "164cb7f2-419b-46f7-a424-dea5e6c8a02e", "value": "8EB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736885, "uuid": "2a604089-973b-440d-ba59-436c2e768ef2", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736885, "uuid": "3434d6cc-a21a-4b07-9ab0-4820e7c69a91", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq88:t082TLrbNGoVMjPR5DxDRoF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736885, "uuid": "49e0d85d-3cc5-403a-b082-380554fcd691", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736885, "uuid": "9fdf7e1c-f074-4760-8006-fb614d0779a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736885, "uuid": "684607ce-5bc9-4bd4-bc11-c29ec730f8d4", "value": "0beed2974fe170f251ab25ed2c404848742e33cbb1d1df024ef62fbd7d98c675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e7d5a6-ce15-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623787585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787585, "uuid": "22b3f7c0-60c3-4756-b46c-151a1da29a66", "comment": "Malware payload (Mirai)", "value": "445b58439fad6cac3ad0d97c14777605", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787585, "uuid": "702f3f18-40df-4c8e-9c5e-5ca32699dd61", "comment": "Malware payload (Mirai)", "value": "0c252990ce9333f0c19600ec9cda8b3ce67b15892f04896972cba96501021e7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787585, "uuid": "4ffe1bfa-ed78-4dde-9b9f-194754010309", "comment": "Malware payload (Mirai)", "value": "880e2b2eb8fcb7405df696e348878cf8fd505b8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787585, "uuid": "b453c145-339c-4979-9839-dbb8e7baf567", "comment": "Malware payload (Mirai)", "value": "30283885f29c96cab51592eeef3578ec76d9c470370dbc0014e0bccea3532f5c08d5b55b5ffa7a12dadc969c3506b0c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787585, "uuid": "d2b9ff98-98d7-440a-a2b2-cdac27942c93", "value": "5C432925AD792E26C0D8B57E11F78724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787585, "uuid": "ce9028c0-036a-40c3-ad96-17be64cc0c88", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDT:eL0AxvSHfymp0xgunvCkV6vTMDauE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623787585, "uuid": "28daae0b-183f-4cdc-a0be-c6230e5a9457", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623787585, "uuid": "fa5a7163-e726-4a87-a009-118e9fcdf6d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787585, "uuid": "fe28f80d-999a-4f9e-afca-460bd9a323d8", "value": "445b58439fad6cac3ad0d97c14777605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a2ee84-cde3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623766256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766256, "uuid": "007d0d66-0a51-4235-b349-4dcba00fadb7", "comment": "Malware payload (Mirai)", "value": "16c9f98084651b74f53d03cb8046b7a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766256, "uuid": "0814895a-c171-4c14-8387-a4357a55a9a5", "comment": "Malware payload (Mirai)", "value": "0cb8d3af19c50201db3a63329d66ff18c3208135a40a237b98886f5d87f706bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766256, "uuid": "c2c2cc81-39bf-45d5-a117-56b73b977576", "comment": "Malware payload (Mirai)", "value": "a360a369fea29c9d917658c72a711765f6e3dbf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766256, "uuid": "f5e4615c-bcf7-4d21-8899-e7644c5593dc", "comment": "Malware payload (Mirai)", "value": "81d9dd065f6c2e9e8260c3f389744ecff69018ac59f7988e96e1080ea1bdb5cee6cabab72c0c5eb04936ef52d3163df5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766256, "uuid": "c61337c8-fd6d-471a-b0f4-9636caa7637d", "value": "0DD3E880F48B41F5C50B89306196F73FCD3195EA8273A66EEF98AF32DF6B642811194D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766256, "uuid": "6affbd10-bb45-49f6-9e6a-6ebab8bbf65f", "value": "3072:Ux115U0qnq1wwN/mDrfBcJJrNwwKhpVeNYFfioTX/FpwLZGfOje:0j5enq1wwN/mDrfBcJJrNwwKhpYNWfiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766256, "uuid": "182ce249-b7a0-46f7-9e6b-bc24fba9c019", "value": 131984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766256, "uuid": "eec5cd0d-1035-4940-b018-7de9fd325128", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766256, "uuid": "b919ce11-8d43-4587-a11b-d19697dc6156", "value": "16c9f98084651b74f53d03cb8046b7a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cba17ea-cda7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623740372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740372, "uuid": "fd0ba5d0-bb80-44d7-9036-7590972fc641", "comment": "Malware payload (Formbook)", "value": "c142a15f6244f82e701d53b595995a02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740372, "uuid": "6aa4f6ff-d1d8-496d-b1ee-330d198b321e", "comment": "Malware payload (Formbook)", "value": "0da92ee5ab7eeb708288a5738697bf61857dfdc9ab3115dbb9e94392ea786696", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740372, "uuid": "55339798-22d3-451a-ae76-9e534f2c9f8e", "comment": "Malware payload (Formbook)", "value": "ac80385bf8104ba49ef68691e4cf9e148fd940dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740372, "uuid": "f9f8c7a0-b4cf-4df9-90cb-0610f22563d7", "comment": "Malware payload (Formbook)", "value": "983a57b1b5099ea94e68e0ed3d876ddec4e74463912c86e5aed2f2b524325edf1d07dfe5686038e2770f74b961defc5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740372, "uuid": "6a506074-3814-4bb9-909a-041cba4fb80e", "value": "34156B5D92214471D82B2A78DC7BFAA855DE3D1135A88C4A06F73C45EE3D7C3782A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740372, "uuid": "92b368a9-c61c-41bb-aea3-f01b48b32874", "value": "5d03253373fb0f9ff309efca685fcbc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740372, "uuid": "b21ee812-55f6-4240-95ab-5af6a752cdce", "value": "12288:uu62O21Q9SUxQTnn8rh5aFUdMUgGj3LxRoBQCpK/yYPtbxPjtTHDfPnbetkkkgqQ:x5RKggrhmWPyIPtbxpAq/XQBee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623740372, "uuid": "a74e60f4-c781-4ebd-be59-d3125cc58a8f", "value": 932992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623740372, "uuid": "9bd44e08-bbde-4935-9462-1aca8b077e9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740372, "uuid": "d461dd5c-46df-4295-8298-178e81be2c46", "value": "PO094638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c30a7b-cdac-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623742614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742614, "uuid": "ec61dba2-327e-43a5-b1a8-0853043d9a60", "comment": "Malware payload (AgentTesla)", "value": "7f2b44d43554df2e127e83a78a4d8fee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742614, "uuid": "4c36210b-c9c9-4f2c-8461-34dd250a3c55", "comment": "Malware payload (AgentTesla)", "value": "0ea60776afead04e4eaadc7428b9a200ce16c4c2f43691c089db073e4d566f8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742614, "uuid": "34273d50-0e2b-4e75-a4ca-bebdd727eef4", "comment": "Malware payload (AgentTesla)", "value": "f10333a39e404c156f9d0dd560c444716098228a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742614, "uuid": "07e95ac9-269d-4213-ab47-3848b02ec9c6", "comment": "Malware payload (AgentTesla)", "value": "7de0113a10f4bf6404ab201ec018ebebead923cb559024f2afcd9a3c01e9436b989603c00c390b0c80e898f2bd5f4470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742614, "uuid": "47d619a4-76dd-4b7c-824e-ee121d5289fe", "value": "1AB42206DD36A740D54E6A76E0EB89B44AFCFEA19504B44B0798BF0C24737EE6BC450B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742614, "uuid": "c4c9dab2-3526-456a-90bc-01d9882db854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742614, "uuid": "9e15342c-1360-428b-ae6e-2e27ce710b36", "value": "12288:h6ufT2athywNEMUwFFuz2UM5xOJMFmUm68S22+bRZdHmtwuQ+gvq5U1:htZywNEKHc/YxOJgmUo2+bHdGK5vqm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623742614, "uuid": "cd5f93a0-441e-4eb2-b6d1-3cda5f56f0bf", "value": 524272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623742614, "uuid": "fe6bd3c2-d620-4a05-b7e6-1a04dafafbbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742614, "uuid": "4498f3be-0474-4292-8514-cb8de3dc0348", "value": "7f2b44d43554df2e127e83a78a4d8fee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2131bcc6-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736890, "uuid": "b0ac1c4c-71ca-4b98-babe-f41199248c78", "comment": "Malware payload (IcedID)", "value": "aaf54e27626eac44905d24bc30e3ef66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736890, "uuid": "0f210f35-d895-42da-9ff7-b82fcd475494", "comment": "Malware payload (IcedID)", "value": "0f7642a45a47ff73f57ab407cbbc2b27b18a4418a2a7868b521110b4fb0387a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736890, "uuid": "89cf6403-2e97-4b36-8300-d63ce47df1ad", "comment": "Malware payload (IcedID)", "value": "149c9f208c92caa1fb6d06f6b4b0a3f42bc40c9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736890, "uuid": "2a7156ae-4a97-4df2-a219-a29949ee0b35", "comment": "Malware payload (IcedID)", "value": "6963a7dedb2d0e267b5fc9a9b233fdc25d3a3b3806b453135daa59df9357965ad991f115daefc5b35dd3bf78b965163a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736890, "uuid": "e9d5320f-9402-451c-9527-af472f64982a", "value": "06B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736890, "uuid": "cda2df1a-06d1-4e3e-92bd-0c053046e3af", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736890, "uuid": "7b6bde0f-d17f-4fa8-9354-60a263b81a81", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8W:t082TLrbNGoVMjPR5DxDRoFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736890, "uuid": "51d09408-edf0-4491-8d4f-d7a3fc17b4f5", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736890, "uuid": "dae84b0d-160d-4771-ad1c-9e25cf77b17a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736890, "uuid": "7c71166f-18a4-4206-98bb-44cd0e9e5f18", "value": "0f7642a45a47ff73f57ab407cbbc2b27b18a4418a2a7868b521110b4fb0387a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47da20e6-cdd4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623759718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759718, "uuid": "e42833f4-bfc5-45f7-b0bb-bc669ee961d1", "comment": "Malware payload (AgentTesla)", "value": "e93b1ed868cced1c963bd666e720ea5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759718, "uuid": "b6be01c4-a613-49a5-8719-14999e222229", "comment": "Malware payload (AgentTesla)", "value": "104c6a0e538ae1d3f165dcb849a8c4d6e6f68e04d09c11c6c075f514e522fd5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759718, "uuid": "df1015a4-20f1-44d9-836a-8dcdc722d8be", "comment": "Malware payload (AgentTesla)", "value": "525069b273e61c1f5d9c62caf95b61ffe4d705cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759718, "uuid": "7b29dce1-60f8-4c9d-ae61-3aadf236ca89", "comment": "Malware payload (AgentTesla)", "value": "a27cc1af44f818c286bcf0a75434ea62a8a80828cc116e8a850c4de1d30def392967921690c2a2d888e85ac63c563c21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759718, "uuid": "44cf657e-d44b-4505-b517-64daa78e6138", "value": "E615AE565DCE52EFC5558CB69F30BC5282311CAA1609A7122EC334BDD93F1EEC9BE40A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759718, "uuid": "e24d1e69-f35b-4997-a9c7-e3c6d23e2925", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759718, "uuid": "3d7bbf27-26b3-4394-be04-c3ea8a297d50", "value": "12288:fayfSMPQipP5X0pchESBU0nxzpASNhc7NTzKRCTgBUOGiybQ0:CyiipySBU0nxiSNoNT+Rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623759718, "uuid": "41dda8c2-7431-476e-814e-2448665f5c3a", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623759718, "uuid": "002e76bb-7390-46fa-8b3b-835edcd04f06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759718, "uuid": "bd79eb91-2d8d-474d-a675-1ab73944002f", "value": "Purchase Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456dbeb6-cdcf-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623757567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757567, "uuid": "8c793e71-d155-4a4b-af1b-a00b9137d27b", "comment": "Malware payload (SnakeKeylogger)", "value": "8a7e0364daaf595bedd885a5cd28ce08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757567, "uuid": "0d75be72-9a0f-4a88-98f3-2b06189db649", "comment": "Malware payload (SnakeKeylogger)", "value": "109bd7aa6730a6b04f730b3fcf4f19b9ea9d9e2cb465315dabc2c6f3519ba5f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757567, "uuid": "9e274ee5-a585-4770-97b3-354e29bc86b2", "comment": "Malware payload (SnakeKeylogger)", "value": "87f5455f672f10af97f475cade5b3dfea44dfa2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757567, "uuid": "280b1849-95be-4515-94d2-600b75dcf80d", "comment": "Malware payload (SnakeKeylogger)", "value": "8a2b54a70afd5e040a6ce3381c950f44b2164090fd85751c7585bb016c11b22681b44616be08932405bc84d21251d3ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757567, "uuid": "1a23f622-efd0-428f-b7da-d867273808b8", "value": "521402EB74C004F7E4265BF15136E6B9C2B73F102A32C55B6B96BF9B3231283461568B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757567, "uuid": "928054a0-1066-452e-8e79-fe399e540142", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757567, "uuid": "e9b5ce4a-e3bf-45c4-998a-74b91649752e", "value": "3072:eLk395hYXJeFkMg/idN9qf3LY8/PNQmWRXn0SlwN5VIas13acizaXER1woV96hOt:eQqCSA45PCmWRX0S85VIac3jCaUR1HAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623757567, "uuid": "05c7d8a9-5d04-45bc-913d-51db1cefd227", "value": 191713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623757567, "uuid": "dbc178bb-25d1-4f05-a329-91b36b228653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757567, "uuid": "1850a246-603b-41ce-841f-ea7d966c527a", "value": "PaymentCopy2021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9662a0-cdc4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623752797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752797, "uuid": "899b37b5-26ed-4a53-b169-5c42e76d13e9", "comment": "Malware payload (Formbook)", "value": "209874a1969edb4678d68681b37642ee", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752797, "uuid": "c7b8de9e-ec27-430c-8ce1-b84e99ebb96d", "comment": "Malware payload (Formbook)", "value": "121127767d617cadfab39492a44c2b0f555d907565a79e560d94ad75ee4b1dc6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752797, "uuid": "eb87a90c-12af-4f17-96dd-1acf4bde4788", "comment": "Malware payload (Formbook)", "value": "ad57265c0047c7e44e2cb8c752fcb4ae9de8ffbe", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752797, "uuid": "4ac3025b-a272-4a58-856e-a404b1df6723", "comment": "Malware payload (Formbook)", "value": "0a5ba0bf19c43fd95c323c6a750e5f6fbe17394937ddb7f1dc4ee1c6cba0c62dd39bca28460e773c50c809d2dde71ab7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752797, "uuid": "8ea198ae-24cf-4e02-9adc-4c1f6c521327", "value": "EE34139B2141B191F74FEDC1D0EE74D0E1C7B676742AF24BE915D2AF69A4279030A01E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752797, "uuid": "571b16ad-d37c-42a2-9e69-725359f3bd9b", "value": "6144:wZzcxxS0UuvGk77LohbL7hux+iV7kGDTsAlUUz6:KcxWuOIYJL7IF6IsAl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752797, "uuid": "cc76d7b3-f899-4720-9e3c-9f53a6b2445a", "value": 233245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752797, "uuid": "a8fcd320-bdeb-4576-897e-48abf7f3bfec", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752797, "uuid": "5507c9e8-36b3-4628-836e-7f66b5f316af", "value": "121127767d617cadfab39492a44c2b0f555d907565a79e560d94ad75ee4b1dc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b142000-cdbd-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623749738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749738, "uuid": "90cc0f44-ace8-4f1b-9946-e64db758970b", "comment": "Malware payload (NanoCore)", "value": "832b5d9ff0d87237424ba7e07480ec74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749738, "uuid": "32b0db7e-18d5-485c-af4c-d93bcb321120", "comment": "Malware payload (NanoCore)", "value": "124173cb331e9e281480a04af877126efe11abf7635060d472d7d2017b3ce865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749738, "uuid": "5d91ecbd-6954-4c61-a6bc-0272d61f3369", "comment": "Malware payload (NanoCore)", "value": "0ca152ef768f95b7039422996ece2562796450cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749738, "uuid": "dd8443d2-4d11-4c8f-90e3-ce5957b89b5e", "comment": "Malware payload (NanoCore)", "value": "082f20def0318b7bf349924ac2798a16bb00ad88f480c72625a86665eb49a28507fbfc0c2c859bd3e96943344f293215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749738, "uuid": "d75f285d-0308-4599-80ac-52d22cdf4e93", "value": "BE64F251F784C8AEE15D0EF098B2662442BFEE9745920A1F57B8371A107B183787BF87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749738, "uuid": "3957bb03-efc7-400c-84da-7b04b99cc8f2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749738, "uuid": "b006591b-5d43-406c-88d2-43ecbbc460eb", "value": "6144:/Qq542x7s9Qq1GRqWawv4QO56/blFHzuHwudY9qGbGaFt:/f2QiG9awwv56/Xz+wRbGaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623749738, "uuid": "f6538383-2d30-4472-b1a5-d174b228acff", "value": 322362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623749738, "uuid": "0d8ade95-09de-46e7-8865-dd85411fa16a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749738, "uuid": "eda6b8b8-5825-475f-98f1-d3d6b3de784d", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e70ed9-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623769107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769107, "uuid": "87e8bc87-9b7a-4288-b803-196e0df7ed6f", "comment": "Malware payload (AgentTesla)", "value": "87ad99c3fe21f3c3eddf7c915221251b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769107, "uuid": "6690935f-f40c-4228-a47d-4bdcfb4f57e5", "comment": "Malware payload (AgentTesla)", "value": "128ed4ceeb4d3b644afffd03c466420d09eddd9a627f80727f72152e109e6dca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769107, "uuid": "6334b681-a966-48a3-9125-0c9891a752e8", "comment": "Malware payload (AgentTesla)", "value": "dc7a2cfef2f09d3122eb1243eb6d685950b90e4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769107, "uuid": "9af19d21-5918-47cd-bc54-6ab1f06de8fe", "comment": "Malware payload (AgentTesla)", "value": "f6764d68005f70f7e473ce1a16506d8f7e458f0249af6fb46091efab7169b626d7ee335369c2695f1c57ed39a43db436", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769107, "uuid": "dfdd2c28-e60b-49a6-97e9-73a3f4ddf533", "value": "1E05BF522E98AB89F4F99B347DF0431513FB7D12BB23D3DD6E9471DA2963E808A11342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769107, "uuid": "917858b1-bff4-4ba6-8e51-b5d6528f9db7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769107, "uuid": "9eb39ed1-8337-4a6b-8c43-5d67ce26efa9", "value": "24576:v9QBOhQiVy7hHJM3uuhcUzlyX0+quPHpRa6U:vOgf4W+UCFa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769107, "uuid": "e05cf4c5-a022-44e4-bd4a-1b8d03e43748", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769107, "uuid": "ba9f470e-b30f-4399-9798-84c8be2ea864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769107, "uuid": "9bb18ef4-9d0c-4498-9de2-7d849f79e96e", "value": "AWB # 176-25046976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff3e433-cdb6-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623746793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746793, "uuid": "1f95b3f7-9032-4556-a156-f6e41db1154d", "comment": "Malware payload (CryptBot)", "value": "000385ebbd5e91d09746b2de4af54ad4", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746793, "uuid": "16743ab7-effe-4c20-a29d-1c0a1f5a72f6", "comment": "Malware payload (CryptBot)", "value": "12dcd1bdd0cae0600249bccca37eb78756f4bec7b9e98d857eb33251b6f357fe", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746793, "uuid": "5e009e4d-54e6-4417-9dda-df914d2b92a7", "comment": "Malware payload (CryptBot)", "value": "4c20b44df5e55711d0faaf34d081a66098bd9843", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746793, "uuid": "2d85113c-e5c5-4a8e-af53-84488a72c7c3", "comment": "Malware payload (CryptBot)", "value": "194e87104742d5eb6559e66dad66fccb8a08d0521d725352cba55c3f825ebbd646664fd62e6b615ed15e05d959fafd89", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746793, "uuid": "a1db3382-1c9c-43c1-bbd9-b74f85e41039", "value": "47F4F110B691C036F1B316F446B6D264A53DB9B1AB78A4CF22C657EE4AB41E0EC31F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746793, "uuid": "2b33a59e-e8e9-40c0-8aa1-2c53462c7611", "value": "b0d3854c557fd79a46b820c312bd2709", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746793, "uuid": "76999f91-8855-4296-9d25-e91b5563edb1", "value": "12288:qnlc+pZ9DLWlfld92zl4Pe96GAiifyv6DmMGL7UodplVHaRlkaC:qlzDiezlbMGAiGDbAQaV6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623746793, "uuid": "70937eee-4a3d-45bb-af8a-c1c0305efb77", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623746793, "uuid": "05759e06-5dcf-4bcb-87fe-3a3798b668b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746793, "uuid": "63148803-250d-426b-8b69-6c36db4ff379", "value": "12dcd1bdd0cae0600249bccca37eb78756f4bec7b9e98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b14799-cd8a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623727898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727898, "uuid": "aa8124aa-4641-4558-866b-be491448a9ac", "comment": "Malware payload", "value": "3aea79f15337ac4053dd12a5efe97a02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727898, "uuid": "716c2206-bfc3-4034-96ea-97f0b7ac2963", "comment": "Malware payload", "value": "13e779a3317c7343012179bf9ee55903c1029d74cc2c133752344744ec147824", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727898, "uuid": "81e73e4c-a05e-4004-98cd-2051ead7a904", "comment": "Malware payload", "value": "7e7577362cad11ae641151bfbbcf219dfcda4dcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727898, "uuid": "1460f7ff-309c-49ed-a165-0e8439743205", "comment": "Malware payload", "value": "d8f9546d1ca10ff96daf695e0cd6630edbb769902476bef45d83eb80a18dbe501c2772aea03f246c196678e8550bf432", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727898, "uuid": "1e2b9f6c-ab8e-4844-8b37-140cb34459ac", "value": "8D935D11B6D1C871E576193558B4EAB28A3EF9341F315EEB33480A7A0F342C15A36DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727898, "uuid": "d6c0aab6-e649-4525-856e-ded944b12d7f", "value": "67ce388efd77bfb2450ce471a6cb1e0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727898, "uuid": "79863929-06a2-440f-a832-d169823ec238", "value": "1536:fgd1lCy5qBTQQrattA5ng2KHH2Tv9QuMqDNIVCR3uDxbAZZMsWvbcdek8GUwQKfk:fgNCwqm57ANgqv9QuMqDNIOuDxbALek+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623727898, "uuid": "5f23d011-e101-45e1-a3d3-9967ed33c4d7", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623727898, "uuid": "1ef65d2b-337a-455a-a71d-fa72df1811b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727898, "uuid": "4aaa1ab6-0b04-4a84-b2ca-a7b90f62711b", "value": "3aea79f15337ac4053dd12a5efe97a02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b0e37c-cdc3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623752655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752655, "uuid": "cd2a26ae-d9cd-4c8f-a239-3569ee434051", "comment": "Malware payload (Formbook)", "value": "7aec050391d83d48faaf828ed03ba822", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752655, "uuid": "6b183159-4da1-4433-af6c-2ef9d53fed33", "comment": "Malware payload (Formbook)", "value": "1462d6d903933e84513ecaf491cef3586534771a779406ed3a48ce3d1528f407", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752655, "uuid": "188ce32b-5906-4d6d-843b-fbb0aed624a0", "comment": "Malware payload (Formbook)", "value": "a6f266a6804b6b621b3fe2c7392213c49115cc55", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752655, "uuid": "b40a12d8-41f7-490c-8253-921f70f89876", "comment": "Malware payload (Formbook)", "value": "624d3c900a13a56ce2f2296ba51c25726eb8b56b2ae96a1a40d32eca90a80e6b7f7ec0b08d541abefd085b32edfc5184", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752655, "uuid": "594b209b-4db5-4601-93f9-b874e67e3869", "value": "2F3423C0662D56DBD82473BC8192009772A5DF691BBF27B98F1C96436CFC0CC677888A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752655, "uuid": "93d86dbc-e883-45ad-beb0-030557c55cca", "value": "6144:w/T+QrKFtL/2T78gZ2fqOBmzsp5Vb2yAJxxas:RQrKPuT78gIBb0JxIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752655, "uuid": "55b3737a-e422-4027-ab58-c4e2992b1dbf", "value": 244674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752655, "uuid": "40628f40-62a4-40de-b9f1-c34233dc4abd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752655, "uuid": "2b2b29d6-400d-4e72-bae1-bf408989718c", "value": "1462d6d903933e84513ecaf491cef3586534771a779406ed3a48ce3d1528f407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f70e32-cd96-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623733116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733116, "uuid": "e647d369-aac8-4612-8226-b95b501e1796", "comment": "Malware payload (SnakeKeylogger)", "value": "701125469f5047a2a2a92c4054072442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733116, "uuid": "61435807-4034-4690-bcfa-f349236ef10e", "comment": "Malware payload (SnakeKeylogger)", "value": "14bf0f2bd86e85f8162ef4e3094b60b9a790c20d718b52f898902220cdd70c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733116, "uuid": "9c5bfc80-96b7-43b7-94a1-8e5ad460dd2c", "comment": "Malware payload (SnakeKeylogger)", "value": "295d387a1ac030a76c42dd7ea44e760534cba3dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733116, "uuid": "82f8323b-8d2a-4bdb-89cd-b4950c768778", "comment": "Malware payload (SnakeKeylogger)", "value": "27ae64120682ab9bb3a288d3b599496ed715023e0e8d008a671e65434f8f496b95e3677bac8d9219eabe6d422327e407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733116, "uuid": "b014453f-c3dc-4443-a078-93879af500d2", "value": "1E2512206A44AB22D27D97FA0160201123F1E60BE331CB5EBEF995D50F56B874AB77D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733116, "uuid": "11d05015-24cb-4b76-9caa-3483c82806d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733116, "uuid": "760f7946-9779-47d7-a114-867b5b43369d", "value": "24576:qeGaPhELuYA5O/iTW/chYQsl9G298dUvWxbez:qbaPhLB57TWSP29G2Mxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623733116, "uuid": "14306883-c031-412d-96cb-f6515ebcdd3d", "value": 1032704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623733116, "uuid": "1f7a17ee-e4f5-481a-8c42-c1aa0e0b4729", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733116, "uuid": "46a1b1c7-f67d-4b2b-89ac-83dd7777aedf", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f78ec5-cde1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623765512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765512, "uuid": "ee4f226d-56e2-4d3f-a471-26f24329e6a7", "comment": "Malware payload (Mirai)", "value": "dd2d2e54a8fa5f4c8db7456915a0844e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765512, "uuid": "98532f9d-f59a-442a-909b-b06a182ff480", "comment": "Malware payload (Mirai)", "value": "16115592e25046d05532a06d8626fee2e38f5aa09b6b4d3272179b7308475ff4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765512, "uuid": "eafdd4fe-b8a7-45df-ba17-809ff083a353", "comment": "Malware payload (Mirai)", "value": "4e42211244fc8eca060c2b1888ee741e1474b6f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765512, "uuid": "bbca4922-ede3-4103-9cbf-79828cc731f4", "comment": "Malware payload (Mirai)", "value": "38f003d7c688e3ec223a12fc16ab5189f7f74091d6f36c15069b1804dcca3617aa64f09b0064aeae5076d250bf99f6df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765512, "uuid": "a5fdab74-f654-48f0-baa5-76c5178006cf", "value": "BFB38E35F029A8E4C4B54638A4E8DDB50F5160C853723EB7DBC58EB8009BA74F619FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765512, "uuid": "2b299e48-b40f-4661-a746-d6cfd7076d96", "value": "1536:5/lUoUavwtOVuo384RBcHcfnMsnX96oB4s2+/YESy30HU+Gvc/Coc:5tUXcJuo384RqHwn/bBtdS0cLGvc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623765512, "uuid": "175be0fd-6dc4-446b-a8ec-4a8292976553", "value": 116108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623765512, "uuid": "38baa8e3-b5ef-4d4e-b03d-4094672ad04f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765512, "uuid": "64b6e232-c9ab-424e-8714-f3574c207b71", "value": "dd2d2e54a8fa5f4c8db7456915a0844e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25d89c1-cdc9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623755253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755253, "uuid": "bd9a92b2-ea30-4eb2-8855-b3a73b53f8db", "comment": "Malware payload (Formbook)", "value": "844ff44415314cd8f8da2de011b2ac2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755253, "uuid": "19ca0072-4ba4-4e9f-ae7f-24bde511a3ac", "comment": "Malware payload (Formbook)", "value": "169ccc389d18d44f4693c1de00f47e1b405f530ea90903b68c23523fe86592b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755253, "uuid": "6ad2d311-aabf-4184-b580-c6d59baa48e8", "comment": "Malware payload (Formbook)", "value": "deb49ed5fda8ed053dcefc70571cd474772c937e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755253, "uuid": "6fa9bbb7-2f69-4cf0-8217-6be14e6b0e10", "comment": "Malware payload (Formbook)", "value": "224a0091a6a83cafa7f24edd7d360812f24e8ed2215c225b52ce9b2e3432329273ecd6f581be6344a85841e328054ac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755253, "uuid": "ea30023c-d620-4e06-88d1-a956d2bab639", "value": "203412C35AE9083BEA1344712CBBD76AFAFB97151220012F37660F7E7F206D29686175", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755253, "uuid": "675f632a-2fe9-4c24-b614-ebc34f42cf12", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755253, "uuid": "9acf4d92-a3ec-4d14-a525-d2b7bebea496", "value": "6144:cQqHnjaycjzhEN52PtCgJByD3Y12TxZPt:mjaycEN5Gtl/WrTzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755253, "uuid": "c145dc6d-5d5c-4d16-9a87-db847f0647f8", "value": 244556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755253, "uuid": "c01531fe-4f64-461f-ab32-edea703a2c3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755253, "uuid": "c41ea76d-44e2-4fdb-b963-7da9928595bf", "value": "doc64654475795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de701d1a-cda1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623738067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738067, "uuid": "d4b19d70-700b-48e6-ae8e-ccfc84133c7b", "comment": "Malware payload (Loki)", "value": "4e79d701c7dc304e562db3d540d34761", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738067, "uuid": "64e5ee3e-d9b8-4725-a8be-f5618d6c839b", "comment": "Malware payload (Loki)", "value": "16a140ef10b0ea8bf9d2b139d26c447d9e8d090801dc82cc77d4f06a6a80c8fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738067, "uuid": "4b2aed5f-b897-419f-9355-887fa9f6080f", "comment": "Malware payload (Loki)", "value": "03e3d3d75abd4cd7e8c7fdf84e8373f657195049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738067, "uuid": "6c62595a-3be0-43e8-8d67-80b8cc14303e", "comment": "Malware payload (Loki)", "value": "a05a3c28bcf250f77017f2ba531ce1623ef9029abc84292c7188a7df70bbeb84c1add343f8fe0abf3299336323a3cb42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738067, "uuid": "581ee1cd-7f73-41b4-853d-9d433fdcc0b5", "value": "09F312A236D098E7D5A3467023B7FB25C7BEF325203155571B298DF82E121D3C6AB293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738067, "uuid": "21555e1e-f174-4b5b-b379-306502397dcd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738067, "uuid": "72144623-6bf9-4dde-a605-e66285ea2abd", "value": "3072:mLk395hYXJ/MDwvi5T7sakYDXOuZf/8bahDUMCkk7OgGtq8PwkF/ra0t:mQqWDwvOPp3OuZf/Sa9UMCkk7cqCBDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738067, "uuid": "3de0a4c3-891d-4553-8875-66b600e79ebf", "value": 168672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738067, "uuid": "f48cae8c-1233-4c80-bb4f-84e74321c22d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738067, "uuid": "75afdef4-ef76-4d07-a163-c90dca9a49e8", "value": "Zahtjev za ponudu 15\u00b706\u00b72021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfaf290-cdb5-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623746521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746521, "uuid": "fe3cbbcd-7520-4aaa-988f-ae17a5bacaa4", "comment": "Malware payload (OskiStealer)", "value": "7019a380fcd93ca7245a7c1139b82259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746521, "uuid": "205ae70f-9798-4642-b39b-5824c6b567e1", "comment": "Malware payload (OskiStealer)", "value": "18b1e1c27320911f66b4f1373454cbba4ef41b5e093221cc9aa4893d087712a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746521, "uuid": "c989b7bf-0d8c-4646-a351-e6fd53e1b15e", "comment": "Malware payload (OskiStealer)", "value": "43d429d8089befd553a7b59a7e1c86fb721e73d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746521, "uuid": "cfc93cd8-193e-477f-9c33-adb6ed47bf10", "comment": "Malware payload (OskiStealer)", "value": "729fa5cc4449a24b1faed9f4ceb99b5ddc9fd277cc7192372ca2766604296d1dc79d3474352ba018e1b4af9f44263502", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746521, "uuid": "3392657a-3502-454a-94e5-22504767b56f", "value": "7254135231E280BBCC12973115B17B39D77DA91622E06D473BB54EBE8B11FCB83352A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746521, "uuid": "464b9fff-9a0c-4dcd-b283-81a17a13c5ba", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746521, "uuid": "5365b998-658d-4965-9242-34bac860abff", "value": "6144:JQqQRnuHNLkVDeSvEux31/eA8ONpW+vtozCNfNcKcEt:86NL+CSvEuvNs+luCNerY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623746521, "uuid": "8a6f1160-ce5b-4ae2-8990-b24996e655f2", "value": 289362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623746521, "uuid": "f7d14b34-69cc-4246-ac7f-636749d899e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746521, "uuid": "c4c16713-dc08-44cb-bb98-9c2ba7c13aff", "value": "Mitchell_RFQ_36496.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8642f2c8-cde9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623768842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768842, "uuid": "8319848b-6200-4496-8089-87beb5c210f2", "comment": "Malware payload", "value": "a75c6c6953a362788c54b36ec7f8dbf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768842, "uuid": "77e52377-6620-4909-9a24-61ee417ec37f", "comment": "Malware payload", "value": "19a93cf55d422bf9dcca2ece46b98704248641f86ca7ed2a21d903c724c79a53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768842, "uuid": "201bab0f-abfe-435e-ba59-dfc48a3e2214", "comment": "Malware payload", "value": "36c2485f9bec118660d3dcfb60e4b184c01c5d61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768842, "uuid": "6213f81c-67a7-4795-b244-4dac020312da", "comment": "Malware payload", "value": "1dbacadce096ffaadaa5834fb7bc30d7dbde43be7b3a31e2c5b80add2cfd2899c48fedc5f369911b40a7b25c023a2b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768842, "uuid": "cee11acb-5c71-4fc9-866c-96b5973d375b", "value": "8244B843B2477626D1A8AC7026ABC12A77FB2C77F210590336C1BF2767349A77DB0916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768842, "uuid": "11fb99de-bcb5-42a8-9fb7-90fc62cbc329", "value": "adaafa2c180eccb7addf1201d12c8322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768842, "uuid": "ac578054-fc79-453a-8045-7d8333a7eca8", "value": "3072:goQ3J7Mb+bnPdaljI+dJrODGqrK9+p7r2qrFx0fi0XdtaHS2Jp:M1aO+eDdrw+pXpxU73l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623768842, "uuid": "bf90f649-3b6c-4f94-8c90-297b91b9b805", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623768842, "uuid": "f3c8585d-aa8e-48fa-b9b9-8332e765028c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768842, "uuid": "c8c1c426-62e2-4008-add4-447930487665", "value": "PRICE-(BPS).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7091f6-cddb-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623762654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762654, "uuid": "134d36ae-d63e-4c38-854c-ed2033603a41", "comment": "Malware payload (RedLineStealer)", "value": "089eb54bd79832c3aee1f715c80ea28c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762654, "uuid": "c4c2635d-4b1a-4f80-adbe-d9356be6b6ba", "comment": "Malware payload (RedLineStealer)", "value": "1a0dd04106a32a7cb062d8294720506f7f84a54c4268e267163e1c43b08d65ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762654, "uuid": "0c3b391d-fd40-4c25-b7fb-e87e5365d689", "comment": "Malware payload (RedLineStealer)", "value": "44602ffb57f0eda2f9c497e928455d8b3f190761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762654, "uuid": "68992c95-3f78-4cc2-a921-b783f104cb81", "comment": "Malware payload (RedLineStealer)", "value": "4010c47d03cdbcf8de0cc66dbea42fd8cc53435f52058136022871edf5a932961c994a3e5833e0492738593aec1ccf08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762654, "uuid": "4f3eb181-444c-42eb-bf7a-675c7847decd", "value": "9F74AE10B790C038F5B712F45A7A93F9A53D7AB06B2890CF42D626EE5634AE0ED31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762654, "uuid": "734daddf-b5f7-4271-97cf-c2e30c7c47e8", "value": "709d5c7631204ea8a49d3c234309fc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762654, "uuid": "0ebda77b-a502-4f76-b7b7-2b9417a36dfa", "value": "6144:tWNYJR1nDgw3CIRz6VmuxMntSTDsvRkEGQBzhk:tWNKR5gw3CIV6VmuxMgTwveDyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762654, "uuid": "d8a3464c-bb7b-40b5-8694-87e29c9b0e6e", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762654, "uuid": "4cba3bc5-da2f-4f60-9bed-41fe32b5ec3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762654, "uuid": "6e77ba92-facd-4d20-9bc6-2e3c2a3e25a5", "value": "089eb54bd79832c3aee1f715c80ea28c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2628f66-cde1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623765588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765588, "uuid": "9fff1fe2-6464-493f-b548-5e9a508a1376", "comment": "Malware payload (AgentTesla)", "value": "6329f532af9e79c069a28a98fea78070", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765588, "uuid": "8ce0441a-8eb9-4548-ad27-4fc3d8dc36a5", "comment": "Malware payload (AgentTesla)", "value": "1a7916565b10df8a93edb90f8c4518ae990a949aca2c17ef6f976849a6685ead", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765588, "uuid": "3363aa4b-ee33-47ef-814d-c3a1e980152a", "comment": "Malware payload (AgentTesla)", "value": "15c0328bf10c7c1429f0377fba4562f0dcafff11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765588, "uuid": "2de84b10-c222-41d6-882d-14e23d111f2a", "comment": "Malware payload (AgentTesla)", "value": "1de2f1b9d8bc92f8a54f8470eab2fec654c33c5892d048ab16b59336696a413a46007688f47692954732f8fdc7c945b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765588, "uuid": "55472ab7-13a7-43f8-8909-14395c0490bf", "value": "8F15AE575ECE92AFC5658CB65B30AC56C2311CAA2609A3123DC334BDD93F1EFC99E412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765588, "uuid": "e91915a0-95cc-447b-a5f0-4ea7a4b6859b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765588, "uuid": "fbcfda5b-d2e4-46b1-8784-d6f81b3a0130", "value": "12288:N6sgOSMPQipP52h1DO73veNAdk4VDnh6qc1Y6TxsOFfuAtH:wxipg1O7G6kgzMqc1YAxsOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623765588, "uuid": "fc0ebcf8-e657-443b-a019-552ec99ba03d", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623765588, "uuid": "276753cd-2da8-4e77-a1d6-444ef537f32b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765588, "uuid": "11e0782a-739b-42a9-ba33-df4b8736516c", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecefd7ac-ce00-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623778893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623778893, "uuid": "b4eaec2a-6b64-4b53-bab5-8e899421022a", "comment": "Malware payload (DCRat)", "value": "52ac6ad9bec9773531d170fe025f8cfe", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623778893, "uuid": "0516c5c3-66d2-4d8c-b594-a880768f4770", "comment": "Malware payload (DCRat)", "value": "1b5114a819cd0f44d02a11ac1f896e934a93cef4375292ca9aa763b8e41bddd9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623778893, "uuid": "32409097-63c7-42a0-936d-4f97ad07f240", "comment": "Malware payload (DCRat)", "value": "fd15564483854d8d26610de2ff8f8dafcb861b02", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623778893, "uuid": "2ad46210-7a68-4c2a-b86e-460bf17d6cf4", "comment": "Malware payload (DCRat)", "value": "773aca9c8e42b851e54cd9c34faa0646435fa7f0cdd758d69850825ee7e3029912cd2da8f7de5197d0ae080de348f3d6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623778893, "uuid": "39a09dee-b3cb-41ac-a177-96b32f6ed126", "value": "03E439223648EE11C069133BD9EF45244BFCEE41B6A2D7167E9F336C65513A3AD0E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623778893, "uuid": "36b64d43-037c-473f-a06a-5cb28e08efd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623778893, "uuid": "e5045d67-051f-4798-9b14-cb8d39f5d097", "value": "12288:Z4w1tMWi5bzSICSpy0jFx+uve102bo1U+kCRqn:Z4AtZICSn+y92boyQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623778893, "uuid": "f6a39cb1-2270-47a6-ab03-0e225380db37", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623778893, "uuid": "7504de54-5187-4b13-8273-1773e2865f51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623778893, "uuid": "be1ed3f2-776a-4cdc-b4a0-fdbefc8bca45", "value": "52AC6AD9BEC9773531D170FE025F8CFE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07c361e-cdab-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623742284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742284, "uuid": "a685af6d-1eb3-4e91-8c1a-4748af2f3ab5", "comment": "Malware payload (Loki)", "value": "42fc76d30b92b67537d548dce7a06f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742284, "uuid": "e40cb926-573f-4cda-9a97-8ed20432e398", "comment": "Malware payload (Loki)", "value": "1bb1b225d4e08edcd68087385d46e8ebfb51d9d3d3ee7815330da331ed6676c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742284, "uuid": "3a14c805-763c-4474-8cfd-919cf9f71847", "comment": "Malware payload (Loki)", "value": "96c447d6bf30a87ec4824c5887899d8ed49e8f0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742284, "uuid": "4eb13ce5-adac-4bbf-ab85-c996066d2eab", "comment": "Malware payload (Loki)", "value": "a0f800d48836fd689be6ffe87634d2a37e62546e795c51d8c13a041bf6cd836509989ae316d06b882b43be6a81def340", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742284, "uuid": "7a95e6bd-d39d-49da-9ff7-685a1cc60303", "value": "2F25398C7555EF9EF4378B3185549C10E617ACAF9227820BA313B67F6A3F3D38A141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742284, "uuid": "e59aa0e9-2617-4b39-bff2-547a6db1eee1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742284, "uuid": "83a84651-9e77-4565-bd2c-460eb6ff8350", "value": "12288:WBcFaJq/K9VCZ6vxFwOpn/AwM95ivqGnBnR/lCWMm2spBKjGvsJtr95KuV7IXooH:QcFa/xFhpn/rMTINBR/XMmk7IFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623742284, "uuid": "af5da3d2-161d-4856-8cd9-a8dd58386d58", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623742284, "uuid": "ccc726ee-1e50-406a-b1c5-b70f64551099", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742284, "uuid": "e14bc711-7e4c-47fa-88a2-a6dabdefffd7", "value": "TDF9XB01IbjiGuv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c12ea3-cde2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623765719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765719, "uuid": "90620f32-07e0-4a32-938d-a00d3ae6f66a", "comment": "Malware payload", "value": "615f2501445e5068912051a1bc11d382", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765719, "uuid": "a1fa7934-3cea-4732-a008-0b76bfb34cfe", "comment": "Malware payload", "value": "1f9381182aad4f9917a66438b10d69f62c1027e3e4d27477c48cdec6651bd0d8", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765719, "uuid": "1d63c8af-9d02-4a3f-b92a-1e28dc6659ff", "comment": "Malware payload", "value": "b05c6a1ce1aa0b551e8837a8b00f55aff46ae2a5", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765719, "uuid": "c88a8b59-9755-49ef-bb64-fb9f5c414769", "comment": "Malware payload", "value": "ca4436620bd7a1b5b8134d4c2ca040230b87db5358f25f7685f9fa37e11e08ad39757cfc275141b6a3eec7affc72a75e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765719, "uuid": "c9adecde-cca9-47c5-a5b5-31809ba0db57", "value": "1B5533ACDED71FD7E1BBA433000786A653B9DD493748E11D3A4CB75820389B897876B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765719, "uuid": "ef7ef5b4-c805-473a-b744-92f63f12cb61", "value": "24576:nf/OIS76X/V4bI2f5+c/Mrw1avA+GlPBb9QVJdJV7oBL7e:nf2ImWsd+TdGyLV7Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623765719, "uuid": "9cee4a56-91bc-449a-ae7b-2784a91115b2", "value": 1359360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623765719, "uuid": "3d6b6d37-179b-4f70-9647-b16e80c4a918", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765719, "uuid": "3aac68d3-a1f8-4770-bcba-701a88124186", "value": "Citibank Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8474aec3-cda4-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623739204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739204, "uuid": "e61e04bc-fd02-436e-8dc7-9e46179218ab", "comment": "Malware payload (Quakbot)", "value": "ce0952650e415b22e940d348e36ff72d", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739204, "uuid": "30c23820-a5ce-4631-bed9-ebd21760c795", "comment": "Malware payload (Quakbot)", "value": "1fb4f0fb6c1b9f3d4227aa732d4c683f7a2089fe71d9535d403ccb9b7bd0f777", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739204, "uuid": "e333325a-3da1-48dd-a819-806a652d9d28", "comment": "Malware payload (Quakbot)", "value": "ee5cbe4a1a38fbd3623e94657311819143e9540e", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739204, "uuid": "53493a19-2d1f-418e-9c34-a3af5ee7e5ee", "comment": "Malware payload (Quakbot)", "value": "5a0f88aa79c792dea59d828118111a27b6b867a2de16d49634cf07b351c324e0bf2fc8ba4b51a25c9f94825047f7c1f8", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739204, "uuid": "e261eb98-4604-4b03-bd3d-0850f6af991f", "value": "3674127EE68169F8C3398D3EC640A1D48215E1D140A7B71D06DC391CAB533DBEB9E2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739204, "uuid": "e7556531-7010-4da9-a195-2aaa85853c46", "value": "6144:qRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNa:qRMmEv2Bc/nvm8IKABfsYOmauFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739204, "uuid": "d2d1f63e-2c5d-4915-b16f-ad9b687181c1", "value": 351561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739204, "uuid": "3557be76-cf5c-436f-bda6-fea372b7563e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739204, "uuid": "6ba3f94b-3260-4f3f-8e7e-511e459332cf", "value": "Rebate_1963763550_06142021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a90c00-cddb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623762728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762728, "uuid": "d80cac42-3c8e-4b06-8bd3-21138c844cc9", "comment": "Malware payload (Mirai)", "value": "559bcdc021b9593015b377c058e9ff1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762728, "uuid": "0b8d0a5f-4120-422d-8d80-a4e8f8570ad2", "comment": "Malware payload (Mirai)", "value": "1fc34eb182476d9c94fee20914ae72275349d8e4085c9e230441de412ada903c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762728, "uuid": "7a77222d-28be-4bcf-a524-dec00f3d3145", "comment": "Malware payload (Mirai)", "value": "48447d9b56a8e50ae7f12a50bc051be9009894d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762728, "uuid": "23d659b3-1f14-40dc-9ab8-ace67122173a", "comment": "Malware payload (Mirai)", "value": "8f093038bab212019545508b25ba095196afc78fa54c0f9832bc3fec9885cef8f658f2d45b1d2cf9e6f86730052433f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762728, "uuid": "07975387-eaf7-4e31-926b-d00fea9d5114", "value": "20D33B2174392F16D4E0A47E21BB8B41B1E23BCE16A4C54E7D760F4FFF21650A846EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762728, "uuid": "902b7d7d-5672-4a9a-9b6b-c11d2a7a430f", "value": "1536:bG9DCM18TSSGvO5OqsQCFlIsWfDbP8b7lF/Bs15l9m2q+IsT2iabSxvBqy9jFSD0:WDqmnuffDDSoxZ/12BlVmT93sj3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762728, "uuid": "cbed7e7d-0e91-478c-b363-47076aebbb34", "value": 132184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762728, "uuid": "3d2226d5-cc92-49c1-b712-e2273d5994bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762728, "uuid": "2f24607e-89c8-42c5-85ef-dc21ddc5acfc", "value": "559bcdc021b9593015b377c058e9ff1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad2f881-cdcc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623756502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756502, "uuid": "4b39aa1b-96b1-4365-97a0-6dffd0531ee2", "comment": "Malware payload (AgentTesla)", "value": "04c3d2eeb3ce81530d4611430003f339", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756502, "uuid": "55c1511f-a21d-4e95-a75d-0afec6580098", "comment": "Malware payload (AgentTesla)", "value": "225de92e4a01822b3595e2cc36644a8420af71b00f9fba1c38f2bf0b48fa843b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756502, "uuid": "fec0afd0-638f-4573-a420-bea5d3d02dab", "comment": "Malware payload (AgentTesla)", "value": "f797d36ee7ac2b92346b065ee9a0dd4b4c8b4b1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756502, "uuid": "2b888fc9-ca83-49cc-8e0b-f252ee10ad6a", "comment": "Malware payload (AgentTesla)", "value": "51607b234c04460cc32afdc832735225983685117a96c08fc3bc255ffe28aca15c01787c0174d00871fdf43472f1315e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756502, "uuid": "f8707188-4cbb-4710-a360-166627869999", "value": "3615AF575DCF57AFC6598CB69B30AC5682311CBA2609A3122DC234BDD93F1EECD9E012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756502, "uuid": "f13f459e-ed82-450b-bb83-7fbc805ce7a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756502, "uuid": "c5d98a8b-f460-4d4a-a2e1-604a0d60ce64", "value": "24576:ymzLHip19m9ICummg468Y2vYo+UjtlxXEWHs2uo:yahx46GQoPUWHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623756502, "uuid": "5cc418ce-060c-49c1-a47d-bae7e0707b97", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623756502, "uuid": "35c0310e-cf41-4eff-b302-d06a5da586ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756502, "uuid": "4df90dbe-0e11-43a0-8a07-3ff6d9f22a0f", "value": "AWB & Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b30b3f0-cd96-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623733229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733229, "uuid": "4532a8c6-31dc-4397-baee-3b38eaf02c02", "comment": "Malware payload (Formbook)", "value": "d93a6a467c317170fab6a2738e319632", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733229, "uuid": "7585838c-0202-4b1c-bc52-580bc8af1589", "comment": "Malware payload (Formbook)", "value": "23d6edcb2e937997404685d08ddbfe792fef0d5601aca303c1a80085803c9480", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733229, "uuid": "f0057647-d92f-429b-b3d8-029f645eebcf", "comment": "Malware payload (Formbook)", "value": "53307e2adbf5225cb4fbfb9dfcd49aabfb6dd01a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733229, "uuid": "dee35ab1-4e92-4396-b563-7569e58c6c12", "comment": "Malware payload (Formbook)", "value": "457e990691397bccf4e851db03f401a48c527c539fee0791b61942451906c610ae1b69e07d7518bf5a982314074392bd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733229, "uuid": "e793c9ac-c31b-42c9-8ac8-9bd0e6ebfdd2", "value": "39D4236D9E64573BEA609C82512F0D42D9FA331580F346D41F112FCA2296CAE8FE3F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733229, "uuid": "54fad0e1-5a88-4243-b178-7f5718034db0", "value": "12288:cY3c9V7MR3KjahngSLqASm1ZT6JVc0qtQE3h6ED0h220lvaP9kAX7DFuQD:ciqRycML+mLTkVwXx6ED20xaP9kAXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623733229, "uuid": "27e5c348-f4cf-4d8c-bf5f-0c6756f74140", "value": 656854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623733229, "uuid": "c012a5e4-f39f-4cca-ba8b-b7b53e903d14", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733229, "uuid": "3ced286f-a8bb-44b3-9cf8-2902b9cb8870", "value": "Order_896890.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d651f88a-cda5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623739771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739771, "uuid": "c08f0b20-740e-4a12-bcc7-bfacd54ff829", "comment": "Malware payload (AgentTesla)", "value": "a3125aa5f4fced4f922f6fa4e6e9f192", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739771, "uuid": "6e93fee4-b9c7-497a-87c1-bb8219b9fdae", "comment": "Malware payload (AgentTesla)", "value": "24c1f51ea28776ef33efaf3e5551af5f05b3a09b84ec7d05778f0905e5f7ce9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739771, "uuid": "8354659d-63a0-4362-b9cf-55f603d9ed0c", "comment": "Malware payload (AgentTesla)", "value": "ed8ead4f50e7cbff0e679114e854a92e36c3392b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739771, "uuid": "b44ecc62-e69d-4a72-8fc8-b771890f8246", "comment": "Malware payload (AgentTesla)", "value": "6343ab9a620004c6ecc62de631be1ae41876949ab2035bae05034acd5ac95cf4756594fffaf395405c144e9d4d5875a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739771, "uuid": "521e3496-aabd-45a1-a0b7-dcc1f2072eb7", "value": "0E255B8C7555EF9EF4778A3185549C20E513ACAF8627820BA313B77F6A3F3D38A141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739771, "uuid": "fc864659-ff0b-4d76-9d53-e5b754f2ee33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739771, "uuid": "6abd4b43-389c-4457-976e-daa099ee274b", "value": "12288:kB4H2Sag09VCZ6voYOlAe8qH6zdhIS2dHYeNMWODJRID3FE8/Fja75rF5Uo0lW6z:kBCGg4olAela12dHwWQJRuv65IFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739771, "uuid": "5326011c-7fe2-4563-a6cd-a859fa93c6e1", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739771, "uuid": "cbd6e828-4853-432b-93ae-668b485362c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739771, "uuid": "e76b2b47-92e7-45f7-9293-7d7bae09f475", "value": "SecuriteInfo.com.Trojan.YakbeexMSIL.ZZ4.4603.31227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d186e16-ce15-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623787591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787591, "uuid": "25642040-faff-4d5a-9355-dd6c20a16a93", "comment": "Malware payload (Mirai)", "value": "c6a13610b9e5436040311dfef1b7f8d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787591, "uuid": "8c541f47-10ff-478c-a0b8-34eb3eb1a590", "comment": "Malware payload (Mirai)", "value": "25e02dfa88c7dfe98a1e003c1e22c7f77ea9066ab93b7783efb18130f9f3dbd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787591, "uuid": "d530d813-d9fa-439c-bb00-316715fff37e", "comment": "Malware payload (Mirai)", "value": "cf2261520e7eeec655dcdb6167f62310cc07d80e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787591, "uuid": "d506d13e-e5e3-4213-9ff7-940a7f6424d0", "comment": "Malware payload (Mirai)", "value": "426333ea0741af35c187f016f9ef61e4fc81092044d695f821196f636a5a331f43706448db2ce7ef25b9fc2e1ca560bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787591, "uuid": "88c89aac-1219-42bd-b790-d54942ce76ec", "value": "86C2E0DFB48A79C5CD1C5CBC258D9AD116A9A2C3234BCF0837503ECCA57655EB89C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787591, "uuid": "2702d1c2-2572-4074-9a00-de45fc37b9ab", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBLu9WE:oCrJgHiOJrfwmQrctjur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623787591, "uuid": "fcaf5ef7-c1b1-45e7-90aa-83a6ac39b9dd", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623787591, "uuid": "6b1f1456-ee8f-4d3b-b659-0dd2b769b28b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787591, "uuid": "fc529274-a1b5-4911-811e-5c8c2ff8d116", "value": "c6a13610b9e5436040311dfef1b7f8d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe333a50-cdac-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623742844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742844, "uuid": "137ce73c-88b5-4211-afb4-166b0a39a178", "comment": "Malware payload (RedLineStealer)", "value": "abc3ac745670e04203cd4ae20a14a774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742844, "uuid": "c4d747ce-90c4-42a8-bbfd-5bc80ad1510f", "comment": "Malware payload (RedLineStealer)", "value": "261728fc1400289488ed7168916b8752a2633c638724cb1653f671568437545c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742844, "uuid": "ca538d44-b9a9-4d41-99d1-4ea8f9a2ac0d", "comment": "Malware payload (RedLineStealer)", "value": "44dd96a7d833579d769158c2294be21cc7da6b01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742844, "uuid": "f8ca79e7-a10f-46c9-a796-136b03d19030", "comment": "Malware payload (RedLineStealer)", "value": "a946ad56675defacae95f7a9ab667e8356b9444559adb4f47d66e73125a8131c2fe103da5481a1f287b30c8df58fcc68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742844, "uuid": "a7bac737-b6de-4694-b142-c779e600f442", "value": "C31633E279F985F3DA404031A68C7F3AA0EBC7540360ED9BF3706B0D4AAEC159517B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742844, "uuid": "1c175be4-2c2f-4bab-bcb3-4e8186d05f9e", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742844, "uuid": "dbfd4fa2-348c-4ad8-87ef-30a36543cbc6", "value": "98304:xDCvLUBsgd3Pg5z7et+BMZSkLZ1zTpyNxeZkBiRCc:x4LUCgBYRMtZ1zdA1iRCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623742844, "uuid": "4414a26d-89e8-4c04-a084-7bf750b94a06", "value": 4248575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623742844, "uuid": "e303d4b6-2c4a-4388-a9bc-009c719f3170", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742844, "uuid": "a43a45e3-7c86-4271-9557-70c321f2daec", "value": "abc3ac745670e04203cd4ae20a14a774.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5424007c-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736976, "uuid": "f62cecf6-c0ac-4376-8f55-a35d39549e6c", "comment": "Malware payload (IcedID)", "value": "e531966b9352420a0a7d0e271f362e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736976, "uuid": "d1d47d32-8d3c-48ce-84e5-13a6d75ced88", "comment": "Malware payload (IcedID)", "value": "2734b6bb45956f844c39ca9eddaa694e42227164f23d1a0bb4b978e1934a2162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736976, "uuid": "31deb39e-9fea-4fa8-af2c-c0b3e2272164", "comment": "Malware payload (IcedID)", "value": "6161d0a1dad86228855566e15e33ba415af20c0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736976, "uuid": "87842a69-52a5-4584-a4ce-4a4b972a0285", "comment": "Malware payload (IcedID)", "value": "e5ed56b661429e0af86676572b3ab83330113048d274189a74704f8580cbfce68070465d0e48e1e39f50532d72cd6409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736976, "uuid": "ff2b6f4a-c1fa-4e30-a811-dd590370d3b8", "value": "3EB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736976, "uuid": "93ad7634-4f74-4ea1-9f56-aec6db387673", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736976, "uuid": "802f6ba7-4e56-4b6f-988d-8c7266da85f5", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8Q:t082TLrbNGoVMjPR5DxDRoF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736976, "uuid": "cc3bc90b-8909-47a7-a4d4-8066bfae1750", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736976, "uuid": "d0339b3a-4e2c-4e41-b88e-7f29b0cc46fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736976, "uuid": "58efe595-268b-40e8-a3ca-738cd88ce480", "value": "2734b6bb45956f844c39ca9eddaa694e42227164f23d1a0bb4b978e1934a2162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b90e3d-cd75-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623719174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719174, "uuid": "4273214e-1703-40e2-90a5-e8025f2db338", "comment": "Malware payload", "value": "6790916fad4f73875682a0609b1e2f05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719174, "uuid": "a30f3b9b-7aaf-4529-a2fe-0b7bf4ee64cb", "comment": "Malware payload", "value": "280626c6a1b49b72197144e8b287544f316ffb82fbc6133c1cc51d4f77437660", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719174, "uuid": "f78d4e2d-dd6b-46e2-9747-0ab44d003699", "comment": "Malware payload", "value": "476a107fda4f09e656b602012639ff99672af1f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719174, "uuid": "436003c2-de3d-46a7-97d4-c27c6439dcd6", "comment": "Malware payload", "value": "939f363c8be94e24b1eab0ad908aaf8e2f44cc6b984b8bb5ca7136b9a4bb6f0decdb05d6bec526c82908f5c610f874ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719174, "uuid": "bbc5bc0b-dc52-422e-90ce-6a264fbe9732", "value": "C944F1A696C7A101D8854FF16DC18C6AB4FEE7900E3F19E778072D2FCD09A8FD612225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719174, "uuid": "d044a003-1ead-409c-97ed-4978c51b9094", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719174, "uuid": "31a93d6d-349b-46bc-8405-ceff9fbbcdb2", "value": "6144:aWNIO9/Wv5P15epIUQamGY7Pyx7cSd3iYUimW/U1:aWR8D5excmx735iNv6U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623719174, "uuid": "11bd06d3-4f2e-44d9-a67f-82e981d5a722", "value": 272368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623719174, "uuid": "5d027b96-061d-4482-8efa-7e99f7f78d55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719174, "uuid": "2860f252-75ce-405f-9dd4-ff4b6c80d01d", "value": "6790916fad4f73875682a0609b1e2f05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d38c4a9-cde4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623766519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766519, "uuid": "29a95df3-e821-4868-bc3b-a1de867b586d", "comment": "Malware payload (Mirai)", "value": "eda1e31865ad68f8f4606e928899b77e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766519, "uuid": "6a5c49be-b5c2-4b4c-8ed9-bb95771c720f", "comment": "Malware payload (Mirai)", "value": "2aedc2b26e8e67c745d3e2008645edd270f12b56d15530a1117c672e454f19a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766519, "uuid": "18e4a190-bee3-4397-840b-49e951991245", "comment": "Malware payload (Mirai)", "value": "a8446a278fff02354fb68eb8dd6e43b4596df597", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766519, "uuid": "4c01df43-90d3-4498-8533-cca355b5cdc2", "comment": "Malware payload (Mirai)", "value": "35b5002608b835bb65fc3ea15f08502f2ff3887cd3af237f2b03736109352d4859bbdb8c5e75cf86c1f40a1aa5401e64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766519, "uuid": "6a61f0c8-ef56-4812-a258-ab702bbef53d", "value": "57C33A45E68BF2F0DC4609B02057FF36593324B2233ACEB7EBE4BA636C916528459D5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766519, "uuid": "bbd176df-19d5-46b5-82ba-85731dbd2463", "value": "1536:1eNfpfRffBfdfweBf6SPfoXViOsI4Qi6r4s+KE93MqKoDfddnuDISP7Zwd25o+:Q9VfFhFFDoXViQ8s+RnPobjZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766519, "uuid": "47e05ba1-8229-41a4-8f33-8e0dac3c09c3", "value": 123612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766519, "uuid": "ebd88a68-d92f-418e-b876-9b851830328c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766519, "uuid": "64a9aa15-2c9e-4a70-9797-4290db72519d", "value": "eda1e31865ad68f8f4606e928899b77e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7aab48a-cdcb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623756040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756040, "uuid": "9023adcb-85ab-4353-9cd2-36a1c90b8005", "comment": "Malware payload", "value": "22f70cfa1db7eb72f09e64b26669974c", "object_relation": "md5", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756040, "uuid": "647d428c-ca42-4ed1-b857-755f095cc912", "comment": "Malware payload", "value": "2b281e7c739a368203eb9726253218f21f198097a5c1dc51aeb20e24439f99de", "object_relation": "sha256", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756040, "uuid": "43e7fefb-9ea8-414e-a5a5-90bb34087ea2", "comment": "Malware payload", "value": "941d9788c60290cf42a3c20fe9e750f57063e07b", "object_relation": "sha1", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756040, "uuid": "487c34d4-7e39-4db4-94ce-66203b341c5c", "comment": "Malware payload", "value": "9e8b4324bd4581bd292eca8107296cf5e828b83e16cbd23485a313e9642822e1d192df4cb2ace1f1b566d78e653fabf9", "object_relation": "sha3-384", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756040, "uuid": "cd018d94-d271-42ba-a66d-7fa8f1ee9635", "value": "3FF423601622187AD5E0B7364F0FC219E7F6683D85A2EEAEA5CC45D429CDD6C702D2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756040, "uuid": "df0d91ab-0bb4-4c03-9ebf-5e6b381d3bc2", "value": "e683988345840af6d99d27f0f11ec866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756040, "uuid": "14f18e7a-6fad-46c0-aa37-5f9376b7f9da", "value": "12288:Ll2toeRUiecd6CeAfq2lcBoyPLlA0E3WCiCvWvp20e5VXI:L8oeRUiZeAf5lQoyPLFPt20e3XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623756040, "uuid": "37ab0f24-a221-462c-bddf-bbd339f5197f", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623756040, "uuid": "43734db9-d14e-4ae4-b6fc-cb6d524a5a24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756040, "uuid": "b2df3413-4bfd-42c6-8914-b2ad0fc525fa", "value": "jg3_3uag.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb75122-cda7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623740349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740349, "uuid": "d7496141-4dfc-44ca-b1f8-e77c552c9e4f", "comment": "Malware payload (Formbook)", "value": "ce848c6c1433d66150ac8f0859ee844a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740349, "uuid": "0457c564-4ce8-4016-9c76-be71711eb658", "comment": "Malware payload (Formbook)", "value": "2cea4d259b54152c7e175ed0739e4c4c70050a49d07cacae4d9003032e7d9990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740349, "uuid": "87b4311b-f5bc-4257-89f0-2dc2b0983aa2", "comment": "Malware payload (Formbook)", "value": "bc3ef5c1e6b136456df7f2589e474b9fd0eae300", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740349, "uuid": "6d352876-268d-43f3-994c-49afd4e9ad9b", "comment": "Malware payload (Formbook)", "value": "9bf35f7e3ad2df71665a6a8e4d57fc8ff39594ac0392f84315bb5e0a464d52995e11d0dcc0978b3565c751db79e4fa66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740349, "uuid": "c0cc92a2-c2a5-4a66-a4ed-c088535c7b89", "value": "C4945B152BE9CF5BD0439B3539A2230A76FFAF753742B66FC2C0B991AC317A02751489", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740349, "uuid": "d18f8cdb-24d8-477c-aa88-143f741bacec", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740349, "uuid": "fc38ef4e-6706-4fb6-bd3b-809777628a4e", "value": "6144:HQqf4XvYN3nG4J/W/EBxxflz0mT/fVIgfrHyyJTDqjd+59h0zt:p4XvsJ8EumGQHHojdM9h0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623740349, "uuid": "bbd11852-05ad-4cda-bd94-c226afabfc6a", "value": 412958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623740349, "uuid": "96d57824-3907-499a-96dd-ff83221c4100", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740349, "uuid": "1ba95f78-e686-4605-be0d-6ddafbaf8743", "value": "Swift_Report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed8ce08-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623769474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769474, "uuid": "2e0e90b8-861f-4b95-87c4-efc618ab53e3", "comment": "Malware payload (SnakeKeylogger)", "value": "81e574188d421355570c54797a1b195f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769474, "uuid": "91da060e-9d3f-41a7-9a38-bb5812e01af8", "comment": "Malware payload (SnakeKeylogger)", "value": "2d42af7784e752c407280376756dd75a5aa2c7a08a565090c829050df72f4c93", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769474, "uuid": "5e96edd3-677f-4447-a3f7-da401f2e0e48", "comment": "Malware payload (SnakeKeylogger)", "value": "dc8aab2f363e6f7da6d4f079631242a585041f5b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769474, "uuid": "0b502ccc-e25d-487a-ae23-1945d3765b8b", "comment": "Malware payload (SnakeKeylogger)", "value": "ab8b00921ca8ad8e5f5bd16fed55745ea3e6224544e45dd149e2c3ee22d24c03c60ee8500d5a3c614fb2ddfb2dba1603", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769474, "uuid": "dbb5ee7b-d06e-4b4f-a49b-8cda7a7d706b", "value": "D6942347203C7A38692A5C74639439B8834C0554FCDB9047BFBBFA918B631F6564ACDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769474, "uuid": "fc029689-b195-4136-bc4d-09f1d4abb245", "value": "12288:sr62SMpc+zJWnCuMsigjebZ8GSn0twQKT:5PG9zJWCrgjed81iKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769474, "uuid": "096e8115-db90-4c8f-a26e-b11bab6cf8b6", "value": 442589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769474, "uuid": "d1ef1440-5795-4b11-9676-8a5ff3204cb7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769474, "uuid": "eafe4cea-05b6-4b7e-a5af-97b227615f7c", "value": "Original Invoice_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627c9bf0-cd8e-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623729698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623729698, "uuid": "8732682f-2614-4f50-befa-c9bee0fed5b7", "comment": "Malware payload (OskiStealer)", "value": "a57673cdd862db5fd8482eaeb3b9a606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623729698, "uuid": "312b6999-fca3-4d2b-aea7-5e72ff2e1a71", "comment": "Malware payload (OskiStealer)", "value": "2da08e5a86ad90f6727c65f81a523de70a45a8a04c35c50021378ab2e4f46e5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623729698, "uuid": "17accdc1-83e7-416e-a3b5-8ede96064ab7", "comment": "Malware payload (OskiStealer)", "value": "164ccd4c156e2ce59f2f1d1d27045f3a72ab8a3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623729698, "uuid": "c40e15b0-394d-46cb-85e6-4dc1b324a7b6", "comment": "Malware payload (OskiStealer)", "value": "7a92e0162aee68c31f09187c82a0f77876d9011c05f2e5b121dad16212a3627da4721333eb554a95cdba24020871e323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623729698, "uuid": "fb97a2f9-91d1-4162-9766-4507a36f5faa", "value": "51B4F16833991F93E4BE06F681F12B551765C16BD34ED30E6D8D19F80C99BCB8A0B18B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623729698, "uuid": "9fa631cd-ee3f-43e6-8943-6034bd9072cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623729698, "uuid": "24b3ede6-0a09-43b4-b035-643f8c6165d4", "value": "12288:DUbxdYqn8IME0/lcbnKsn9RjkvqXzntevcK5QmSRXDUpreTN:nY8I4lAKqPgJvcBmQXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623729698, "uuid": "16c29aa9-58fc-4124-8ab2-990df6db8622", "value": 531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623729698, "uuid": "c1d56f7c-f155-4acf-9246-bbb8e24b25e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623729698, "uuid": "0bc17e33-b39e-487f-8f47-0b4ad48faf57", "value": "a57673cdd862db5fd8482eaeb3b9a606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f238f16b-cdc3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623752703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752703, "uuid": "75c0beb7-d770-4c73-b1cd-ece19bf8a948", "comment": "Malware payload (SnakeKeylogger)", "value": "f1b0866ff4bc213ba2b6d7e4cb7b2a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752703, "uuid": "58fe916e-9ffb-4da3-b7d7-960752c32e07", "comment": "Malware payload (SnakeKeylogger)", "value": "2e826b4ff8b272db629c4983e9edd53656cc4a2e9d24178ebd2b6a8890d1e864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752703, "uuid": "65657a29-806c-4966-9519-7643c10f73db", "comment": "Malware payload (SnakeKeylogger)", "value": "a83bb812d37903ee097e86a382c4a8a67308b02f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752703, "uuid": "3c969595-5029-4765-9df1-25227cf7cb06", "comment": "Malware payload (SnakeKeylogger)", "value": "b79e7c2c0ee8ff93b50f8d0a73ef97213ec92b02811960ce8d9fa26b88fece97ab4a762b8731bba878c69c52a9471808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752703, "uuid": "12be2cad-a0a8-459e-80ad-917f8c41812e", "value": "A405BF527E98AA98E4F95B70BDF0431603F77D127B27D3CDAE84B1CA2473E808625356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752703, "uuid": "558d1ac8-1144-441f-ae17-24e35e7017c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752703, "uuid": "1f9bb7f5-fb42-4eb7-b0cb-208afd9de999", "value": "12288:ucP09MurXvFmWZfkN++Yrh8z7BqItaRbIMxOhemAX6wZPCfGnX69vquwaHpHavA:uwzDCIMUhemAMfGnXUquPHpHavA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752703, "uuid": "6bb33044-8bc8-44c4-a621-a5100289799b", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752703, "uuid": "e443f1dd-0f0c-41ea-bf9d-62e3249f464e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752703, "uuid": "b017e0ba-4a6a-4e3c-8fde-8b45a43a7827", "value": "Yeni sipari\u015f _WJO-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0252dde7-cdd2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623758743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758743, "uuid": "49e72443-c5c8-49db-8a8c-e5592e0689df", "comment": "Malware payload (RedLineStealer)", "value": "8e5a68bdf8f6de79798ad15a59bc1126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758743, "uuid": "79d92c41-297a-4f2a-bae2-fd3501e77535", "comment": "Malware payload (RedLineStealer)", "value": "2edde91a2015d578bee82583d6e89a49f9f17fbc6ff8d51771f08a9419a7ea93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758743, "uuid": "88af0c9b-df6e-45dc-ba94-1975d95720c2", "comment": "Malware payload (RedLineStealer)", "value": "5d79c26df9e53206f1945940a54beb86db78e906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758743, "uuid": "3f075d6f-5c79-4839-bea6-2eca4ed2272c", "comment": "Malware payload (RedLineStealer)", "value": "1b132b4f2578f5b976f03743aef06e0118c54cf57192bb4df5b064b936530504bafff74b81bb67d00e19a7b8c91c7a9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758743, "uuid": "359c6710-7dd1-4eaf-bad5-0e2d66956441", "value": "9674BE10B790C038F4B712F85AB553F9A93D7AB0AB3490CB12D62AEE56346E0EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758743, "uuid": "7a09bc7c-a872-4095-aea3-0714ba4f6c89", "value": "f8b8681fdae7ff6c00298505c40cf976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758743, "uuid": "67541a12-7f6a-4c73-857d-5838530ba6f0", "value": "6144:vvxHRZHTGr9sYMF++aCbteC/ChP5E6LiDot0jxL:vvxHRlGr9tKtelhP5E6LiDYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623758743, "uuid": "72536070-c376-43c9-9606-8dc64837f1d1", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623758743, "uuid": "15c05b8a-b214-4dd9-bba9-673d45a74ea2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758743, "uuid": "fa89189d-436d-4bde-8c57-897caf05a618", "value": "8e5a68bdf8f6de79798ad15a59bc1126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d76c1cd-cdf8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623775109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623775109, "uuid": "e173d67c-2ccb-4a33-8649-ddd04b9d728f", "comment": "Malware payload (RedLineStealer)", "value": "a4f1f7fe9de324bf060f44976d1e0d17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623775109, "uuid": "148ec077-d9f9-489e-86fa-d7f0c233c50c", "comment": "Malware payload (RedLineStealer)", "value": "2fb6bf1f605b4441037e7870f0060ad5e5bdcfd9b8ad065a42dc953be5c8d321", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623775109, "uuid": "82dcec43-8ee7-426a-8c46-fc16b2ad721b", "comment": "Malware payload (RedLineStealer)", "value": "1d215ea2639e67ef10a03660e00d7527deefe19e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623775109, "uuid": "c7e90617-e313-453a-918b-2a90172cf2e0", "comment": "Malware payload (RedLineStealer)", "value": "addf53c2a361b9d8ee4437a2215f258482bf0b6d81a55ed47593dd2bf4797e054e84c2fb93757e0591a12948e69b9cca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623775109, "uuid": "87441ccf-6473-4eee-aaa5-68291eea3a36", "value": "8974BE11B7A0C038F4B622F45A7593B9A52E7EB06B6490CF53D626EE5734AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623775109, "uuid": "f8aba761-c209-4ae2-9d6a-3ec259b3bdaa", "value": "b0d3854c557fd79a46b820c312bd2709", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623775109, "uuid": "6bafa88a-58f9-401b-833d-e36c3fe5000a", "value": "6144:PIXuxqHbApdbj/WCrrPY22E0QHYW5n+RZKXpuLVRB:PIXuxwApdbj/BPQ22E0anUZwp6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623775109, "uuid": "78985499-d8b8-46e0-8a5a-3c07eb2e29cd", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623775109, "uuid": "332eb739-3af1-4cd9-8120-80f78b58ba98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623775109, "uuid": "fe60f2d0-0b41-4270-8b8a-6ca3838d21a4", "value": "a4f1f7fe9de324bf060f44976d1e0d17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70965468-cde3-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1623766229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766229, "uuid": "10401710-2cbd-4395-86ba-496f2598bc99", "comment": "Malware payload (TeamBot)", "value": "9dd6eb5f40cce36e7c62887d09f8e5fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766229, "uuid": "5c924300-0474-42e6-a37a-220310a7e589", "comment": "Malware payload (TeamBot)", "value": "3147ac2cd69440350f3c27e38abbbd55056cd34cf07d2e4d4f0c24d40ac899df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766229, "uuid": "2847afa9-7939-4d5e-b87b-0147710e0394", "comment": "Malware payload (TeamBot)", "value": "93ad6a5ac699a218fdaced05c6daf53dc7525909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766229, "uuid": "f85d9947-c8f2-4628-90a6-00603ed25c7f", "comment": "Malware payload (TeamBot)", "value": "7415b4238e17fd7c9a970e97ccd6a6acb112e06fda9bceaba0125837d8bc09ea90afe186c47952509bbd408740832ada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766229, "uuid": "bffff89f-a4f9-426c-a91c-4febef7c94a5", "value": "D4050100A7A0C039F0FA62F966AAD3AD912D7DA15B7490CF52D657FD4738AE0AC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766229, "uuid": "0ac303ee-575f-4588-adaa-6dcab55f9113", "value": "709d5c7631204ea8a49d3c234309fc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766229, "uuid": "e406a091-8d02-406c-b765-8fc527f3a5d8", "value": "12288:jO//r2Mqwmym6FTu4R2jKHVhYbpQg9HkwLsRRavCOiJM6d5Yf2j67NDwtA2e9g+U:j0yfapuo2jK1h2OoCJbdw2O7Jwx8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766229, "uuid": "5862a5bf-c426-4e32-85c3-3025af096620", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766229, "uuid": "b8a09dd7-29a2-49e7-a595-6399896466a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766229, "uuid": "9829ea24-3939-44a0-824b-32ed2fc32a7a", "value": "9dd6eb5f40cce36e7c62887d09f8e5fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3380bfed-cdce-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623757107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757107, "uuid": "14aae783-4366-42f9-b987-e7add51cefbc", "comment": "Malware payload (SnakeKeylogger)", "value": "a0651bbafee30d2bca32db857a02fee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757107, "uuid": "d1b594cd-6899-4c3f-a6b6-aabb831c4d96", "comment": "Malware payload (SnakeKeylogger)", "value": "31f7d71ca24fbde43953ebf5e0518c065b795cef8e7b021ca7fbf31a06ce9348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757107, "uuid": "700782ec-0152-4260-ade2-402551fc3fd4", "comment": "Malware payload (SnakeKeylogger)", "value": "d870c2552fbb95b3450288b6587f8f4152a41fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757107, "uuid": "f8905595-3aba-41b4-9bd3-2bc5cd41dbbe", "comment": "Malware payload (SnakeKeylogger)", "value": "3dd60735982d6af8fd482883ab89a0ea2397a150af73ee35486771f719729adf4f87e9335ea299b656dc52bd8af57f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757107, "uuid": "96f6b2c8-9397-448b-b516-b9360a1e2785", "value": "5805BE416E98AB99F0F95B30BDE0931203F77D227B27D7CD6E8475CE2967E808626341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757107, "uuid": "07efb087-38fb-4d1f-be77-f2426752434f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757107, "uuid": "f92e61f8-b635-4db8-8b9f-dd850fcd1fd4", "value": "24576:RwpaH51M4h8aCyJw3lSNEVaMquPHpga5T:RgU1M4yh+wYN6ca5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623757107, "uuid": "f58960da-24ea-410f-8e2f-bc481aff2901", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623757107, "uuid": "f6b6ad95-6e81-4715-b850-ed573c9834c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757107, "uuid": "8e15ebcd-eba2-41d3-a4c4-9caefb30ce06", "value": "Swift Copy Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3df5cd-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623769364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769364, "uuid": "f977d2fa-1cb1-47db-b511-c90e79f8d94c", "comment": "Malware payload (AgentTesla)", "value": "24e35c5fe0b3890cc9d7c4f228952b26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769364, "uuid": "39416b58-5e21-4ae9-9702-50063f0c5d02", "comment": "Malware payload (AgentTesla)", "value": "32a41492aa8859d234b0e85b9bb65e408991ed00a859bf78f154274770451c6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769364, "uuid": "ecb73a1c-d049-4dbe-8cbe-271980c3450e", "comment": "Malware payload (AgentTesla)", "value": "908fce982e43e8288a9c5476009dd2bfa084984c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769364, "uuid": "7d496d68-8fe3-4555-9f4e-98c381c17124", "comment": "Malware payload (AgentTesla)", "value": "978026e1f074ad4003e9f4d737746ec7f41a2fc0342c62d95f2bf81d3e39e8493e3c8adb0d22ba558ef9eb3a575f95eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769364, "uuid": "608d555c-f7fb-4bc3-80f0-2f679210bc1d", "value": "B2D4334F73201423CE63AC4250666EA7BF1A6CBE4AB7839D56C55484EF6234308B58FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769364, "uuid": "2411334a-837f-44a0-a6e7-edc42a13a294", "value": "12288:NH++hEUHPIfUlhA6Ykx+HhfPs2Wsgb8ZMVqNklxZ2VRL:x+QEUgfUPA6Jxmh3UcMVqSlxZ2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769364, "uuid": "b0d1ac89-2b2b-4bf4-81f3-4191d42bf958", "value": 624648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769364, "uuid": "2e34be4b-3d18-4073-8272-f19d6795f979", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769364, "uuid": "81993df4-7278-40f0-b916-93d9b00a0b14", "value": "#3120334.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af250ad3-cdbf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623750872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750872, "uuid": "33add09c-8305-4dc5-8d70-bf16e7f7ebac", "comment": "Malware payload (AgentTesla)", "value": "3d52c8d770932cd1d84edfc3b9655b22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750872, "uuid": "53ef9bb3-1397-49f6-bbef-f8462905bfc3", "comment": "Malware payload (AgentTesla)", "value": "3343bd70c5e77d6b6f18db8b8f9b42e65c3f89d6e0ef88cfbf8d50d8c8132be4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750872, "uuid": "6df1e91e-fdb2-4df2-a29d-56c43d1d352b", "comment": "Malware payload (AgentTesla)", "value": "122f0617b51689d985d2aec3bb0a609c630b53c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750872, "uuid": "546ab81b-65a6-4d89-b097-f5c3642066be", "comment": "Malware payload (AgentTesla)", "value": "6c64d1c8d9950ee80245fa83771bc7483ad0650f2722bea01c9480cc85a79dd33a017d37e3f211d46414ecb5d3f616be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750872, "uuid": "64ec0b36-0402-47c8-a714-b1cf371a49f9", "value": "71256B8C7655FADEE4378A3189549C20E613ACAF5717D20FA213B27F5A3E2D38E141B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750872, "uuid": "5555e6f1-6076-4296-bb97-44b8af1ab27b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750872, "uuid": "613b8feb-8795-4dea-a925-54ee0e73f63b", "value": "12288:aRFGg9VCZ6vQr+212iXWD4w8ctVhV3bc1RlRar13VNKkDWWq4VXxgXZnrfhhKag3:aRFad12EWMwdtVhVslIfDeg+ryW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623750872, "uuid": "75440393-448c-49b3-ba4c-59a8f83b9531", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623750872, "uuid": "f5ddbd7a-583e-417d-89f1-9472376390a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750872, "uuid": "6d9ec680-7206-4288-b20d-4a9381428faf", "value": "3d52c8d770932cd1d84edfc3b9655b22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4f3a7a-cd90-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623730409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623730409, "uuid": "f97fcdbd-0095-4ae5-b3f6-936866ea47d4", "comment": "Malware payload (Quakbot)", "value": "83edd795222d06de2d12b38948d576d0", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623730409, "uuid": "32ac9ed9-02eb-4602-a064-656be602edc6", "comment": "Malware payload (Quakbot)", "value": "3383043324b755aaec94475fcfe467e9f13ff5b5df14ec88f18c6a0cc0796bbd", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623730409, "uuid": "ddb82031-9c1c-47d9-a591-8c7d017b80bb", "comment": "Malware payload (Quakbot)", "value": "4534664db6bb1ed36deb3c984fdd5fd0dc0f5523", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623730409, "uuid": "87f37bb1-bcb7-456b-bef3-98896a56d73f", "comment": "Malware payload (Quakbot)", "value": "e798ef79b282e7f405b77f54d6a6f037d26abff12b25eee3dffbeb4566a7619f3390a24d879f66574b14c874a9e352f4", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623730409, "uuid": "4fd5234c-3af0-4975-ac52-f4ee03238d76", "value": "7074127EE68169F8C3398D3EC640A1D48215E1D140A7B71D06DC391CAB533DBEB9E2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623730409, "uuid": "9aebe57b-ab30-4a71-ad79-c78e228d111f", "value": "6144:ORMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNa:ORMmEv2Bc/nvm8IKABfsYOmauFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623730409, "uuid": "088f0c1f-1a5d-4e44-97c5-a9c1a6f598b4", "value": 351561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623730409, "uuid": "e33aee9a-9ca0-42b9-9e0e-c5d66ec6fc95", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623730409, "uuid": "d51b32ee-1daf-4c62-a0a4-c1a738e6e992", "value": "Rebate_234359500_06142021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0a88c6-cdd8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623761690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761690, "uuid": "2700d69c-11c7-4bb1-8074-09534ebd5c5f", "comment": "Malware payload (AgentTesla)", "value": "d30e5c313e04edcc1321bfd7796d2cc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761690, "uuid": "c35c3cd3-7c5b-4d1d-8e92-7357411c0630", "comment": "Malware payload (AgentTesla)", "value": "33f876673f95a241651fa65cdd841403444db462314f5de6ed7a760807b083e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761690, "uuid": "e54718a5-baae-4ddf-901f-803c88b630bd", "comment": "Malware payload (AgentTesla)", "value": "250a264f1f688caf65ecd62b04ee368844473b1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761690, "uuid": "aba7c785-ec66-4dea-9587-7349241a4c38", "comment": "Malware payload (AgentTesla)", "value": "ee2d47d586a14d20dda24ee958271f76ce92d145f306cd014f2945080eae3576f1ee1350569427b60a090858a3f44163", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761690, "uuid": "47556243-28ee-4eb1-ab23-02f2127cd741", "value": "9C055CA1F2882DA5E52A13794C375D2021A7BEAD9574C619386E7F2A7F733433072D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761690, "uuid": "a98acff3-c2e9-4b6d-b103-1c9bcb7364c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761690, "uuid": "f4a0c7c0-5ea4-452c-9045-ccd9859d2093", "value": "6144:7QyKM2RG+zcwxOVbcEkXWSCc0KDjryoiRWdT0UlWhfSH0dzzHoTrAfNYcrNFp:M7M4GSYbcbW3KDjWoiRvUeSWB2KF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761690, "uuid": "f471f898-2a61-41b2-b8c6-40b8f12a6a1e", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761690, "uuid": "f8e776a0-215a-47c0-a634-f134d8c7fcb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761690, "uuid": "107f4434-2384-40d8-b4eb-1fc543252ccd", "value": "New Order 171-702629-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1376232-cdb7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623747520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623747520, "uuid": "fc49d8e4-3185-492f-bb83-920672cfabec", "comment": "Malware payload (AgentTesla)", "value": "fe5d039de5e9cd4fc062f821bc706d35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623747520, "uuid": "ab655a52-bbb2-494a-872a-eb44a0e62641", "comment": "Malware payload (AgentTesla)", "value": "34886616b6b5c7af447671106cfc9dc4d28a52647e5b208eef8d1aa0a7f78549", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623747520, "uuid": "a457ba34-efd3-458d-bd25-adb443228547", "comment": "Malware payload (AgentTesla)", "value": "4d57f3d57d6463aaaf9a3d881b30649e5afda0f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623747520, "uuid": "feb043f3-9be1-465f-adfb-47da41d8492b", "comment": "Malware payload (AgentTesla)", "value": "8a1234cf832c3bf8204777fb76a031540c1c30f80fbf25f5473bbf36a3c33489bea7d9b69422b4f653c9dfb08eeff586", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623747520, "uuid": "7c903e8c-fc9e-41ac-b3ec-1217a1b60803", "value": "C925CF134ECF826AD2B44DB56B31AC47C1325DAA254873213EC075ADD93B6EED8EF502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623747520, "uuid": "799297cc-f392-48d6-9c8c-76c20cd37792", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623747520, "uuid": "d7e9b931-6ceb-4207-8179-66a2d82dd4d9", "value": "12288:B92SMPQipP5AH3+ba8X0ICh/sP+OXDiZtr+ERAnY93K4FZbcwpIV6Vfg+C:pipi3+j2W+Ztr+gAB4FZbvPVg+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623747520, "uuid": "0375684f-2598-4b24-a7a7-6eac882a6e16", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623747520, "uuid": "44c5f17a-6867-4263-8004-f2ff1c92a5eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623747520, "uuid": "ba032b78-30e8-454c-a2d1-6722eb507196", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dee53d3-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736965, "uuid": "4c4b92f8-559d-461d-ac41-ae115d9dd7dc", "comment": "Malware payload (IcedID)", "value": "227c5e30c509803e9805095968e4c220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736965, "uuid": "be1a1d69-e730-4758-8047-9ee89cf393d6", "comment": "Malware payload (IcedID)", "value": "356a5800cc984ae2ecd24b21bbcb245ccf5e60534c76b7013359547dad274f63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736965, "uuid": "5e9deeae-f43a-40dd-b935-2ddf557ccaae", "comment": "Malware payload (IcedID)", "value": "9177bbbc2d01c1b4efeff090e5d6bdd6e1438496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736965, "uuid": "baaf2826-21d3-455a-b3f5-8f1ce6d45bd8", "comment": "Malware payload (IcedID)", "value": "e854fea7fb42a489ddb04105f0a317bee4dbf342bb1cf9fcdc4ec5f1976caf3194b12e50cbde509b5ecbe4041e165d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736965, "uuid": "6658d4aa-8ae8-4393-a0d0-c51eba8f00db", "value": "1AB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736965, "uuid": "25d2cf48-708d-4bb4-93ba-1cc6dac703d0", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736965, "uuid": "ab4ff00b-5fd0-44c8-bc46-dea06490464a", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8v:t082TLrbNGoVMjPR5DxDRoFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736965, "uuid": "22becfc4-5cd6-41fc-83a1-d92e79feea9b", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736965, "uuid": "09466f4d-1b38-4855-9d14-8383ef827705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736965, "uuid": "8e46f5a5-a1df-4a96-8782-5e311f7ae210", "value": "356a5800cc984ae2ecd24b21bbcb245ccf5e60534c76b7013359547dad274f63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a333c84-cdbd-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1623749763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749763, "uuid": "bdd4c4f5-18c4-4438-92e8-c68427219fd2", "comment": "Malware payload (Dridex)", "value": "d65c8d73d13ed5d4f2973631101c4b34", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749763, "uuid": "77ed199a-d10c-4977-ac1a-777ef7edc9a4", "comment": "Malware payload (Dridex)", "value": "35f32786d4cef03729a8702bee05910c8cb7682cf6b2370f911d437ad0df1644", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749763, "uuid": "e4c354a5-3b73-4b8b-95a1-01aa5c6ebf8a", "comment": "Malware payload (Dridex)", "value": "7edc23db25c3773cae51b2f94affdd1cbc2fcdfc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749763, "uuid": "467fe51b-2fa1-42b1-b8cf-52f909eae41b", "comment": "Malware payload (Dridex)", "value": "43b08b50a2e18e6dcc1bb1e520c3d05e5ad5cb8c65639dd824b5e58b962e6e0f8eb02d16ebcd23afd0b914e895fc65ac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749763, "uuid": "51e3b46f-bde3-4778-845d-8655f8d26105", "value": "A505F163FB648627C45903361D5297922779FCA58F3B2207B2E4370E4E3A7E8D963712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749763, "uuid": "548167c6-272a-4ce5-86a1-91fa8616fec0", "value": "24576:TiOvq0l6lWl5lhYJ+elPxB0jE0JvoX92FR1TkNKbQ:tzl6lWl5lhKhlPxmjDmEmNKbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623749763, "uuid": "890d76fa-8243-496f-b08d-74a0530e8ff8", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623749763, "uuid": "b32d811c-5bd9-49ba-a332-3e86b1e50550", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749763, "uuid": "e6b22493-b0a4-45f5-b6eb-0f1ddd6e77a7", "value": "d65c8d73d13ed5d4f2973631101c4b34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08df5952-cdec-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623769920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769920, "uuid": "058cc957-113c-4bae-8543-dd98e9532b23", "comment": "Malware payload", "value": "e62c3abba5d3c5d4dda25ffd6934bbac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769920, "uuid": "bb512731-377d-4ed2-98a3-a2902873d489", "comment": "Malware payload", "value": "360aa7350fa68fbe5ee11dea4c0291a23fa65fce3fb8ce37a0649e5e86d26cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769920, "uuid": "dbf5e4ab-ec64-4846-911a-a381dead6cf3", "comment": "Malware payload", "value": "c1efb5a87659f595f9ba955c94901e7855d67ac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769920, "uuid": "2bd72e8e-c8c6-4338-a40f-f02b71fde570", "comment": "Malware payload", "value": "1cf4e11cb4ddfe2a5bd4aab2c6746b44d489d7958e8e4db6cc8cb70fa64c42b4af7eebd500e468618dd5742845a5f7c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769920, "uuid": "0b9ef490-d50b-470d-9b82-0734312180a3", "value": "E96412A615E528EBE1A70B7064B6CBABC2F37D512BA5099F135D7FB932301D342432D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769920, "uuid": "3683a3a2-d18c-4a6a-8575-49f8d972b507", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769920, "uuid": "392e63b0-ff11-4410-843a-2b83b92d7670", "value": "6144:eQqTdw+YC3Y0SeL8uCoMwnt7V74S9VG580kjcxZfsM893Zr7f8fzzBt:Ed80SeL8N8xF9jjIsMir7fyzzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769920, "uuid": "ee51bd7f-9880-4257-98ff-c9406c596b87", "value": 323017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769920, "uuid": "1ca6f142-65b8-4581-bce3-fd03de683988", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769920, "uuid": "76de7da1-dd14-4843-862f-bd5d4e54eee6", "value": "LCdraft6152021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c23dad0-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623736237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736237, "uuid": "751bec49-d220-4df6-b1e8-b3ac68a2e79c", "comment": "Malware payload (Formbook)", "value": "b84149ea0796e2fda1dd0f9c43fc425b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736237, "uuid": "1e421618-fc16-4c7c-ace1-08b0d7755654", "comment": "Malware payload (Formbook)", "value": "360f7adfb84151a958c2ab27dde89e01e84ceffd431864602fbba7120c8be990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736237, "uuid": "0c8ecab7-6223-49c9-93ad-5c0340b0c2a3", "comment": "Malware payload (Formbook)", "value": "daf1111c87744eb6beb82eec44b96c1289df569a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736237, "uuid": "d8c72ba2-ace1-49f3-af8b-4481df8e02af", "comment": "Malware payload (Formbook)", "value": "29a667d797c8b3394c34a5a76bd66d02547acb53bc7df7211e5c03fabb0630cc909081347fd835d4de9d6cc54c827087", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736237, "uuid": "274479c6-06b2-4453-8f2c-687c5be94cf3", "value": "41C4D03AB78467B6E2294F3AC263059853F18217B232F76F68D425D5CE00B8D5B2F593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736237, "uuid": "695e7184-f95f-4f9b-ba8e-0627ce42fc45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736237, "uuid": "c561fa76-0f71-4a72-8b0a-58b0d25e9972", "value": "12288:oDtHzdkFM4GSYbcbMLQysPAIBWrR2b+mV:STdEM4EKlBW1/mV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736237, "uuid": "47dcfd56-5946-498c-8316-64b546233ead", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736237, "uuid": "fcb29c8f-4c5f-47a6-ad90-a6609315abb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736237, "uuid": "173e42a0-a511-4010-bfd1-d7a37c331d7b", "value": "#10923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da719ae-cdd3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623759352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759352, "uuid": "80504f8f-5cd7-4b20-9ff3-45af21f1eadd", "comment": "Malware payload (RedLineStealer)", "value": "f7bd49ac1e676db8c9f2e3bbd5b03a75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759352, "uuid": "d3403f9a-5232-4778-8530-cf9df07a88cc", "comment": "Malware payload (RedLineStealer)", "value": "365fd289daa60e68b54237aaec835baaf8e2cab5050c7982d2cf6dd7061842d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759352, "uuid": "e465bfa5-d235-4748-a7cc-6b9632e37a41", "comment": "Malware payload (RedLineStealer)", "value": "a2d06aa70438fe18ced421b2f629ad45a38a20bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759352, "uuid": "344375bc-ea91-4278-990b-ec5867edc7c1", "comment": "Malware payload (RedLineStealer)", "value": "9ef1369f79d00c2418f258f48c36afaa752a3478ddb4ecc308f9284e0371bbc5c2051d04ffb8687d722fff77f1675e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759352, "uuid": "0c428d10-80c7-4ea9-8132-3c65835c95be", "value": "9974BE10A7A0C034F5B326F45AB693B5E53E79B0AB3890CF52D52AEE56346E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759352, "uuid": "6ec0e684-501f-4880-b030-9450a0831d83", "value": "709d5c7631204ea8a49d3c234309fc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759352, "uuid": "61c57136-dfca-458b-883e-5f61aca94e07", "value": "6144:Fhq4TR5nDgwzs0Km6oeRrDPBQmKIvAAH1BVrUEgOUC+U:FhqIR1gw5KmyBQFIoAVYEDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623759352, "uuid": "86f2a2b1-15a7-4b8a-a9d8-df2661b44e22", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623759352, "uuid": "03a31c46-e288-4bc9-ba36-8513a415f9f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759352, "uuid": "87a0a678-79ac-44b8-b5f8-e89df88da017", "value": "f7bd49ac1e676db8c9f2e3bbd5b03a75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efd0963-cdfc-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623777044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777044, "uuid": "237ba9df-753a-4272-92e7-4e1de83323cd", "comment": "Malware payload (CryptBot)", "value": "e875325f940b5ccb3c5e592fb4a286cf", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777044, "uuid": "31338a68-2c59-4330-9a55-bb3b1a93a128", "comment": "Malware payload (CryptBot)", "value": "36b09f53de4010616ddd1a8f4cbb9b1a1e87b655b10b406653380b77324956c7", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777044, "uuid": "270e8380-f13f-4c67-9372-1c573d20f051", "comment": "Malware payload (CryptBot)", "value": "9e3c420ca17ce5bd5b88b85dc3aca7b207c6e503", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777044, "uuid": "fe8c63cd-0155-42b3-8a08-7440f1b979ac", "comment": "Malware payload (CryptBot)", "value": "830887edab93093003871fd64c2263d05703eada3dc46030aee606655406928e3d218c7abe5b3069000c57566ca1e984", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777044, "uuid": "7dd96b7a-6a3c-426f-91c5-b4b8b6c79fa0", "value": "F2F4011077A2C039F4B222F84575A368A53D7EB29B3C95CB62D317ED57A46E0AC31B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777044, "uuid": "243e9db1-2d10-4518-9c92-0f1926abd6ae", "value": "f8b8681fdae7ff6c00298505c40cf976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777044, "uuid": "d2c7c252-34cc-489f-ad63-dc70e4a7ce83", "value": "12288:lMgFe03vo2O4JGhHfpKifIeZW9ugTfgdKQ/S3ta6c7PL4Ovq7tjeO2:l9Pg2OZHgifIeiugdAnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623777044, "uuid": "ed57e10c-a200-4450-9d63-35ba1d612ab3", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623777044, "uuid": "3d1228ad-8412-4011-8f08-e91a4f76dfb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777044, "uuid": "0130d246-2133-4f97-98b1-96d5e4ce5927", "value": "36b09f53de4010616ddd1a8f4cbb9b1a1e87b655b10b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df9dde1-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623736214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736214, "uuid": "9f9743a3-500f-4f9a-955c-763971911b47", "comment": "Malware payload (Formbook)", "value": "f0400b8eeaaf66d4baae0c682d3a16a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736214, "uuid": "99e35772-f80a-4a46-8331-6b7f92f8e2a8", "comment": "Malware payload (Formbook)", "value": "36f34d118ee0769d818d0cdb9b7562262e23233f97fd78c9280e8d5a7c390636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736214, "uuid": "3c0e8f57-4945-41b2-988b-11080f2071ba", "comment": "Malware payload (Formbook)", "value": "db9e8fc6765e44c47a3a693a1d52c853e5ac5c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736214, "uuid": "6feffc9f-aba5-4bca-b442-303bc810ac05", "comment": "Malware payload (Formbook)", "value": "6f15c773d075a0b814534187b19a7fbb99a1f407d913c457fd3933ac72e76ab623db0eacbbb39372e2c91303ca375d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736214, "uuid": "76585698-1805-4006-9cac-16c00b63046a", "value": "FAE46D5E92808C72ED372AFD8C1AA690583E7D813A64DC8E26B87D493F757D4391C18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736214, "uuid": "0fcfe875-764c-4cd3-952f-5da2c68995f4", "value": "a66cda4dbc02db195dcaedc912db7cdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736214, "uuid": "b02227d7-d5c7-4c7e-b4cc-a8b6ca972806", "value": "12288:890ywyQxFTkWyDA0eOlzgnD34mG2qX0uNb+T0HXX+jBnnXLVgKR3/E:8iPPTkbY/D302q/XQB/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736214, "uuid": "87974730-3e4d-4109-896f-f434ded9551d", "value": 667800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736214, "uuid": "5813eaad-c737-490f-9d68-a3bf6eadac14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736214, "uuid": "3bbf0bf0-8a34-4d9a-92cb-22b983ccb6cf", "value": "DHL_SHIPMENT_NOTICE#6142020_Signed_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf47f61-ce04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623780611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780611, "uuid": "5626b6ba-1bed-4a96-8dc7-8f52d77e0d65", "comment": "Malware payload (Mirai)", "value": "13c93b923627b5f93559fdeec70340a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780611, "uuid": "8aeeff27-b2d2-4345-abdc-570a852e40f1", "comment": "Malware payload (Mirai)", "value": "37406f594b7490438781fd7d1d79f09f3046600ad62551cb4bf95549f37ee3d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780611, "uuid": "273eef94-da25-4c99-ae5f-ad7fc01b31ad", "comment": "Malware payload (Mirai)", "value": "164bbc14fad6a1fd51406de22ef20acac49c852a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780611, "uuid": "2076eb5c-7bac-4a9d-b029-fd8da7c6d242", "comment": "Malware payload (Mirai)", "value": "26d1372949bf46ea93d81eba7b02a7f5c6a0fcaee143328f69621b7f92fd578704905f1353a93a84f30ddb6a40bcbdac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780611, "uuid": "3e91de3c-f72d-4f00-9535-03b71dc80a07", "value": "CE539EB5C4A8BE99CF699278B61488389723900565E33DF6E742C796D00BEECF04D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780611, "uuid": "4e333ec8-6729-42b4-a774-013845091bb8", "value": "1536:B/bivQhunOtaewt4ItuRosTDFx4Oi8fs3HW7oPZ1c4nCZQ+:BjiBm1OtODFxhf+2C1c4n8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623780611, "uuid": "46182c57-ad65-4bce-8dcd-075a90d4e5dd", "value": 64364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623780611, "uuid": "186778c4-a68f-4b15-b429-993386f839c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780611, "uuid": "4e11caef-8c4c-4e51-b588-df2e70698e5f", "value": "13c93b923627b5f93559fdeec70340a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3468d9a8-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736922, "uuid": "0091606a-3b35-4369-958c-a6b97b9d11bd", "comment": "Malware payload (IcedID)", "value": "0fc84552247cb08a73c62c21a441896b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736922, "uuid": "c28ceae2-3260-46e2-b688-8aeb14362335", "comment": "Malware payload (IcedID)", "value": "38b6f3fbb664be92bb62badc65b13d8c4f084e36c6284472b72a7bb5faff6b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736922, "uuid": "00c1b7b1-81d5-4691-8fd9-4e637ad45c02", "comment": "Malware payload (IcedID)", "value": "94635312891d69025811877de4406ae6a323fcbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736922, "uuid": "33422935-8d7e-4861-b207-c527788dd190", "comment": "Malware payload (IcedID)", "value": "f53ba1ab6fbacdcc77f71cb71c35c0f48259a4043c93742875f48817ed0c253031aaa6a5946a0e57c1d8c2c7c3b48443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736922, "uuid": "2cb8b464-9062-478a-a31c-7558d62398f5", "value": "1BB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736922, "uuid": "d5463fc8-ad56-432e-b233-3f8d37c4fce0", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736922, "uuid": "9bc16ac2-4223-4f1d-ae7e-52bb45af89ac", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8s:t082TLrbNGoVMjPR5DxDRoF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736922, "uuid": "8a1ec7e9-37fe-4dd2-9716-f4156b39806b", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736922, "uuid": "3944712f-2c00-4783-9604-4e4e88f89342", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736922, "uuid": "7de1554d-adcb-4c53-89b0-81482b1b4779", "value": "38b6f3fbb664be92bb62badc65b13d8c4f084e36c6284472b72a7bb5faff6b5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa96282-cdc3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623752618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752618, "uuid": "4443a85c-9589-4e50-af14-cf196557dc00", "comment": "Malware payload (Formbook)", "value": "74d93f4784af69c69791756e20d9b47a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752618, "uuid": "ded51882-454b-4000-ae41-cfea3219cd85", "comment": "Malware payload (Formbook)", "value": "397d0a36ff633572431f378d6818371e1bf2c6ca575e01802e14c36980b261bd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752618, "uuid": "a7def6d1-a14d-43f1-94e3-df0a3ac7c180", "comment": "Malware payload (Formbook)", "value": "8c859f5ef624a81a08cf60277cc008f2916f8681", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752618, "uuid": "81a24cd7-8476-48d6-9872-21906cfaa358", "comment": "Malware payload (Formbook)", "value": "dd25793af6b68bee54dc97a17db82302217ea97472581261a715927b15e607b6fd13b55e27e56dccceb2efc99fcbee3d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752618, "uuid": "43c6c4c6-c4a9-4bf7-8069-a8836458bea6", "value": "4134220A38523FBB42962FA24D50AB9704B8839B45D8B8E107D3748BF13D7B2B71195F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752618, "uuid": "d0c97a5c-1b50-4f34-81cf-3590c5d91a33", "value": "6144:HBJdaOg7yZD59WeKZB1lGFbkVAnkQb4M0pcxQ:/dFD7aZB10NkekOX0uxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752618, "uuid": "e19a2fcc-5495-484a-8519-b95b0e01ae6d", "value": 233207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752618, "uuid": "8a6132a6-efcb-4077-9e90-1ab3a74cdfe6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752618, "uuid": "e04de9a5-a788-4020-a3a1-0071fa1ec9b8", "value": "397d0a36ff633572431f378d6818371e1bf2c6ca575e01802e14c36980b261bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdda3276-cd9b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623735542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623735542, "uuid": "0c2296a5-220b-40be-8822-df39c3f9229d", "comment": "Malware payload (Formbook)", "value": "ecd0622ec7b682f2d2fefb1efa574509", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623735542, "uuid": "83acbd3c-3225-4727-b2bc-251de8887d83", "comment": "Malware payload (Formbook)", "value": "39cd11ccdcf63f9a48d3ae0db60295cdc6a3d14cb21b3dcd2bf5c544378b1432", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623735542, "uuid": "e7bb984d-7549-43aa-ba3b-e3a148561e85", "comment": "Malware payload (Formbook)", "value": "e2371362a5e204f3d4636c921e170c78b59232f7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623735542, "uuid": "ba088862-ad98-4182-9027-714f8604aeef", "comment": "Malware payload (Formbook)", "value": "23d462bfebc08dafd7b17fc79562367d653e44d9bfa90ea89962ee6371abacb27dd5f2d1bf3e384602657a5e736ca7d1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623735542, "uuid": "84e71e47-9dd4-4883-b296-bb14eb0928e2", "value": "B8F42314AFD8D87F54B4FC97AE866CA13C7149926FDB9DC0160CB2D6F2AD2841AC1CC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623735542, "uuid": "bca2bc2a-c04a-4b0b-88c2-bad342805cf2", "value": "12288:ZFyBd+AA7sn8x4vYy7IuTdV/zOygIsny/MJhHUk4wl8JbsIIouvagZ1hZaH0:ZESNI8xOWYfzOygny/sHjl8JbsIIoZkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623735542, "uuid": "e289feb6-86dc-43b2-8461-19f36794a523", "value": 729621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623735542, "uuid": "676101ca-04a6-4e53-a1da-be8bbe489287", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623735542, "uuid": "a1b7351b-52d7-467d-bf1e-7ee48d3c8844", "value": "Enquiry (OUR REF #162620321) (OUR REF # 166060421) Taylor Marine Project.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f44c8aa-cd78-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623720136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720136, "uuid": "138d91f4-b276-40fc-b0f0-4ec85cc19a7f", "comment": "Malware payload (Mirai)", "value": "c78d2e729821179170e2f7f8566c3b62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720136, "uuid": "db799768-0d33-4e43-bae5-d452c14e8fa4", "comment": "Malware payload (Mirai)", "value": "3ac7de98b6d4bb0c7b8b40bc018efd060a480ebd85bf7705197b2e181bfcd857", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720136, "uuid": "2586d8a9-5dec-41b8-9d06-6b0f6e50448b", "comment": "Malware payload (Mirai)", "value": "d18df253b4abe29689b170b08d987fe1051cfaf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720136, "uuid": "fb8b7964-2d8e-4abd-a699-f0e72145997b", "comment": "Malware payload (Mirai)", "value": "64a6315f73b2f927328aa9b3fbc2577bca0fb38177428f5f8273f7c1122403adba30bc15ad75ce15a242a20763113873", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720136, "uuid": "d3c39564-0730-441f-a798-127a8a696876", "value": "D0630881BC819912C5D8237AFA6E45CD372663E8E2DE3217CD116F21B7C992F0D77682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720136, "uuid": "65a661c8-19be-4220-898a-fb8b4d17596b", "value": "1536:6HUYyriI12oioVp8PZaGpc4uGAqwEZKv8Kdme:6HWiI12oioVN4sEbne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623720136, "uuid": "7a38e394-4b2c-41dd-ae84-da7dfeee2622", "value": 70608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623720136, "uuid": "9d6a886d-86df-49de-bcee-9a794e8f6f98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720136, "uuid": "1d21fe07-0588-4192-9e9b-599d1465562b", "value": "c78d2e729821179170e2f7f8566c3b62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b5f08a-cd8a-11eb-875b-42010a9c0053", "comment": "Malware payload (Zegost)", "timestamp": 1623727908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727908, "uuid": "ba520bb4-0966-4941-b3ca-e6fca724840e", "comment": "Malware payload (Zegost)", "value": "369af7277751019de4e0a12b294d24de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727908, "uuid": "1f30e7aa-14c6-4962-889f-7989405306c8", "comment": "Malware payload (Zegost)", "value": "3c536c1558eba42c1967d9732bf9afd25c9c3c28bfbdc0028b945e88f1141d90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727908, "uuid": "0a5702d6-8c56-4de4-b6ce-907edc00da81", "comment": "Malware payload (Zegost)", "value": "3d0a267b5f9b1f966d9577b0f7f797c813ab8b80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727908, "uuid": "fccf8493-3c7e-4357-b9a3-7c7a2b4dc1f3", "comment": "Malware payload (Zegost)", "value": "7383e993f017af03394fd3b2766e94ddfb408e1eb822cfcf4b33dca0c8e62c38e352c4f36d4e0469c01d304535bec04c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727908, "uuid": "edf7b418-3432-4023-8c43-044ec9a8a3ba", "value": "7D046C42B67A48E1E5FD84FF7C72491D50B7F4586980B9AE9A0BD538E46D3E039300EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727908, "uuid": "81316d6c-d590-434e-ae2c-4d14d236257c", "value": "07cd32fe06d43febfbbba5706c9ac01e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727908, "uuid": "5d5072e1-4444-4c97-aa76-c17f97a45a88", "value": "3072:mtABk6W//OzY3qKz05HOScaZLCbnUvH6+gxF13+ea2rXYShBdj7ExxwXDGLOqPfC:GABk6W/M1KKRCXvlYShPYxxwHqPf1mI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623727908, "uuid": "eb649c89-0126-4545-a43a-c582c6c2bba0", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623727908, "uuid": "aa9f80b7-854a-4ad2-8660-695db956d6c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727908, "uuid": "102d25be-3b55-4c1b-8dfa-496ef7577f93", "value": "369af7277751019de4e0a12b294d24de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdd336b-cd77-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623719889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719889, "uuid": "9d3e9ebb-aa4a-453a-aead-96914b524506", "comment": "Malware payload (Mirai)", "value": "7627e28854d3a3eb49169ea9d60606f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719889, "uuid": "eace4b37-b712-4a01-962b-be529f57f15c", "comment": "Malware payload (Mirai)", "value": "3cba70941fbbaeaae26afdb6bfd0f582eed3ee17c53aa073b8e5983068b26d28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719889, "uuid": "32a1b7e4-9bd8-4530-a145-8c14fc7171a6", "comment": "Malware payload (Mirai)", "value": "ae86fcec910f84cbad0235d9678a0c053e811950", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719889, "uuid": "dabd8aef-3906-4576-a92f-df7b6b28ed4d", "comment": "Malware payload (Mirai)", "value": "3246a9dd0f0d7bb39294292c38604e7ffae9e3b2bbec4027ed1e18a330eec1786486df67b7723036d8680ad47fa45007", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719889, "uuid": "812d317b-4d2a-46da-9012-ed4f4b6455b9", "value": "22632B02325C4E43D1920EB8253F1BF183BBEDA420E4F689290F9F498AB5D77514AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719889, "uuid": "47576df7-0228-492f-ad8f-82ce967b3f42", "value": "768:niuOSEYf4Gx1T+B+9LeCfdAgWe8Jn0KEKEABMAF4Hhd3QcGR4itBm9f2jvMRYrDP:nwVo96gAEKchfGPtLprDiEyryr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623719889, "uuid": "20df683d-8665-41ac-ba01-9a2c82fa39a7", "value": 67420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623719889, "uuid": "34b86527-27c5-4531-9efe-addea0b641b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719889, "uuid": "8b34269b-caa1-40b9-ae75-7ad10a8f18ec", "value": "7627e28854d3a3eb49169ea9d60606f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9174d820-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623769291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769291, "uuid": "654e90da-3735-4d13-8eae-06e6379f29a3", "comment": "Malware payload (AgentTesla)", "value": "07c96918279ffc2951aeda453f1a19b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769291, "uuid": "7f30a179-ba48-45ab-81ad-d1084db07931", "comment": "Malware payload (AgentTesla)", "value": "3cfa66e516f9223a33af8c4dd1224bcd01c4157ec368318d840659667b551026", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769291, "uuid": "c617196d-79b8-476e-8166-1b493dc2bef6", "comment": "Malware payload (AgentTesla)", "value": "d78451c3e15d76f16a1644dbc31134ead50bf748", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769291, "uuid": "8644ecf9-e50f-4c1b-ab9b-1077f7c936a9", "comment": "Malware payload (AgentTesla)", "value": "28903a7e3f2a0d95c3ce6193d36c5bf3fe0b5e3be3717b93f88f3158c64cc8eaecae4151fb1e58e2cf368e328e042ae0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769291, "uuid": "05f66051-fc9a-4884-9c8c-9cde2b1360f5", "value": "74C42315C1CDD1795275539727D6B80360C429CCBE483AB2AC87BE3987EE4E3AE60B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769291, "uuid": "cda6730c-7823-4090-838e-634984f1019e", "value": "6144:4XDUIAc0PFmPkun3Ojh1XnOXVj3gaAQJCNvYnAzU2PzWrVdS/chtpz0BvlM3VLuK:IS/FmWh13ON3lgNAnc4Vd1xECY1YURw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769291, "uuid": "63f503a8-ec3f-4b04-a8b9-710d07e70c12", "value": 545788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769291, "uuid": "f0a1cb1a-0be2-4238-a4ed-9dca3919d780", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769291, "uuid": "80cdb1f1-5ab8-4ef3-a9ff-7afa7d5279b2", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242c2039-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736895, "uuid": "ed332103-dd8c-45f2-b783-eba0d3cfb247", "comment": "Malware payload (IcedID)", "value": "a555261025f3c01e931e93cb71b17323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736895, "uuid": "53459a60-db6b-4e8e-9b3a-88a44378a449", "comment": "Malware payload (IcedID)", "value": "3e24a61a59ad138928c6d67e2e1cfeec9360ff33bfe668b9392e2ee3ec20045c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736895, "uuid": "7677dd72-5a54-4248-a6d2-30993bb4ae78", "comment": "Malware payload (IcedID)", "value": "d13cd08e9b055170896317db790616891269a370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736895, "uuid": "283bc6bc-bbdf-465f-ab31-5dca660838a2", "comment": "Malware payload (IcedID)", "value": "c1c57b87d5c4f467dfe9b59543033f11a29c9bd0d5b517bdc024c22fb53544a47349f7d3d32e63b3cd9273a2772463c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736895, "uuid": "a7ce68ac-7dcd-41b0-89f2-90d28f3e2da1", "value": "04B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736895, "uuid": "5506d3e9-5531-4c1e-b49f-43080b8afdc1", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736895, "uuid": "1e82af8e-57ae-441e-9f1c-267bfe65cfd4", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8T:t082TLrbNGoVMjPR5DxDRoFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736895, "uuid": "1d4af5fa-d0b9-48eb-a1a1-0217ad2334ae", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736895, "uuid": "cd8b4fc0-ade2-4717-ba0c-a81f74a0bd04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736895, "uuid": "ee8ed345-7901-4ee1-aff8-5b2911233c5e", "value": "3e24a61a59ad138928c6d67e2e1cfeec9360ff33bfe668b9392e2ee3ec20045c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ff546e-cd97-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623733454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733454, "uuid": "21298674-1ff6-48b2-ab0e-5b5e77f1d470", "comment": "Malware payload (Formbook)", "value": "976074463bd54e063617dcdb016af406", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733454, "uuid": "6734f875-cae6-4613-93d5-fe32d9ca1e5f", "comment": "Malware payload (Formbook)", "value": "3e456eb789adfc4ee2927002c7c1a87ac73811715d23da20771a989b807ffb19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733454, "uuid": "3316a65f-8e67-441e-8278-c80337da7c85", "comment": "Malware payload (Formbook)", "value": "e70af81585c6ae177696d1196f812a8bdda9cd37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733454, "uuid": "7c8e9ace-6092-4656-848b-d6e3e087592d", "comment": "Malware payload (Formbook)", "value": "e96d05404be9e62ce800fc6f801bf505e962d380d1f82876424a995ab87d037f2b951b9511a6d2151f4e7243aa9554bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733454, "uuid": "212d5f1f-bbef-492a-aa2a-f878463829d4", "value": "D7355B8C7655EF9EF4778B3185549C20E513ACAF8617920BA313B67F6A3F3C38A141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733454, "uuid": "519f6566-9e87-412b-87b6-3f277c72ea4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733454, "uuid": "8501af68-ea39-4b6b-92e6-f3c9aacd5768", "value": "12288:UzLlu8s8E9VCZ6v9pceX5rrLsb0cMzOaO/fJ1bKpkgWmf9+bpxifP5UDh6VQ1/g+:qLlg9pcKFr809zBOPEknmf9ubyIFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623733454, "uuid": "fb043018-30af-4b36-9fcc-ffe8389aebce", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623733454, "uuid": "35bcc84e-e188-4e46-b9c2-e7098a0c0d3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733454, "uuid": "a782ea53-41e9-488f-a1c0-fb379c232cff", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2748f1c2-cde2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623765677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765677, "uuid": "a36e47e7-cf40-4229-980d-de07a27f8f88", "comment": "Malware payload", "value": "312c3c5155258b9e6b4a270eee8f4029", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765677, "uuid": "88e55bcb-2651-4d34-9225-85fb621548e1", "comment": "Malware payload", "value": "3e8934af50e74c540b281fbca3fe2ef70cfb46080cda20152817c8ee16389ba6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765677, "uuid": "df84b767-dd34-4ac0-a48f-e976c4e1b553", "comment": "Malware payload", "value": "5d852ce08fd8fc676e132e0a3ba30aa027b6f35d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765677, "uuid": "4b3b0d2c-28ca-4f9c-8871-3e33199fac05", "comment": "Malware payload", "value": "b7f5a0140b951a3df14c781a39167fdbb075ff00e04fdea456eb5050820dc27ea1600caf1e1d3d950811579f75084e10", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765677, "uuid": "a5219667-40e3-4522-aa6f-f4dc17210036", "value": "39741242B2A0F617D91BA235488BDBC23367ED462F4A834FA5047F5D7FB6F110A42B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765677, "uuid": "cd227eba-8827-47b5-b8d1-3a576778a70b", "value": "6144:Xlhk5CDUJUMEUEl+8myYXxKiKz0jpQ+Wb4+2qREMmIEM1cNbeomCsJn:XlhcQMEUElwvXxKDe2YqREMm1vRm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623765677, "uuid": "f70ead5b-d98e-46b8-b81c-8aef510b1d4c", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623765677, "uuid": "2f8fd61d-0080-47d5-84de-8afd79463e55", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765677, "uuid": "1a48d5a0-6137-4197-8f01-a63a8046efbb", "value": "Order details .(2).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee4d95a-cde6-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623767595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767595, "uuid": "0bfa3e98-7fd5-488f-a07b-cb7f911ea290", "comment": "Malware payload (RemcosRAT)", "value": "c9be6f0e1c9c5cad19e97353bbdbf857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767595, "uuid": "c445cee1-7fd1-42f8-8dc2-688a9ba7ae14", "comment": "Malware payload (RemcosRAT)", "value": "3f5ccdc99b29651852d447f8587f5cfa5e108ea10dba0eed36d436a4b6e73719", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767595, "uuid": "3825e51f-886b-4c65-bb2e-8fb7c3bd9d95", "comment": "Malware payload (RemcosRAT)", "value": "db47280c828d40c34522f3acf88ec2b71e907ff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767595, "uuid": "21a3440b-00ec-44d6-b300-dee9c9e349d6", "comment": "Malware payload (RemcosRAT)", "value": "aa84d58babe6bc215935b603704f40ea7ffa2b7c366e399b69af02d2b0e57f395e0bda0aa4ba81e4c3ef3f4f7154bb3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767595, "uuid": "0d8bd71b-0ff3-4a0c-b8c3-fae0d2fae798", "value": "94258E499656C535D82B36F9886736AC082B3F057A249C4D32F93B46FEB47D02C1E39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767595, "uuid": "b8682e08-f4df-43d9-b721-95321c1f7b7e", "value": "0b326f03279d25cd7d2b11f5e25abd5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767595, "uuid": "2047ccd2-b904-4482-8a0f-c0e4992a2bdc", "value": "12288:AGG4Q59OZnlp7UwjmJomJsCEGo8rzVNvAHl0AqX0uNb+T0HXX+jBnnXLVgKR3Zxh:3+5mlpmXqCWC8F9q/XQBQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623767595, "uuid": "eec20f83-87dd-467c-8eac-497ecd4a88a2", "value": 1004384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623767595, "uuid": "d5b32a12-ec2d-4fbf-b8fc-28af51b04121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767595, "uuid": "71438836-757c-4553-bf29-3af0583aa3c0", "value": "newr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80b7e54-cd88-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623727292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727292, "uuid": "a22c700d-277d-4b00-a841-350c2e881f8b", "comment": "Malware payload (RemcosRAT)", "value": "91952d77440244071732d42cb9e476a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727292, "uuid": "4acc04b2-9398-44c0-901f-d9e404929a99", "comment": "Malware payload (RemcosRAT)", "value": "3fb05be6f9437b4193be86c5c498d812e96b0cfd8682f8fffee9a4f8adaedfe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727292, "uuid": "a62e8e03-b5ab-4307-9e5a-e093d347e93e", "comment": "Malware payload (RemcosRAT)", "value": "02dc013cbecf82a1967b4562f3c82d8d6b7499ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623727292, "uuid": "9ab367f5-a70c-4a47-9026-9f041ed88253", "comment": "Malware payload (RemcosRAT)", "value": "6121994b77d494070623386e4774305173654024225d918d1eec7aa3922ea444fbda27165840cc0573439926cc4051d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727292, "uuid": "3d94d0ae-1a55-46d4-b73b-63c7559e6a47", "value": "73924CB7DE84CD58E81B4A37F4B0850837B1775FA672FF8B49D490064B433963678A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727292, "uuid": "a09febc5-565d-4fdd-82f9-33664884a067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727292, "uuid": "9db59bd5-999e-4ebb-b5de-637bf02e6d4f", "value": "384:udK7tKMzaeQJWDl4CBqT2E0SLJcW2JpHG61U9JBffJEXesQ7H7e799JhR:uYJKVeQSRqTz0SL12J1G4U5fJEUDyZ9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623727292, "uuid": "291d301f-05c9-40f3-a209-29fe397b00bd", "value": 19328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623727292, "uuid": "8f513bc4-ed99-4e38-9e2c-a7d3b52bfeaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623727292, "uuid": "d6e4f294-7ecb-4b72-b8bc-02c7b0e957da", "value": "SERFINANZAEXTRACTO286648302187037087196744955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f3d955-cda4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623739024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739024, "uuid": "dba6b936-97b6-4b3b-8c3a-d8b938d02467", "comment": "Malware payload (Loki)", "value": "74b2d1b4c57a8d435966669a227992f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739024, "uuid": "76fff3a3-3dc8-48e2-9f92-6343b871c18f", "comment": "Malware payload (Loki)", "value": "4025f4eeb48cb44a7a18159da76569f749508810d0eecf9a1298dc312664a0ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739024, "uuid": "f1449aae-52f9-4372-9bc3-cf6380cf7cd9", "comment": "Malware payload (Loki)", "value": "1b17edf4c487b9f3293dea158e5604b95d512467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739024, "uuid": "c390d3a1-a112-44c9-9a86-709851de8fe6", "comment": "Malware payload (Loki)", "value": "c6f72debd096c4238de570dc8570346874c7b2fa07375b80cca62a148c0244c51be6b2c50b53b00a5b1de846bdf1a926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739024, "uuid": "4fc752f2-3dec-40a8-b7b1-2a54e10cf98f", "value": "4BF3024F76C88473E4454E3302F7EB23DABFE65916A4126F2B6A5FEF29341C29511232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739024, "uuid": "f14be630-0ec2-4a1b-a441-9f0375f658ef", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739024, "uuid": "8ca70c54-dfd2-44f9-8892-afe59a87ebe5", "value": "3072:cLk395hYXJ2Mzypf/O0g/Aeaeo3kpAjhYYceZxR8C9MfMcTGdYsGvFSYt:cQqJe+0T0o0pAjC+xY7GOskMYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739024, "uuid": "4e6e361f-8810-449f-8a20-3f24a41a61d6", "value": 164570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739024, "uuid": "7f27ef7a-43a1-40b9-910d-25e986f88555", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739024, "uuid": "1b175a15-2c79-4628-9074-5fc23f47137f", "value": "74b2d1b4c57a8d435966669a227992f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f55e5db-cddb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623762737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762737, "uuid": "856ef559-9fed-407a-9acc-271684cede2d", "comment": "Malware payload (Mirai)", "value": "07aa2c8335856c07aa99f9e9402c9c01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762737, "uuid": "90194180-936b-44c3-be9c-bd9dbab2e260", "comment": "Malware payload (Mirai)", "value": "40454fb62aca319477a6faab052bebcacc2ecf1b86e1fd59d23cb6e25e3823a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762737, "uuid": "29cde719-b95b-428f-ad83-f29a2b825719", "comment": "Malware payload (Mirai)", "value": "19ad9e47b93584623590fc9e7014f52eb6a916de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762737, "uuid": "2b6f30a7-09e2-43a7-b7b8-014d8d931ed6", "comment": "Malware payload (Mirai)", "value": "3b7e1e5b097668694a56333d38fa538665a1cbb352a22f86b0a633ea715c419e1c366d807224536261ad6e55e9e5a2ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762737, "uuid": "f7f173cc-d8ef-4fba-ad0f-c73ba12de073", "value": "86D30892BC819A26C7D213BAF9BF508D371427E8D3DA71168C211F647BCA81F0CA7B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762737, "uuid": "2a87fc10-9dda-441c-9c46-ae677310cf95", "value": "3072:o/lR8lD81BXB0mmvbuhaBWhc84iwqMJFK:Q/8loaNBWnqqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762737, "uuid": "9e5b3e90-432d-42a4-beff-43da5d956315", "value": 133564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762737, "uuid": "25760d80-8aa5-4e77-89c8-832d33334e51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762737, "uuid": "abbafeb9-d0be-4050-8354-401fb417a447", "value": "07aa2c8335856c07aa99f9e9402c9c01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2f4466-cd7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623721606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721606, "uuid": "dba3282a-429c-4773-9c3e-b8be30a0c146", "comment": "Malware payload (Mirai)", "value": "efe6b663cd63885b47a191739b8e653a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721606, "uuid": "207dcbea-ace5-4599-8490-412ac6eaca42", "comment": "Malware payload (Mirai)", "value": "4082982370fac44671e24b8d964d84c79340e12c62bb4fee26d4c523fbcb9e41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721606, "uuid": "8c8116ad-04c4-4121-a89d-0263f35b9856", "comment": "Malware payload (Mirai)", "value": "0bf588f01659883f5566f44685a85bb93d611a24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721606, "uuid": "a3343586-d22b-455f-885b-14a6c0ed8207", "comment": "Malware payload (Mirai)", "value": "33e4e8f7da6be4c09bc56c6427710373690eb75e3dbbdf9b2d35933448949a02faf1004116579e94224d127830992c31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721606, "uuid": "6aaba49f-f337-4d89-84d8-02f791633723", "value": "46E2E781BD82D513CAD44337FA5F12C93B2A639CF2ED33039E166F5166D692B0E6B112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721606, "uuid": "d120bb58-d17d-4cf5-a5e2-1136351573ad", "value": "768:z/dqt7/omb90O3oRKOuzY3bwx6XvzGh5qTiD4FhtPkAcVb:zdw/wgp3aCjvsPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623721606, "uuid": "f1aeab8e-f59a-4061-a41b-1b52b7ab79b7", "value": 31428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623721606, "uuid": "13ad6cd7-d888-4ce9-9504-42e85d6f5f63", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721606, "uuid": "c3a62ddc-a7b9-428b-90e2-b8fcdacc4010", "value": "SecuriteInfo.com.Trojan.GenericKD.37088896.9056.7094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654536ae-cd96-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623733139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733139, "uuid": "4762297e-49dd-46bc-b314-c01757ed5373", "comment": "Malware payload (AgentTesla)", "value": "33de109195afe181695b2872172524d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733139, "uuid": "6abb171e-d109-4ecb-b191-a56ca671ab9f", "comment": "Malware payload (AgentTesla)", "value": "40dc93f684b9c04cfe4122de2a0eac81a6e012bdb4481c0ff4e7ee118373b403", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733139, "uuid": "a7465faa-30c4-43f8-b28e-92722f0e3061", "comment": "Malware payload (AgentTesla)", "value": "61a63dab0f2e2f34cdc0a2669252b5814c13f128", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733139, "uuid": "30ac4052-75d7-49ad-bc52-f9961c04b2e7", "comment": "Malware payload (AgentTesla)", "value": "3aa522a888cbcac09dad5b268019fbf1e8f4f70bb53ddf9d642292b67901c7ef0842496214fc0ac770882e5cf560293e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733139, "uuid": "12d080ea-d16d-4230-b129-b166d7e2f781", "value": "B4152340A3312E8673765FFBC8F92407D09C02A6596923254E5EE97B5BBD1DC8EE3A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733139, "uuid": "46f28f42-c70d-46c0-b07f-7515ea8ed437", "value": "24576:t0SnPMuYUNYBipl8TiHhadknYTeLu/ZHO4//sn:TnPHvNxpEiBadmLu/JO4/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623733139, "uuid": "addeadc4-545e-4499-b19f-f4a4322131f1", "value": 955399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623733139, "uuid": "2457e9bd-84cb-4df4-b5d6-0250078db0cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733139, "uuid": "80353ff1-9c01-4ab8-b66d-2cdb1cec4b51", "value": "968 9449 2324 COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b020d111-cd7d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623722527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623722527, "uuid": "e439663e-bfa5-4380-97a6-a492e6dcb0bb", "comment": "Malware payload", "value": "256a85be4319b229da4081a4ae738dfb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623722527, "uuid": "76fee514-3d8d-4ff9-a58d-9b6db0c41397", "comment": "Malware payload", "value": "4322ca4065696afe2d355023ae5e6010a554af4b4af963fe11952a60def85b6d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623722527, "uuid": "6f7803e1-91b8-41bb-8912-7f2b84b50ab9", "comment": "Malware payload", "value": "add4dfc02f88a30c4b25eebebc96884c509eb036", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623722527, "uuid": "cfd9b237-f553-40ba-9a5b-cd2b61dae9c6", "comment": "Malware payload", "value": "ae2ccb01e724791c52d0f4010c2ce57a3207393c2c52a11558a2b760640cf671b79579cda90acd5a16e23fa29064ebab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623722527, "uuid": "c4bb2ad4-de55-439e-bcd4-869fcf32726a", "value": "366412ABD8777DCBFE1A4FF021970E4E5EFDD2CAD2C568906655048026FD346A290BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623722527, "uuid": "c53a675d-cae4-40cb-bf52-06a24333859b", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623722527, "uuid": "ce64fbc9-9dea-4c61-961e-9ade326dd818", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623722527, "uuid": "0cc965d8-6d06-4e11-9e19-73c504c5aaaa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623722527, "uuid": "4255c471-5078-4199-bd1a-2723481fbd39", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd780e3-cdfb-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623776505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623776505, "uuid": "68a71588-f8d5-4fc0-977a-f973b362f7f6", "comment": "Malware payload (NanoCore)", "value": "14fdbf5e916e60c7fb81d9b3da7b1942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623776505, "uuid": "660980a4-f65e-467f-90cc-94501c8d6503", "comment": "Malware payload (NanoCore)", "value": "4517b3b57dc11bdd811c88c87be7dda955af5c4103d706e2e39df0866cd1b4bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623776505, "uuid": "6f786675-268b-4568-a6e5-255d9d3c66c9", "comment": "Malware payload (NanoCore)", "value": "865b7245f7848b93e0874855e3c10662ea6f775e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623776505, "uuid": "b2382348-47c0-4a1c-a7ee-785a08849fde", "comment": "Malware payload (NanoCore)", "value": "99891967c42c9562f65603fa1348147ea91f0204c54c47a732a887a734d0cf40a19542a0ca47707a57dec4738c0947c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623776505, "uuid": "7d6424e9-3d72-49c7-814e-5503fc64ceae", "value": "9215021B76598F15CE682575C1EF193403E1AECB2A72E6CB3F19338E1E027239E45B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623776505, "uuid": "b6384c6e-271b-4bd6-a3a5-69bba15cb2f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623776505, "uuid": "3599bb0d-1744-4324-a20a-003c5bd8e8aa", "value": "24576:6bll68MBO+6ZKZH6O9CbMv6WF3NohIo4gjRg:6Z2BOiZHgCFChI5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623776505, "uuid": "adeb0367-60d8-434a-a18a-e44fcc40c87d", "value": 898288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623776505, "uuid": "0c105d02-6d2e-4299-9350-e79a9af55f32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623776505, "uuid": "66dbe286-6640-47c1-bfdf-b2c7bf5b28b3", "value": "14FDBF5E916E60C7FB81D9B3DA7B1942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2446bae8-cdc4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623752787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752787, "uuid": "10a02c61-0ed0-4ff6-9df9-cb5c97ecb7cc", "comment": "Malware payload (AgentTesla)", "value": "60a82b6845fc92eaa33b183b8bd7c72a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752787, "uuid": "41e38734-21f2-4ffa-bf9b-2679b1c83305", "comment": "Malware payload (AgentTesla)", "value": "4532ebc9be45f4224930e723356dd721c6209d45e5d7025bd07f59f836a6dbd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752787, "uuid": "4666dfbe-edb7-44b9-b47c-265468b035c7", "comment": "Malware payload (AgentTesla)", "value": "0319533dc4c253a0cd91fe46f36ed95a96672ac7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752787, "uuid": "744de482-31e1-4258-ab68-ac14b4e9da13", "comment": "Malware payload (AgentTesla)", "value": "5afe0b5daa67fc240c983d1d6d53060dc94cab9441444378c1dd17e812b1d13afe389156fde95be4fa0d0159cb6bad17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752787, "uuid": "b2c9eff0-c319-4ffb-bc92-af42e003aa31", "value": "F1255A9C7655EF9EF4778A3185549C10E613ACAF4227820BA313B67F6A7F3C3CA141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752787, "uuid": "9dc3b575-c34e-46f5-8c55-018b21a44db0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752787, "uuid": "dd9ad67c-4f1b-494c-9f12-eea311c95c81", "value": "24576:/38EA+Y7r+ivy4kszsags7xeOoqzIFW1:MOivhksoag4x1IFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752787, "uuid": "5a26ef18-7309-4231-9492-8bdbb9c4d393", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752787, "uuid": "674c8214-ca60-4bc3-b85f-484cd22746c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752787, "uuid": "0931c8eb-6197-4da9-ac4e-aa8a5945f6bf", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787412cf-cd72-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1623717709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623717709, "uuid": "191cb238-2a5b-459e-aac3-09911ed5b01f", "comment": "Malware payload (Pony)", "value": "5d0a7887574e5fffa3ade9d0ec2eea91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623717709, "uuid": "051ade46-a97d-4168-9592-044fd16e429f", "comment": "Malware payload (Pony)", "value": "46c1e510c659e4668cbb06e34811c0e9decc5cf3f71ce911e59f43e91219016f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623717709, "uuid": "c8177bc1-e7ab-4f9f-818d-acd78226fc56", "comment": "Malware payload (Pony)", "value": "b8396c4310fed7450235c43f5a8110ac1e42c9ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623717709, "uuid": "4861ccdf-e728-497b-90db-7e6853786aaf", "comment": "Malware payload (Pony)", "value": "3d300770e6953c14fabf8096b67100b904984c29c89bda3470eb14f26a0fa03d39db173567efbe9f6255db332843a1b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623717709, "uuid": "3d25195c-fd9f-443a-923d-bc4670777a9f", "value": "E4F5DFC01301F7AFC3E1E2FB646516F433568ACDE915F5A5D22CD740289A52F0AAFD92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623717709, "uuid": "eea514b2-615e-4834-8b46-e5bce0a5ae89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623717709, "uuid": "31e8e67e-0e4e-4bc6-a5fb-ace75dc4da13", "value": "98304:88I074+zRxIjPtY73nj+LmTMmXqmzx+sw:8zi4iUtS3CSTp9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623717709, "uuid": "95778d17-8c1f-4da4-8585-a3109068152b", "value": 3432448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623717709, "uuid": "aa970149-fd0c-4b7b-a537-2ec3fd6b87dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623717709, "uuid": "1551d5e9-6b0c-4872-8ad9-ea5df772facc", "value": "46C1E510C659E4668CBB06E34811C0E9DECC5CF3F71CE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c7b47b-cdab-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623742381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742381, "uuid": "e209ba8b-b9bf-471e-aea6-8fbb1738e0d8", "comment": "Malware payload", "value": "369eb82f2b32981b93aa9df9bf5cc01b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742381, "uuid": "a88a915d-e610-4193-a981-c3c87893bba2", "comment": "Malware payload", "value": "46d62441a49ef9ca19a4d5422eb08bfa091c80893a6ef1d8f1c48b94db0d06b5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742381, "uuid": "c223f643-139e-4a4f-8488-9047ddf91223", "comment": "Malware payload", "value": "9e73546f6555b72657b00b7361f9cc8dcf8c095a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742381, "uuid": "f358556b-e06e-48da-8d20-1992099edbb1", "comment": "Malware payload", "value": "baee4302f1fafc9b4bf2f38d34347141454c5feb72a9ce7442153519575ab1c749dba54c429a08a3a9e5cb069530bf80", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742381, "uuid": "79c91542-b234-4ee5-a1b7-65c100d76cec", "value": "6681FAA1747C4D19DF5558318A38FF7A90D3F1A68BDA4DC0B10CE9930BBF31859B5A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742381, "uuid": "7280fcdd-965b-4d55-bbb4-3416fb27533a", "value": "96:ChOovw9eWOuwxX89NhzcLkQWmZWLwLIz5LcHo/wiTjt0dc:Ch/vw096QIQWmZmwLIz5LvpV0dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623742381, "uuid": "9f3baa62-8a80-4a72-a4e0-8cd84f229d84", "value": 4103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623742381, "uuid": "78d8f6e0-3808-4c91-b726-6dc452c2300d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742381, "uuid": "410ffe43-3e75-42c9-8fea-b1f3fbf6b07c", "value": "Enquiry RC3726642021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9597e9b1-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623769298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769298, "uuid": "3cf12fc5-5110-4065-b987-f113d93fbdfe", "comment": "Malware payload (CryptBot)", "value": "dc31178c8e734d726d361bf5179f05b2", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769298, "uuid": "61e48e09-c8c6-4d17-b9e9-ba705aa40cbb", "comment": "Malware payload (CryptBot)", "value": "473574ab9286caa551c88e2a3ac32e8b7975baac765bf084fd8c6ccb89737666", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769298, "uuid": "b7a5a57a-5cfc-4033-a356-9ea8c7c35459", "comment": "Malware payload (CryptBot)", "value": "d28f5dd56498248e706a3aad546e0e200f19b3fa", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769298, "uuid": "a8fd29ce-4f0f-492a-a06b-1795afd1b634", "comment": "Malware payload (CryptBot)", "value": "dc8ec89f46c4ad8e46ff20bfd222d975a7dd9394a80a9481eb0cf6a13e215cffbd0fc8c61b21cb51cf83591739319b08", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769298, "uuid": "0fd8dace-5391-4ccf-9813-9725a2440e63", "value": "AC95F01626AB8075C4DA8AB24430E8A7E4A7EF982BD8E56F552037F5DFB31D85031F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769298, "uuid": "6efaaaf8-f8e1-48f1-afae-8974322033b0", "value": "760fd261ec10f8a22c61d2a2c4d2af7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769298, "uuid": "61d0c469-e2e6-40d9-aa65-07b2d76fee25", "value": "49152:36MH4mxVdO72o+eOnc1HawgEn+IM4R6kVj6BTTodTm:36CPekcWIhTVj6BP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769298, "uuid": "43589d45-f67f-4844-bb66-cc108ea84fe4", "value": 1959102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769298, "uuid": "0b2dbf56-ba47-4f3c-a662-50686b1790ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769298, "uuid": "017ff189-af69-4dfb-b732-c12ab46d3f2e", "value": "dc31178c8e734d726d361bf5179f05b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25803f3e-cdcd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623756654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756654, "uuid": "6852cddc-0ca0-4ad6-9b58-f4ea75d1dc68", "comment": "Malware payload (AgentTesla)", "value": "e2e3079ac8c5cbbcc7073ca306ab42ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756654, "uuid": "b55dbb7c-3cf3-4517-8582-16e7204c3e12", "comment": "Malware payload (AgentTesla)", "value": "494edbe20027214460af19f45f052f9ccc54db18f438572ce41d607bffc227c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756654, "uuid": "8c8ac3f7-bb2a-4494-91bf-2268572679e8", "comment": "Malware payload (AgentTesla)", "value": "5236549f1fbe0f93f4bde89e6e96a34ff98894c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756654, "uuid": "c6ff3cb0-8295-44c1-9ad4-845ab3705aae", "comment": "Malware payload (AgentTesla)", "value": "7ad8b067279f988fbc04f3d94c21503d59698234b2ed2c68a2c6558eb14b3626518e0086e286a2f9eadbaee4137c9ae5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756654, "uuid": "5c352e5b-faa2-4671-bc3b-d8b9bf3f8a64", "value": "B9254A8C7655EF9EF4778A3185549C10E613ACAF5627820BA313B67F6A3F3C7CA041A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756654, "uuid": "194f974c-db8d-48b5-b55e-327aa5ff643e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756654, "uuid": "2d3b8f3d-aa79-4957-9260-83811939c39d", "value": "12288:Ww9ZTjvNoG9VCZ6vO4wuFhFQwkFGJCzsMhJA+zM8opgQcX1xB3ytxYuwOiwerHLO:Ww7TjFPrwufkcMaeU0IFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623756654, "uuid": "87fbea5c-58a6-40ec-a82c-962df43f57b8", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623756654, "uuid": "4a9e7f82-d504-4ed5-b492-134e4b313a4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756654, "uuid": "f76393ab-dcc9-4201-9aef-ebe08dc3e9a1", "value": "47158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67481d90-cdd6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623760630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760630, "uuid": "2655ef76-01fa-4871-80dd-a21d887860f4", "comment": "Malware payload (AgentTesla)", "value": "ad6a505f5608e0683f9c3e8cb464a0b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760630, "uuid": "49953f77-2b2f-4b57-85c4-a5c6a7a3bbb1", "comment": "Malware payload (AgentTesla)", "value": "49be8f3be48cdaf1e0a536a1fff4918e3897e2c46aec0e413faaa03521b91ce3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760630, "uuid": "343d4d83-fae1-43c7-9ce1-882e0873cd5b", "comment": "Malware payload (AgentTesla)", "value": "6b007b6f7320e2260cf381d2d3d7eab8f0d439e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760630, "uuid": "7b12d5cd-5a78-4fd0-bf55-557ccc95adff", "comment": "Malware payload (AgentTesla)", "value": "ecc003f135de22c9704257f6f6d20175e57c96e5e3f864c70894ffcdfa536f229ee31e23666f074e7a1ea980358cf873", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760630, "uuid": "c6be5f68-6a12-44b0-8b5f-7fb4d7776c32", "value": "99254A8C7555EF9EF4778A3184549C20E513ACAF8627920BA313B67F6A3F3C78E141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760630, "uuid": "c51ab3b5-450d-4f86-8b93-f25e27673e73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760630, "uuid": "bdb69b02-deaa-49d7-a7ab-a7d029675cbd", "value": "12288:aA3M8t9VCZ6va/peR6z4z9pLDnmtw8j0wzflJAGbpF6BVN+2bpLxgDZGanPwBjjB:F9ipzo9ZO7rjlJbP6hqIFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623760630, "uuid": "afad7684-d066-4ba4-a537-61d1d1d70754", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623760630, "uuid": "b1cf0a0b-1bed-4ea3-b7cf-11e4c226ba25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760630, "uuid": "0fb6852a-7d73-474c-be3a-3a2a64258db9", "value": "DOC00150.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8849ed1-cdd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623761196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761196, "uuid": "fed9c303-7fbb-4be0-ba89-810aed625e59", "comment": "Malware payload (Formbook)", "value": "dcf49ae0cb5c01881f1ea104451948d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761196, "uuid": "1aa90bd2-9d24-4baa-b901-d053adaa8dae", "comment": "Malware payload (Formbook)", "value": "49cda865e2b759eae231f9b72cf551b2977fdfa3e0b8762883235915929d318a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761196, "uuid": "1bc4332c-3949-4675-89ce-c67cff5c3d0e", "comment": "Malware payload (Formbook)", "value": "6ab347436175ab71f16b7a648f205239d51da9ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761196, "uuid": "7c5582ab-ca42-4dcf-ab68-d556861aace1", "comment": "Malware payload (Formbook)", "value": "89d3654202ae46ddee4a2f828e69e103912f3900901e916f2d17a5aba02e5fa8d255ef42ce5205bf1530baeb38d9a782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761196, "uuid": "b9cbbd44-237f-402d-97f6-ecfaa99622f1", "value": "9A15BE575ECE56AFC6558CB69B30AC56C2311CBA2609A3133DC234BDD93F1EEC99E402", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761196, "uuid": "d5580bf1-ee1e-42e9-9793-75d209f68897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761196, "uuid": "85542ee1-ee53-4b53-9141-04df1043a134", "value": "12288:OhmtfSMPQipP5/5tiCIvUuQAnB+SJrTJLU20PnTedl8fPqBmuJ:OhmUipV5QUiBRlLB0PTedl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761196, "uuid": "7f00b34e-cc6a-4ea0-aa48-61aa41c0cd14", "value": 937472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761196, "uuid": "2fe9bd97-d14b-4cd3-9bb6-853bff7f0aa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761196, "uuid": "9e7c3d35-d239-4f83-9ad7-61a8b15e1643", "value": "HALKBANK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d66a7d-cdd2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623758774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758774, "uuid": "88d46403-b59a-4707-be34-9fb36d3765dd", "comment": "Malware payload (Formbook)", "value": "028549d34db828041eed451464873036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758774, "uuid": "9eaa3291-8a7e-464b-9e1a-c21ba34b61c8", "comment": "Malware payload (Formbook)", "value": "49e85a486931e92ab028dc10d02b1d2d5860a6656bf6d50cef71542fc0905105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758774, "uuid": "0d89a23c-19f5-4afb-87bb-df8f8159c26b", "comment": "Malware payload (Formbook)", "value": "82d6a07b48ed56c009eb553ed15cb0307cf97914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758774, "uuid": "ca6d6ecd-d7d6-4bc5-8102-9d751b6f098a", "comment": "Malware payload (Formbook)", "value": "84d8f3d9eeca7ea8b58dff8aad6f924c04c961682bdd96dc139e973386d37475946b36dece645baed9fd607043fe8221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758774, "uuid": "7a79e40c-9bff-42bc-bd75-279edc9b1b1e", "value": "8924122839F958E3E96387300A731739EEBF735D165292C7CB195FDA2D210C29B13A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758774, "uuid": "6f31e69a-1a66-48ba-850b-d209aa999d7a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758774, "uuid": "cd9c5775-092e-44d7-aae3-e09f861a5d64", "value": "3072:cLk395hYXJDMXOkf3JS64b4PMIQsTzxcJ+2LRilKs4qYU6zwj3OaF9ltMvhDWQ+F:cQqWXL3g64b0MIlcM4CwbwLlqZ4Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623758774, "uuid": "04da1a16-49ca-4899-934b-6cdcaf799c9f", "value": 217681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623758774, "uuid": "d51c0683-0776-41dc-9d4e-2cf23d607313", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758774, "uuid": "58092184-e08e-42c1-a170-d5efef778de8", "value": "PO# 0499699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c38a410-cde3-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623766249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766249, "uuid": "e0707a39-e57b-4668-8b85-a9403de15ffd", "comment": "Malware payload (GuLoader)", "value": "e6c676ea92d72da7f2d79f8afc468cf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766249, "uuid": "125f4d7e-b1d7-41b6-91f8-c54e48d32821", "comment": "Malware payload (GuLoader)", "value": "4a201ce6a206689701654f28999eed6731499cf7702b484cfdacd42d64e739a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766249, "uuid": "651679f3-5142-492a-a639-1848b7062713", "comment": "Malware payload (GuLoader)", "value": "c52fc4b841927fd73fc018f81c72845e225ad5e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766249, "uuid": "ac4d1970-2727-4ffb-a0d4-9d3c137206ae", "comment": "Malware payload (GuLoader)", "value": "61e8062e3cef04a0e69f2493ddfb87a0c61807d78224f256100d582a53cef4743f90f5b75bb25a6b6ef5588a1bb9a160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766249, "uuid": "026b953e-2568-4930-ba9a-772db497893a", "value": "D6E39336F2936184E9128170FC11AAFEB9146F312D438D07FAF2774E6175ED3BAA1612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766249, "uuid": "b0003d2d-9dce-4997-9969-21e4309dffa3", "value": "2c08d8f9644132654eb702b279083d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766249, "uuid": "d751bc15-a4bf-47f9-974b-a0e3ad07efde", "value": "1536:mgnyQJZHxyp7dwLPEG2TAl/HPqSd46+R1rp0ghL0tET5uMCwPeY4CNQ3:Fy88d6PEZSvqO46wp0ghaET+wPiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766249, "uuid": "c4546df4-5458-425f-93af-76b3d70fad11", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766249, "uuid": "3ac7db10-fa82-4366-845d-911146bad31d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766249, "uuid": "2f91cf1e-a2a8-464d-b033-852b00a7a2c9", "value": "e6c676ea92d72da7f2d79f8afc468cf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c73cdd-cdb0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mozi)", "timestamp": 1623744285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623744285, "uuid": "b2c5acc3-0025-4ab4-ba6a-5573cc9e8868", "comment": "Malware payload (Mozi)", "value": "16cb4b59e16767a4435ab40820474b76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623744285, "uuid": "ba8a1fe1-010c-4840-aef5-93fead9f3769", "comment": "Malware payload (Mozi)", "value": "4b41223ca64ab6ef4b3b9c9d4257902a32f9fa8cdf4d9f6261b24b8dee81d233", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623744285, "uuid": "16cf9ec2-dbdc-4677-8d83-1f3078b8543d", "comment": "Malware payload (Mozi)", "value": "8b72f28a72f46752dc44b6af73a40d4fce2784ea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623744285, "uuid": "6b700a72-1440-4004-86bb-35209b49cdc7", "comment": "Malware payload (Mozi)", "value": "747fcb645710fb50593c27dbb2dadde9811a0ca5ed6cd1cb232eb61ab0bc55b83f973f99cb1157715b416a674f89589b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623744285, "uuid": "f61bac6b-4942-4112-8bae-df450d6e6aed", "value": "D464D08AFE01AF25E9C026BAFE5F034973634B6CD3DBB111E620972936CA55B4F76044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623744285, "uuid": "6f6d95f2-4e55-439d-8d72-9eb399c4e39a", "value": "6144:p3lOYoaja8xzx/0wsxzSin5wKSDP99zBa77oNsKqqfPqOJ:p1CG/jsxzXnDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623744285, "uuid": "3aec9711-5aff-4fcb-a1e3-3660c862cbd5", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623744285, "uuid": "864365b6-668e-4de7-b17b-c6493007ffc7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623744285, "uuid": "3d66a6f1-48a1-41d3-85f2-488cf653ffa4", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa27906a-cda4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623739267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739267, "uuid": "2d3e59a4-c69c-4acf-afa4-2667b914412c", "comment": "Malware payload (Formbook)", "value": "7a07e240643138074d0c7a0808a28ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739267, "uuid": "2483472d-3323-48b1-abbd-a3d608638a71", "comment": "Malware payload (Formbook)", "value": "4b5ebfee6d9719c8f11ab46444ba5c2c803acacb095ac868eaee346924976d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739267, "uuid": "57d98b2e-a0b1-4df8-95ba-a468fac7951c", "comment": "Malware payload (Formbook)", "value": "997229ecdcc783114ee789b422401a0030967b8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739267, "uuid": "8a01aa11-85e3-42ae-b316-e56b8dabeebb", "comment": "Malware payload (Formbook)", "value": "87a8b2681b8eab647ba12c534f2b6a294803003d095afc343909a69d94a6a1a5fa54afc3702b44d8c1840ac832199417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739267, "uuid": "1c88aee5-cde2-47ab-938c-a2a9f2ab1e8a", "value": "EC2412172EC05C73E71046317B737B76E6FBE68A054423AF67161F7E29392824B22293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739267, "uuid": "e2dc8d87-ac6a-4ac9-b9c8-5173cc09b9f2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739267, "uuid": "5f4d4046-cbda-465f-a1ec-6b59e3a50721", "value": "3072:cLk395hYXJIMDlfU6xjtOc4HEi6+LWL6MQIJLbnbxgJ6OpGPFoPEeu24mAN82jlg:cQqHD2+jL1r/QOny6D9oQv+2Tkpbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739267, "uuid": "429fba2d-c0a8-4f5b-bc3c-df60c707d27c", "value": 222600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739267, "uuid": "05f744b9-e998-48e4-a158-542a2c48fc5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739267, "uuid": "2a1d19f5-cc05-4a91-862d-b994d22cd123", "value": "RE Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeb2ded-cdc8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623754786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754786, "uuid": "56d3632f-f490-491e-b545-3c66a0215d39", "comment": "Malware payload (Formbook)", "value": "3fc45878ccdf12070f526ff0246c1f28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754786, "uuid": "3967f470-a2aa-457c-9a20-c920db4d0c77", "comment": "Malware payload (Formbook)", "value": "4b6bc079ff664edfcf12f0d33f06e5fcfa98e7b6ac4c33fb5fc3c8c7910aab36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754786, "uuid": "99d39d0e-7511-493b-bfe6-842fc069ab5b", "comment": "Malware payload (Formbook)", "value": "10c1f43d42e4f2256f2024485a012c15adee2ef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754786, "uuid": "17365fdd-dc4f-4a9d-a8dc-96cf263a6ab9", "comment": "Malware payload (Formbook)", "value": "d0919a6f9f054266e39762c45cb0b41ae9f9aeb3f241aacba0f54a0787c1037fa69c1203e508bd7fb93d3f65fc166d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754786, "uuid": "016ca6af-fda9-460c-a778-2ca685c2fbf9", "value": "FF45D112F211D96AD03E493548B5D0F842F5FE8B6825EB5F2DC07AAFADB26C5C921703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754786, "uuid": "854deeeb-4593-439a-8220-3f8be34030b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754786, "uuid": "8b3826ce-560d-4f4c-870e-feeb904ce9de", "value": "12288:8kIBf7YDF8ejBvQ9XycNsiaX3Yil3jHpKbHS5NRz9N+MkPsmx9VCZ6vpoByOx:REy5X40THpKDS55N+MkPL5Qy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623754786, "uuid": "b12ed959-3f16-4265-940a-b5e60841187b", "value": 1209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623754786, "uuid": "27c0e848-9582-4c79-8375-f26710d0b95d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754786, "uuid": "3df26909-c19c-4f53-aa19-7f01088ce72a", "value": "PI_OIUYT0987654456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e863beaa-cd95-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623732929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732929, "uuid": "cd4347c6-1af0-48f8-bae4-b9635d0f492e", "comment": "Malware payload (AgentTesla)", "value": "aa9a8e37fb3c282ca1dec1fec08a0025", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732929, "uuid": "4330ff8e-38e7-4061-aff7-54242b3a58fb", "comment": "Malware payload (AgentTesla)", "value": "4d71ddf18e164ed0b070d77fe830087b95e93f7c5a4c15e3cdc2cc3dbcad81e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732929, "uuid": "d322bf43-c59a-467d-aa11-de27c136e550", "comment": "Malware payload (AgentTesla)", "value": "c7905e53e068b320b5562eefd4b297fe169bfc70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732929, "uuid": "c64c2793-6d33-484a-9267-02adb07e98e7", "comment": "Malware payload (AgentTesla)", "value": "d512f24d7e83027eb56793aa8dd7d6afb39ccf702674408bc7c8a28015e8ee9b97dd8e66bdca41c2ed9a9f68704de53a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623732929, "uuid": "fb466896-d189-46d7-ac27-56dd5273b4bc", "value": "2CC4237ED78DC24003596A99A0E0B4F23DB1A874CA89619D776058F65FFC4A8FB1E0F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623732929, "uuid": "65676773-1f73-441c-8247-09988fce7b24", "value": "12288:aTFssgJKEupP0ULPpx8nHipILMt6t+RnJAnN7N4vexzEeKNEuvhqkAFZNT3Vf:aTC+P0ULRxwCiP+RJS+ethqqk2T3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623732929, "uuid": "a4d2e416-362c-41bb-ba21-f2a8635edd3d", "value": 596858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623732929, "uuid": "d8f8b7cf-9088-4532-aa34-90dfef0c36bc", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623732929, "uuid": "610dd105-a238-445e-9295-4a7811da7cad", "value": "Transfer000939TT-voucher.xlsx.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85b1a21-cdc9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623755236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755236, "uuid": "b546dd69-aa57-4b48-8a41-90549aa78433", "comment": "Malware payload (AgentTesla)", "value": "3f55930379405101324085031a4e8268", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755236, "uuid": "c33abea6-6228-4147-b826-8c9da75ea20e", "comment": "Malware payload (AgentTesla)", "value": "4e7f8e062b62807aaa0cb39b664d3615770d84b42cf6654f22c3dff2376e3c4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755236, "uuid": "edbe95d6-acd5-4a32-b8ca-d957b621ae44", "comment": "Malware payload (AgentTesla)", "value": "76e77fbed98809446e8d79e842b7962b700d9682", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755236, "uuid": "f72f0e22-6647-4c29-8beb-bbf66c150251", "comment": "Malware payload (AgentTesla)", "value": "30ec5b6380a14e79a8ef667620d0a6a69ae2597f306e4175faaee8336f2efc94d584d75ee1dd134db3dc6e1b336775b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755236, "uuid": "fa1ba3a6-1206-4b23-8940-9f0986bd90bc", "value": "8E355A8C7555EF9EF4378A3185549C10E617ACAF8227820BA353B77F6A3F3C78A141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755236, "uuid": "673ab0df-d782-4ad0-824f-1c67104e314f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755236, "uuid": "f0bf103a-62e7-4b4c-9a99-6e225f7540f7", "value": "12288:TA165E9VCZ6v2g+Wa4zZxq38U24w3/dRN95N9N0S3nsqs59KfwMHjKjAqTUMaQpV:TANg4k8UAxB08sJ50fwMHejZ2IFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755236, "uuid": "fd535444-628f-47bf-9ea9-b9f2b5766333", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755236, "uuid": "e6a66fc1-1df2-45f0-a27f-4924d794cf0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755236, "uuid": "abba10fb-adcb-49df-a932-dc3d20ff1b98", "value": "HL-883258100 DOCAU BC ORIGINAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4bcd5f-cdc7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623754060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754060, "uuid": "944c247a-7e72-41c3-ab0c-b6b8b8883912", "comment": "Malware payload", "value": "eaa60e776bee518b7ef321b9ee8f7321", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754060, "uuid": "48dfa873-6e5c-4dd7-ae5e-2d9bc366649e", "comment": "Malware payload", "value": "4f7699a27e3cb2d8b53e802f968c0b3f4c86d64cc22d2e92825546e525001cdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754060, "uuid": "ab3f2040-11b9-41a2-aa5e-5b489850ab48", "comment": "Malware payload", "value": "62e0b6f71b787b334c74585556cce3d9eecbb1ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754060, "uuid": "83582fc5-39e3-4dde-9fcc-2eff3ab006d9", "comment": "Malware payload", "value": "02359bea24c1fe1b4e2507405f7f5d8843199cc7e24e701b4c66d3a58e195e5f06ce88039c34c277e81cf0aface7ece3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754060, "uuid": "86c68bfa-a052-46bd-887e-92879643d062", "value": "E615F102BBC085B2D46A413484AB9F66A775FE006F6147CF2758332E1F727C0AF39A95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754060, "uuid": "7f624dc7-d7db-4358-bf1b-69dbb7be90e0", "value": "dabd35e6380e4e172d5ef74c7c6e54aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754060, "uuid": "46fc89cf-2f84-4251-9739-f97bc83771e9", "value": "12288:CquQ++lm14uoyqT4NOYoF902Lttt5SFL/uVfGG0eAyWv2xQcu61tGd8AKFUx4ZUF:BuQ+BJsUGF90Gv5p0eApNdNKFtZUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623754060, "uuid": "9a6918c9-e32c-4852-99e1-541d286523be", "value": 896757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623754060, "uuid": "a1a2425a-9e93-4a8e-8c6e-b77fd73301a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754060, "uuid": "ff0ef888-3c69-48fd-a7c3-a012638d4da6", "value": "eaa60e776bee518b7ef321b9ee8f7321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49ccc51-cdfc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623777134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777134, "uuid": "c16622f5-3cda-4345-92bf-87f39f27cbe0", "comment": "Malware payload", "value": "547af0548032bcd7daa373c051555291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777134, "uuid": "bd33b310-cadb-43d9-b1dd-7d1c4774c9a2", "comment": "Malware payload", "value": "5004d617c2ec0088abb36a94e40fc7d1af274b098a33f92a41a0ff31d32b323a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777134, "uuid": "3d3c9507-9e6b-4cd6-9262-8edfe0842bd0", "comment": "Malware payload", "value": "de7072241afee9b424f8c4d1cc21003bc8133f4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777134, "uuid": "97c06ba7-1b08-44e7-b415-c584cec31473", "comment": "Malware payload", "value": "ef646cebf575175da5549dbe218519b56af04594b8da4ae044666fd54b63953e97f32dd406e9c34d419194df58dcdb04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777134, "uuid": "d7a7c557-c27a-4bc3-8798-0d62cf6aeea4", "value": "0684AE11A7A0C035F0F352B45A7A93B9E82D7EB06778A0CF52E527EA46346E0ED31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777134, "uuid": "7c64bc72-a5bc-474e-81da-3d85db6911bf", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777134, "uuid": "55d4d56a-461a-47c5-8753-16ca7ea24eff", "value": "6144:1Qx6L3USjObKdtJEoSQa7u0rYGOaaBaG+e72Xc:1Qx6L3DObUtiNT7u58aUGVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623777134, "uuid": "a8ae48b6-6da4-4660-a027-1ab77ea9fac1", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623777134, "uuid": "9d26edb1-5e68-4eba-9821-fee928437618", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777134, "uuid": "e260fd07-e62e-4466-88f8-fce717beeeb2", "value": "547af0548032bcd7daa373c051555291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac1ff0f-cdf6-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623774380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623774380, "uuid": "659479af-a067-4977-a00b-8016fbb9ad1c", "comment": "Malware payload (NanoCore)", "value": "de541c222f674a8a3417359ec776eb6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623774380, "uuid": "0b4632dc-028c-423d-8588-55c4fa426058", "comment": "Malware payload (NanoCore)", "value": "5063b42f73a25bd97930a62a6f41c7a7dd723896680037b42753d4e9bc4d4dea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623774380, "uuid": "54bbd21c-5cee-41d1-8bc7-1aea078a947f", "comment": "Malware payload (NanoCore)", "value": "b1b5d78e99a915b9e706233c61b672738430e065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623774380, "uuid": "51bd80fe-3ac9-4532-a3c0-75b796d49480", "comment": "Malware payload (NanoCore)", "value": "cbefc976196217167c0cbb6944548c19aa206df4209ba7d018e512907439fbedec7c1c5c065a67a038354e55928f1809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623774380, "uuid": "75d17d6b-7678-4173-8f04-36c89a167bb3", "value": "0105D0413188DC9AD1231DF258EFD12092BCBD9F9529C60E3783BB2B95E7342249779E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623774380, "uuid": "2593e124-1c99-4ed0-ba1e-7e24672f61ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623774380, "uuid": "1ed60be8-7632-4778-82ff-458ac6228e73", "value": "12288:ltxI/lRVKhizZaXFJ6ggyC9zQRehKD1UeFfvvWzvqZWYb4PyZ+SiyyjK:fxCr0/1JqyCN8hUeFfvQSZHbZYd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623774380, "uuid": "067dd292-21d0-49bf-ae96-f8e36be6b2fe", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623774380, "uuid": "e4fd5a7e-7eb6-4109-93ff-a0b328f8532a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623774380, "uuid": "026affd3-b1ef-4f01-adf2-68891cb938aa", "value": ".pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeaf0443-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623736268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736268, "uuid": "0fd35bf5-20e9-4df4-bace-c854cb845c60", "comment": "Malware payload", "value": "6595db67fd20502701ca10d66d6165bb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736268, "uuid": "cbdf322b-5b5f-4d41-8db0-c5038cd3b6ae", "comment": "Malware payload", "value": "509e06e2fec965b38884ccce0a6b458bcbfec12e8b363de05fa02c4bdf1be0b6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736268, "uuid": "ed7488b4-4bab-4e08-b1fb-70842bec1cce", "comment": "Malware payload", "value": "7cb4c8a4af516752d3790b8fd674aa6bb048350b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736268, "uuid": "ec54b3a0-42fa-47fe-a51b-55d95befb846", "comment": "Malware payload", "value": "fca40ed8e1750c7f58aca47627e1e2baa2ae0d7d98212dc343d62ae34b057a4ef784d767f5aca0e9647041f992df65a0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736268, "uuid": "168bd839-333a-4930-af67-e648eee9e8ef", "value": "66741242B2A0E617D95BA235488BDBC23367ED4A3F0A834FA5047F5D7FB6F110942B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736268, "uuid": "2c1be5bf-40c1-406d-a23b-8b5c0816a8d6", "value": "6144:clhk5CDUJUMEUEl+8myYXxKiKz0jpQ+Wb4+2qREMmIEM1cNbeomCsJN:clhcQMEUElwvXxKDe2YqREMm1vRm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736268, "uuid": "1adf1177-88d7-474e-9606-41b08bd87559", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736268, "uuid": "45447122-3513-4e9a-bf68-4bd75e1681c6", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736268, "uuid": "ab21a4ac-aa4b-4491-8c9b-9dc77c9e8c54", "value": "IMG_02317_06_18.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e61f88-cdcb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623756063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756063, "uuid": "0aa10c5d-3e75-45e8-91c6-dc0f43558689", "comment": "Malware payload", "value": "ecec67e025fcd37f5d6069b5ff5105ed", "object_relation": "md5", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756063, "uuid": "3c435662-87e2-453c-af57-9c645f9db8ac", "comment": "Malware payload", "value": "51ac8ea2c6cab10489188133a109aa4507b76ea459996173d0679d542780387c", "object_relation": "sha256", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756063, "uuid": "ebb57c29-0540-4e05-9cf1-40fa44aa0a33", "comment": "Malware payload", "value": "9a5a0bed2212f47071ad27b28fe407746ecfad18", "object_relation": "sha1", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756063, "uuid": "b624440a-0e05-423b-a61b-7e916feea9fa", "comment": "Malware payload", "value": "379a4b40f11d750bb9c58afe09e86301ab2d9c4ff19ee4e97497674db05cb8ed3bbd65cda207359281800c464aa14039", "object_relation": "sha3-384", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756063, "uuid": "e495d77e-5906-4be2-88f0-41553834ded0", "value": "C625D01175B2C032E5A191B14D7DEB61917DBD340B620ADF73C01A2F6E20AD2AB36E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756063, "uuid": "922d51f1-d9e9-4f17-9ba4-ed3f75ba2a37", "value": "af32313fc3f12018e1ca631ff1044218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756063, "uuid": "de610082-0889-45d4-b235-1b9c02ecafee", "value": "24576:DYCFCdoKbl2cVdrAXIwK3+XwTNkdBAnlXG6+Z1mbX:xsbl2cVdrKIX+XMkUlXF+Z1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623756063, "uuid": "8a1a6415-243d-460e-86ca-ad9ded143138", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623756063, "uuid": "01864311-d27c-4f34-8d27-27da1682784d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756063, "uuid": "61547817-58ba-47e0-9f0f-29d50bee96f5", "value": "pzyh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad02d89-cdf9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623775561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623775561, "uuid": "4aff155d-2605-4d47-9913-5e73f034abe6", "comment": "Malware payload (Formbook)", "value": "5ba2fcdfd0a7734d53337952c19c0bd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623775561, "uuid": "67010c88-977a-4499-bf21-1f96a5b03e5f", "comment": "Malware payload (Formbook)", "value": "51bfdb7398dd33d42e842f59fe527d2123508e855a02dcc151a6bf48638593df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623775561, "uuid": "d1932d3d-7113-4be4-a43b-b52a4b246e23", "comment": "Malware payload (Formbook)", "value": "e454736a26e58e38b48f3031746e9542593c6e5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623775561, "uuid": "381937a6-fde6-43b6-bab3-fe00f220d57f", "comment": "Malware payload (Formbook)", "value": "ce01590d24e6ce1fdd21a4d55cd0210cce6fabfd2f96cf938f3d4348299078657d272d06e3307bd2e5fdd7cc178a5d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623775561, "uuid": "be800551-083d-4765-b989-ab998c77f187", "value": "CCA56BF83201B5DDF5225F7D9567B84002ECAC133ADA8AC3918F77A8D8BD95F9B01462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623775561, "uuid": "b36080ac-08db-4640-bc66-baaa32567441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623775561, "uuid": "9534f07e-4b72-4c51-8791-38597f3ae507", "value": "24576:/EnQIZ1/WBb6S7LRI9S79I3zWdfemBa8+Gefg/k:cnQIZ1/WBNn/h9emBa8+Gefg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623775561, "uuid": "8de777dc-cb53-4794-83fb-ae2f7e9294d7", "value": 2081280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623775561, "uuid": "c9cf13a5-5837-4152-a7f3-72e1216e4514", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623775561, "uuid": "6f9b1367-8a70-48af-9949-9e418617adfd", "value": "PO#006611.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de11c1bd-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623736348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736348, "uuid": "6c2f4820-e366-4c8e-8be4-ea96234d4d9c", "comment": "Malware payload (Loki)", "value": "db52dfb1c82a7b9fab22d0a297c0764f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736348, "uuid": "570f72e3-6023-4b03-9462-51e047b56c70", "comment": "Malware payload (Loki)", "value": "53499e04068f8d1217e291c2d7fbce4d236db4f107b40f807fcefd86c1ded797", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736348, "uuid": "66edc464-9346-46d7-940e-81dd4326a403", "comment": "Malware payload (Loki)", "value": "dfda9fb61b3c140010b1df004a91f3c16ae247a5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736348, "uuid": "b235690d-5d38-4b1a-9a9c-6b12d521c7c3", "comment": "Malware payload (Loki)", "value": "b30ae17f2f030e07e6124843e0c4bd8a223e89dba9ad43015e7774d641f2c4d0f8637a8a0da975f8abba1eff6b6a921c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736348, "uuid": "bf513888-8d7a-4b7b-b2fd-9f5e200589fb", "value": "857533BCA8C30B0BD165597D18A1BF74041CAC709899C27A9D1C32AAF5B7A7105FBBC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736348, "uuid": "f86f7172-d01e-4741-b5b7-5516a366bcea", "value": "24576:CuGm1egPdPrLOsNQ2VuovS9qPudMjMmJcrH+X1IKF8hSH4gtzqKfzDVal96naP+s:11JPdPrLHBvSCudMnJcre1IKF4czqCZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736348, "uuid": "a2236d18-3621-40bc-9d6c-8d8e28d88ed0", "value": 1559552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736348, "uuid": "2c865e80-b59a-4db0-8437-ee819c1030a5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736348, "uuid": "175ba335-9f4c-4442-aeef-fe9af35a82c5", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad724d53-cdc2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623752158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752158, "uuid": "abfd6f0f-d40d-49af-98b9-2bf89f436e0c", "comment": "Malware payload (RedLineStealer)", "value": "c049536ce7b2b2f605379167303c756e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752158, "uuid": "720d871b-642d-46d8-a689-59276f61990f", "comment": "Malware payload (RedLineStealer)", "value": "53d75afea7893819fe0c36a6b26f323c42c7b03e657186aacb49c81d79dec3a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752158, "uuid": "66ad865b-ca71-4dc3-af4e-8aa21049efbc", "comment": "Malware payload (RedLineStealer)", "value": "ada1499b4cb8e7af9d18ae63e2f5e796facb9070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752158, "uuid": "56b307ff-8995-47a6-acef-e04a989a8ea2", "comment": "Malware payload (RedLineStealer)", "value": "a0fa2d9ca6dfa50469e049f7881733426fdfa95a9060c30f3f3a29c25a7bd93427a966f03e91d513541ce246fc199b2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752158, "uuid": "d00b328d-484e-4db6-86d2-cd0df1a72c5a", "value": "C374E84B7A85AA03DABC16B180DF70685374EC469B63E3263DAC637C1D2736999C70DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752158, "uuid": "86bea4a7-d635-4aa6-8ba5-24952ee42be2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752158, "uuid": "0636f611-0bf5-43e3-9f98-d0878b73322c", "value": "6144:RUUp0+Udg/6THWpipL4fN2TypVewQ6DfOU163NZD7gtBd/5hK:RUUp03dbTHr8ms3o37g3dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752158, "uuid": "e34c4bf3-5936-4333-868b-e50822c6248d", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752158, "uuid": "0cfffcca-670b-4322-bf90-b98dcfa3fa30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752158, "uuid": "538b90e5-3021-416a-9d8d-44ab294dd99c", "value": "c049536ce7b2b2f605379167303c756e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95535ccc-cdad-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623743098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623743098, "uuid": "777520e1-de33-49f2-b3a1-599d22f46870", "comment": "Malware payload", "value": "35dce2da5ebce1ccb77b6499a5c7abf6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623743098, "uuid": "ebd8d496-e84f-4616-ae30-82706e8c8bf3", "comment": "Malware payload", "value": "541b8cd09d1e5de3d3c865a899183bce7c00a53901aa74bdb19366887a826269", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623743098, "uuid": "a3431109-e35f-4257-afef-43a91f04a3e6", "comment": "Malware payload", "value": "5d0b7d4d2ca316cf83406900d3c2f05cdd1048c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623743098, "uuid": "1d1ee19b-dfa4-40a2-98fc-2cbe1143fb5e", "comment": "Malware payload", "value": "a2faa51b0bc2bcf315d38cade932dcbe294636806cdb8d020c0b19119e595c509097d5cf5d394b132fe8477e121b2d64", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623743098, "uuid": "2552eb9b-1f8e-4d71-baad-0ce406a7631a", "value": "67057DDFEB149FF7D44685F41992A3B1203064F42E9004039D98E068A4407846707E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623743098, "uuid": "13c2a8b4-e2d7-4ad0-8018-24894f837846", "value": "6:MxlEh/jKjXFeyclltAx1icUyvlKtCOl//yn+klIR41a/LNlM/Eg2/eXG:OEh/G70yUQx10WKtCa/araqqRSEgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623743098, "uuid": "7e249560-7d9e-40c3-bf84-da76c07b91ae", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623743098, "uuid": "00961ce7-5d4a-435a-a68d-68127427f5d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623743098, "uuid": "455a86ff-e737-44b9-b2c2-46841bb65ccd", "value": "Broy.getio54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b702e4ae-cdbf-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623750885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750885, "uuid": "6f9dfd8d-8e14-4167-a427-1e3da468d4f6", "comment": "Malware payload (GuLoader)", "value": "ab19307ba349239ed32f7ec471c882e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750885, "uuid": "0066e25e-5a8b-422e-8395-4b7714bdcef4", "comment": "Malware payload (GuLoader)", "value": "5445447afbc7e74f9a827b122e1b38c4cb9715ec3dfc5bbfbf4805759bfc6eac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750885, "uuid": "2849bd68-1686-4e37-8f8b-1f5abc8c282d", "comment": "Malware payload (GuLoader)", "value": "451cb1fc62f9fcd4d6f5e8b187404d278f21c65e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750885, "uuid": "c470f5db-527e-4aad-b06e-59b9f5b6b9b8", "comment": "Malware payload (GuLoader)", "value": "a3dca0a18f2848af7f1939aef6920a60ab928debeb29f70433fa667ed12c9c501d439f39165338ce37efb093e38658db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750885, "uuid": "34d83601-963e-4218-a892-bf5848fa08e2", "value": "79E39336F643A104F9529070FC159AFE79146F316C478D0BB6F2BB0D61B5ED7BAA0602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750885, "uuid": "9933fe98-9702-4ffd-b09e-73d55ddfef45", "value": "2c08d8f9644132654eb702b279083d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750885, "uuid": "e2688a30-9d0c-4a2d-a603-7f6b59a963e4", "value": "1536:+zg1+OOZDPJGMpTzmqEDAoZH0J4oJCEw3dceV1h7nSH2:AOOZrJGM5q1DAoZi4oY3dccY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623750885, "uuid": "2ea61b79-0839-479f-b5e2-e6492b3e8eed", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623750885, "uuid": "dac40d2a-5a2c-4a0a-a373-5064a4ab7204", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750885, "uuid": "e3efd8a7-1293-43b2-803b-216df7517e7e", "value": "ab19307ba349239ed32f7ec471c882e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7b0737-ce15-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623787618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787618, "uuid": "99d76507-fb0c-4522-9c08-32dee37a4bc0", "comment": "Malware payload (Mirai)", "value": "ad8f7fa06a04269dd396b459e54154ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787618, "uuid": "3dd66ebf-be2d-469a-9fe8-1638cf1ed5e3", "comment": "Malware payload (Mirai)", "value": "554a96a22d39ff8f4954bc65a43a2fdf89f661ee6aa7270c0c7dfcef024f42a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787618, "uuid": "25863551-af88-4c67-9832-709acac1337b", "comment": "Malware payload (Mirai)", "value": "2521963989b4833ce38fe43d89afd73727e28ff6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787618, "uuid": "0aa2f20e-2c4d-4592-88b5-d6f02776f2ce", "comment": "Malware payload (Mirai)", "value": "8695c8aaab67720a9c47b9cf79681374013c4c44dcb025b4d5d10a16cf312d98d8d10db196907ef585c562b6767c246f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787618, "uuid": "4725567a-0fbd-41b1-905b-9bc0571cc260", "value": "EC23F24320D7BA13E03458FA45628CCDB60AA7BCB1BF7BA725454E154C35D93ECB18AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787618, "uuid": "2706197a-56b0-4519-bf5f-c4eaaa7f907e", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFRS79q3UELWt/iw+kvBGg6+fYtrBH8Q:E12O1LCNguovDPH7Tcr2aLWhiw+kvBGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623787618, "uuid": "5e8621d3-217e-4cae-bd2e-a39125461bdc", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623787618, "uuid": "4fec4adb-248d-44b3-938b-6d045fbb9a52", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787618, "uuid": "7482366a-702e-41ee-bc5b-e9476dfdaf46", "value": "ad8f7fa06a04269dd396b459e54154ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379529e8-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736928, "uuid": "190e25de-43b7-44bc-9dcb-09c86f77238e", "comment": "Malware payload (IcedID)", "value": "2dd16d4f9402f0f42e8aa5c9fadb3be6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736928, "uuid": "9524de11-4de2-401b-84bd-0642108d6dc2", "comment": "Malware payload (IcedID)", "value": "56f7208be04fa0f0782538102e0e39638f1849212b81fc63923fda383a90cbc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736928, "uuid": "c1985f09-1a68-407c-b42f-ceedaf65ad31", "comment": "Malware payload (IcedID)", "value": "c629b0cebb2b1082d4c77c8036be6ee756755e79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736928, "uuid": "48cc6f90-9313-4b86-b304-042f41550a65", "comment": "Malware payload (IcedID)", "value": "218007c752e80df458fdd3f5dd148ca67006418e3cf364502aa842eefc86fcc8deadb503dc9b9c3a7bb2665b37794176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736928, "uuid": "9c79ee8c-c845-4fd5-8f4e-0e17f528d44c", "value": "5DB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736928, "uuid": "e158ee30-c2ab-4912-9739-aaae55ec619c", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736928, "uuid": "cd10f371-05a4-4cc8-b041-03af7cd259af", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8w:t082TLrbNGoVMjPR5DxDRoFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736928, "uuid": "a8e4c344-2aea-408e-8a2f-b8567141a7ff", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736928, "uuid": "ec7781ec-cf9e-40da-860b-3fc2758bf51d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736928, "uuid": "3112a138-10ef-4aea-a016-074b42ec91fc", "value": "56f7208be04fa0f0782538102e0e39638f1849212b81fc63923fda383a90cbc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4eb981-cde3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623766279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766279, "uuid": "cc9f41a5-a372-44ae-947b-e46148297724", "comment": "Malware payload (Mirai)", "value": "5b91f227d1370e7a242f58a0391d4c2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766279, "uuid": "422e9354-2957-4336-8863-fca389abdf5b", "comment": "Malware payload (Mirai)", "value": "57f91ef81510ac8ed4d542c0ccdf54cfbd5be19260f2386b777b46fd3054ea19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766279, "uuid": "d9134fcf-42eb-4052-a6c5-0a2d2faa0180", "comment": "Malware payload (Mirai)", "value": "50fc34c71a97584effd9349a0677fad8d9bec304", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766279, "uuid": "a95e4c12-514c-4fea-a7fd-27acab186e45", "comment": "Malware payload (Mirai)", "value": "8e0c79481ebe7e08d022685ed963225a1ccb854b605dec4aff5f0cc1091db66f96a3e0d50f9ff4d8c59992e346a0f7c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766279, "uuid": "8422a88e-8aba-4024-9798-c9d8119f4b6c", "value": "B1C32A49B4020E3CF98BA8F954158F0DFD51539157830F2B99ABFEE37C62166BE02D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766279, "uuid": "d92168d4-0222-4156-9063-1bee5982d585", "value": "1536:XzqefLuC9cekOs5kGd0xXjFnrO7pKH3ritlzYPc+xU+5b8rlGoP695TxFcj1:j9fLuC+gs0pjdrW6WW9hrcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766279, "uuid": "6bbd0a1f-a1f5-4ff7-8557-1dea68df561d", "value": 119192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766279, "uuid": "12c222d6-467c-44b7-8240-5cea70ffd753", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766279, "uuid": "1614bc25-a649-46e4-bdfc-3353796def7c", "value": "5b91f227d1370e7a242f58a0391d4c2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd10b2bf-cdd4-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623760022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760022, "uuid": "88b688f9-d279-47fa-92cd-2c2a45f7033d", "comment": "Malware payload (NanoCore)", "value": "21f944058e508f1f846dd7c4a8074d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760022, "uuid": "3a762bc3-fefb-4c79-ace8-c885a7996e8c", "comment": "Malware payload (NanoCore)", "value": "589b099ab4b4255de96d3bc722dc797b3307aeaa1459278d95f6045c7cae207e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760022, "uuid": "b91d4700-d076-46fe-add4-7146f90b79fb", "comment": "Malware payload (NanoCore)", "value": "0ff3642f47f511635f4035656bf9c4f5f54f202d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760022, "uuid": "f537f390-2768-4832-bfc6-b9c1a00c1992", "comment": "Malware payload (NanoCore)", "value": "9e31647d5310876dea4ccbfd56b8e9bc186656ef13c16744492a66a5c3212ed35adf4843a1baef80ca175ad450a0bd46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760022, "uuid": "f1497ffd-0359-45ed-be97-ec70a14fd976", "value": "EE356C8C7155EF9EF4778A3185549C20E613ACAF8617820BA313B67F6A7F3C78E141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760022, "uuid": "ccc0bd2d-8a00-4265-937b-de6a1140f25e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760022, "uuid": "ee16666c-18da-405f-8e51-8ac2f2bcfa90", "value": "12288:6827MWzl9VCZ6v3UdgV4S131OkCNNJIfUsOM9+xs4yJTIARr8/mGoQhVjuhTuFm8:O7MA3Yg2s3QdwfTOM9q4bR5RIFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623760022, "uuid": "9f3d7dc4-bd5e-47b7-908e-75fd051b877e", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623760022, "uuid": "a0ccbfdf-45a5-4e3c-9352-18d72e028dda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760022, "uuid": "8b50faee-192d-4795-86a4-eb8614eca19f", "value": "TT6-Quote (CN.GRP-Asia Purchasing Order)\u59dc\u4f73\u6021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b043c01-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736933, "uuid": "581ce162-e483-4592-8f1f-77339b42980c", "comment": "Malware payload (IcedID)", "value": "faed5ae641e18d17bedf942f0ec55b94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736933, "uuid": "916e6c2d-0a0f-4de0-b8d8-71675527d063", "comment": "Malware payload (IcedID)", "value": "58e6b0a53443f3ffc0ab8149f8ed1cfeeed67a7465802b75ae03e1cd26402a26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736933, "uuid": "b0770507-80c3-4306-9f45-cd54bc2acadc", "comment": "Malware payload (IcedID)", "value": "ecd91e101a4a76ec473a9736fdecee6c1676ec5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736933, "uuid": "2c460e04-0fd4-447f-b715-9d3981e8217e", "comment": "Malware payload (IcedID)", "value": "8e917fe6ce7a37ccfbb6b0d37588e97325189e9948c32314c923bcb033b2d49554c99a9ad1f280eef8e59b489b0b061d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736933, "uuid": "733a6f29-6791-421b-a5c3-0e221e8dba79", "value": "A7B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736933, "uuid": "781a2b2a-543a-4393-8ba3-1ea7005843ea", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736933, "uuid": "9c9fc49e-200d-4419-a630-42ccd351b925", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8R:t082TLrbNGoVMjPR5DxDRoFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736933, "uuid": "c79c5e2a-7201-40ec-90e2-1376ea93aa7b", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736933, "uuid": "72571f3a-2210-4ee2-99e8-f58705da2999", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736933, "uuid": "e06eed0f-8582-4c96-a3aa-c8550d2cd0e9", "value": "58e6b0a53443f3ffc0ab8149f8ed1cfeeed67a7465802b75ae03e1cd26402a26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a1ff26-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623736356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736356, "uuid": "379c1d8f-87df-4eca-86f9-339ac80ba08d", "comment": "Malware payload (Formbook)", "value": "a1bf5e4a6878ab1525013ac00fc3f310", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736356, "uuid": "3dace570-b8fe-4372-87a2-951c368305fb", "comment": "Malware payload (Formbook)", "value": "590ab95d71a175da7f9ea49baa0d8b51540c9bb74b32052d89d0575af9dae378", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736356, "uuid": "f179f003-0c0c-4538-9c94-f41027bbccdf", "comment": "Malware payload (Formbook)", "value": "68693acaa8b3c31813d564a9f00db9cf94cde2bb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736356, "uuid": "2db8c9cf-ad0d-4a7d-b2e4-1f6703faec7d", "comment": "Malware payload (Formbook)", "value": "5603c9aba447286b3b61c1f8885a54754bbd11dd989068d5d946955de4f0da3ed954616faa0663cad45bc5b3439f1b32", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736356, "uuid": "130d6d34-e1ff-45d4-b3e4-d51bdacc8e66", "value": "93552345BADC5BAEC257A9B4004E6D79653EDC203730C10B2BA473057A787FA0FE5A78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736356, "uuid": "ff6a17e2-113d-4b5e-8c0b-eac7d9197d23", "value": "24576:o2JHDUo1o490LhYKhb+PgwT/OHeHOSJqa2LM61MdJCDeu59MbuT6+:oKHD5tkBhb+BbqPM61YJQpb2k6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736356, "uuid": "b649bffe-0d89-48bb-86d3-e79f135aa3d1", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736356, "uuid": "da89d1a7-9548-4be0-a56d-03556248109d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736356, "uuid": "6347d8f5-6a1c-4b13-963e-3f98ddd8bdc8", "value": "RFQ54609222786.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1544dec9-cdc4-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623752761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752761, "uuid": "1fd8bac4-e883-46c2-9a69-28b9b52e896e", "comment": "Malware payload (NanoCore)", "value": "c0ead13a5839769e3d5fdad29e6ddb5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752761, "uuid": "ff39dee0-54b2-46f9-b6a1-6112fa1b355d", "comment": "Malware payload (NanoCore)", "value": "5a941d8294f1ec2a7482275692de6c05f5100be2a6a34d6ab02b4ec49ab9ded7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752761, "uuid": "d3ca1f77-18c3-45f1-be22-86465989ab74", "comment": "Malware payload (NanoCore)", "value": "5c80e469af0d35ac7e3ef7d684626a5257ab54eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752761, "uuid": "516ed776-542f-49ab-9dd9-3d22f3d04a2d", "comment": "Malware payload (NanoCore)", "value": "a8e3bae9747054914bd724e0192cb845a15bf531cc6f7516c271b521f63eb1aa105dbbc7635818f470b29891d551f216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752761, "uuid": "6f94d208-b662-4c23-a0ab-c7a9129370bc", "value": "ADC4022877B9492FE18E8AB931214513937CC3E7A8D3F3EA28D444F75B162E5460B1E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752761, "uuid": "04cc641b-b1d6-46d9-bc76-b143ef5d55f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752761, "uuid": "09867bb2-393a-449c-84b9-09e6fdd468ca", "value": "12288:SLV6BtpmkIhhDjSqahd/BSav1E1yHCI5nJNc0KoEFYfkWr:QApfeGq0/caNE1yXC01VfkWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752761, "uuid": "54cfbd2a-9df6-4b9e-b6e0-c5350f2ede5c", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752761, "uuid": "15b23562-caee-4024-b1d6-ef4bc21d572c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752761, "uuid": "4e07bfa4-0cde-44bd-9c13-33e0a111535b", "value": "C0EAD13A5839769E3D5FDAD29E6DDB5E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e5e775-cdcb-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623756017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756017, "uuid": "afab47f4-a996-4b20-8245-26b5e98a1e47", "comment": "Malware payload (RedLineStealer)", "value": "c409402102fc8cf262447c5d9e3b845a", "object_relation": "md5", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756017, "uuid": "3be59e79-39da-46d0-873e-d9ba35c4bc4c", "comment": "Malware payload (RedLineStealer)", "value": "5b976ede72eb87c6027fa7cd4aa7d8f0bd46c9105ca955bfb94d86a721f73ed6", "object_relation": "sha256", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756017, "uuid": "7e27d5f3-77db-464b-9c63-1ec2a48aa3ef", "comment": "Malware payload (RedLineStealer)", "value": "ecfa01090a9e0830b9bd596875402cf68c95e73e", "object_relation": "sha1", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756017, "uuid": "ae413007-dbe6-420f-b684-c1927c657399", "comment": "Malware payload (RedLineStealer)", "value": "34cf45c3137539da293c20cc6a1257e661b9ff33ef738150a1cbc654ce6c5b1359221645efe95ffa33c41ff49b7c341e", "object_relation": "sha3-384", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756017, "uuid": "72a5ca04-3b34-421e-9996-6f6df9fdb962", "value": "36F46805E677BCBDCC10D5BC4912C27935A27F64282A9B33A1F9BEDB3635283550EE42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756017, "uuid": "af579af0-a411-49ff-8d8a-bc8d9b6380fe", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756017, "uuid": "ae03c734-f33c-4c5e-aa06-c2c1a66e9dea", "value": "12288:VQi3bv6m6URA3PhGD8p1hf39Wkv8xwJsfv:VQirChhGwpdUMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623756017, "uuid": "4c238d0d-6d3e-475e-9fd3-a4f7029d16ee", "value": 775218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623756017, "uuid": "804b3bf8-63a0-45e4-905b-298aabeb5c70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756017, "uuid": "c26e2558-25e8-4d3e-8006-de69e7c40c44", "value": "IDWCH1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b770996-cdca-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623755564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755564, "uuid": "41f3797f-8252-45a2-b1cf-014bab3d4240", "comment": "Malware payload (AgentTesla)", "value": "1050afef59d2d58f659a4bc5cefa28a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755564, "uuid": "daf677d7-da86-4641-b09e-9c24507d2427", "comment": "Malware payload (AgentTesla)", "value": "5f063032c267a75842862b1d2bc53b4ac86fa73b1b657f5215c27e87bf04edba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755564, "uuid": "bd9271e9-224d-43b4-82bf-6f658e6a1fa6", "comment": "Malware payload (AgentTesla)", "value": "475587366483e42154054b7a646235fcfcacedbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755564, "uuid": "c0cfcc75-8295-431a-b848-e622cc13977c", "comment": "Malware payload (AgentTesla)", "value": "7211b399c7c8688da64b19ef746af51c9c8234854de4bc911498ead3a9499586fd52b541293f94441818f2d65bf1dffe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755564, "uuid": "43ebe77f-7677-408f-a749-d62f1db07503", "value": "F915AE575DCF56AFC6698CB69730AC5682311CBA2609A3123DC234BDD93F1EECD9E012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755564, "uuid": "0d346906-9f2d-4010-82a5-b5c0edd2dd18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755564, "uuid": "d9685153-7669-4f7a-8ff6-9dc848658de6", "value": "24576:NI/ip4mb9S/hyOSg1jvxES1CfFH0fOoaC:MmpehoExESI9mONC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755564, "uuid": "042fc563-97f6-4c1a-9600-6c34643d048a", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755564, "uuid": "7c693b5f-657b-452f-b9e7-c99795796103", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755564, "uuid": "72a0ee7a-36a7-4898-8f5f-17e7ba96e1ef", "value": "NEW ORDER PO 15.06.21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3673b2a7-cda3-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623738644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738644, "uuid": "84ae45ea-efee-45e6-b8f4-9e6c0db090a9", "comment": "Malware payload (Loki)", "value": "127b4f17d1cf7929bd29b7651335bf53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738644, "uuid": "5330b3c7-9bf6-4963-8f9c-886ec13fa1ef", "comment": "Malware payload (Loki)", "value": "5f819efef7b557256567d0e9e58aaca82ee9c8df17ae73fda0e29601b7b07511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738644, "uuid": "90fb7e26-fd38-4295-83c5-55eb8fc220da", "comment": "Malware payload (Loki)", "value": "475d9ee39b95095b30d7fea83ce7c5976f11ea73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738644, "uuid": "779961a7-e3f5-4bbb-8f24-cc9a2e996f13", "comment": "Malware payload (Loki)", "value": "113c82b62c393bcd8c975e55c33a3cff7f3abdfebee309ab59009907a10bec29930f520f41c33fe90f8f2edc712be54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738644, "uuid": "b9d001ed-c11a-40e1-82de-9b10d3fc179d", "value": "12058C9C5559DFA4F07B1B380050D210A26BEDAF9531DA1EABA1FB7F2B373C38419261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738644, "uuid": "2f11d432-e7ce-4223-9a7f-5e74bc31463b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738644, "uuid": "84533000-78d4-4fa4-bff8-337f48de4b81", "value": "12288:dzDbB9VCZ6vaiaxfCYuvzL/S5tQ/88+VJ92IXoUWMPPPPPPPPPPPPPPPPPPGPPPd:dHtai6qJLW8+MIdWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738644, "uuid": "1329b0fe-00ef-4e65-918c-51864ac524cb", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738644, "uuid": "d7bef428-b76c-46a3-8ca0-7acc9cf6f58d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738644, "uuid": "0cc64528-de04-4e50-a54d-5080a439f51f", "value": "127b4f17d1cf7929bd29b7651335bf53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e14bdd-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623736064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736064, "uuid": "80ca8ae7-d7a6-4cf6-a2e1-3f2299a3329a", "comment": "Malware payload (AgentTesla)", "value": "4d9bb8d649b0d5a1b5e5a383930a4ba8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736064, "uuid": "7fba5ac3-be6e-4571-8f15-fad644812194", "comment": "Malware payload (AgentTesla)", "value": "60f6041600f6bf60c479145982b5690541d42fda8b8dc130cb1981a419b41879", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736064, "uuid": "6be84a2b-73d6-4462-93d3-0649332b1a7b", "comment": "Malware payload (AgentTesla)", "value": "1c4f1114b74e30827358f2f83b6791f1119c4955", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736064, "uuid": "b750dd3c-50ce-4da2-bdb7-39cdc77ad0e2", "comment": "Malware payload (AgentTesla)", "value": "4355301f500507d3691ecc7ae975fd1ac0b3a58fb127b2918395a993c00ccd190bd21f0a70c4931055a95cd8d15093a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736064, "uuid": "9eca3029-6d1d-497f-8c08-d8b7991ae344", "value": "0ED28052B3D9CD16F25241718DC3C6C67729BC5DAE0AC24F3385BB0EBDB62B08A21749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736064, "uuid": "6578eee3-2cda-44a1-8688-9d9bf72c2957", "value": "192:wnGNslLZEvA+6/6rrILd/Kf3HO8teLi0s9gUrSBJdf3AfdDby0jchV4t6EqF56a0:wr8iSUR/8dehGrK3Kby0jS4tWF5IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736064, "uuid": "70ccdbb3-bdde-4826-be7c-87302ec1d403", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736064, "uuid": "e00b960e-8623-460c-9598-af6e5b7f741d", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736064, "uuid": "3e0530b4-86b4-47fb-a11a-ff68377cf1bb", "value": "IMG_006_110_38.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5798ec1c-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736981, "uuid": "a137bc96-fb6b-4dc5-acfc-7f2fa7074c23", "comment": "Malware payload (IcedID)", "value": "c4e8e1d0aa0c1e4983aa3f47bff79568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736981, "uuid": "38c19bd7-bbdd-42b8-bf17-d85b75f7c2a4", "comment": "Malware payload (IcedID)", "value": "614099b67c8e42eec7a65e5f1a1ee9b443c45cdfb56342ac0b6d3481566c747b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736981, "uuid": "efcf1c4f-cc76-47a3-9400-5634ff0041f8", "comment": "Malware payload (IcedID)", "value": "e8a4533c8d0318420c128e9c82fd6b672b92e2a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736981, "uuid": "7129e24d-12d0-4fb1-b772-cc04dea06ebd", "comment": "Malware payload (IcedID)", "value": "13da64f681e023bd3b50d06031d3e32e446a2a663561027069ed202a83ea7e857287878df4ab590b16166af681a744a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736981, "uuid": "07e11d63-1ba3-4b58-b7c5-25d90a764725", "value": "C3B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736981, "uuid": "df855ed8-bb51-4a80-a82a-18098cf23d80", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736981, "uuid": "5ddc2b22-835f-4740-bdc3-548c7c365a27", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8B:t082TLrbNGoVMjPR5DxDRoF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736981, "uuid": "8e839e8b-7eba-4776-bd5f-7d0c90aad5e3", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736981, "uuid": "6d3833f4-70be-4a16-9805-55cdfa32a875", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736981, "uuid": "f49880a5-07c7-46c8-837e-cd4bb7901032", "value": "614099b67c8e42eec7a65e5f1a1ee9b443c45cdfb56342ac0b6d3481566c747b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bebab1-cd9c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623735552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623735552, "uuid": "dd3f5356-dcb8-4ca3-a5be-0dfa11856531", "comment": "Malware payload (Formbook)", "value": "05e040086f892078aaa7343934ef5c47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623735552, "uuid": "18646fd1-968d-4d1c-8326-86cb3d5e2d26", "comment": "Malware payload (Formbook)", "value": "617b258c08311b306f17228bf1df3f322d3afe24e7bb94c641e54a671b902452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623735552, "uuid": "cb0769fe-9deb-40a2-afdd-3b420e7e4881", "comment": "Malware payload (Formbook)", "value": "d59aed3ad0a31fd85f88bac7f532894437a0424c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623735552, "uuid": "f5bbb83e-3526-4861-bfae-ce4681486c3c", "comment": "Malware payload (Formbook)", "value": "fe98bff7cb7c325ebaf02929d72c7fbf27388066bf356e866ea1df9716bc0cf7f887ab17226d8681d2d29cd475af8208", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623735552, "uuid": "f7e343b5-bf3f-42d0-b373-7dc02d3cc73f", "value": "EF255A8C7555FF9EF4778A3185549C10E613ACAF921B920BA313B67F6A3F3C38A141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623735552, "uuid": "60cdbc20-a409-47a2-b24c-c064305ca731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623735552, "uuid": "f82ec030-8f43-4467-9f7e-f0e9e14e6b88", "value": "24576:ImwCUdQk9qIfIs92JbUPyDX48uUxt4LdmIFW1:S5RZmAP8PIFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623735552, "uuid": "ef04b073-6b30-4a67-9d6c-14002916cc93", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623735552, "uuid": "02324242-7c4b-4070-88ea-d1058268078d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623735552, "uuid": "8cc43f35-505d-447c-9e79-bfe1c2e824de", "value": "Enquiry (OUR REF #162620321) (OUR REF # 166060421) Taylor Marine Project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04841ec4-cd8d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623729111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623729111, "uuid": "a416cbc5-be69-433b-9eea-c886b6db1e9f", "comment": "Malware payload (Loki)", "value": "aec6dcf258c9f88246508f94f6a8db81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623729111, "uuid": "608653e4-fc99-4c24-a7c9-2cd2f5985904", "comment": "Malware payload (Loki)", "value": "631ca8a74e37d039353116ec1d3790a27ee2dfc0aec5b56006a4aed9a402e17e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623729111, "uuid": "a6cb6209-2c0f-4eca-857f-af4781828650", "comment": "Malware payload (Loki)", "value": "bb6c4f4f36482dcb2cfdb91c37fd4cbb37954bcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623729111, "uuid": "b8d2ad4d-bb3f-4141-adfd-a7cd3786c1f7", "comment": "Malware payload (Loki)", "value": "c54b3b2edf14bf295858af35f28097b46030b9e7f8528678ea25073737af583ebf1420ecf3b66261fc32da4100accc72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623729111, "uuid": "cd5c665b-130d-40ff-b363-202177ef9a25", "value": "D9F302A677E09073DA6A46301A676B76937EFB410722166F57847D7C1C332E38B063A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623729111, "uuid": "1e774ace-5bf5-444e-8106-3d5ed64bea29", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623729111, "uuid": "77da6cd6-643d-4b7d-8383-d4edbe358fb8", "value": "3072:mLk395hYXJzBZMhqzF390JbbXleOPlXFPB9cA3toZGj+t:mQqx0gzF6JvXllxcsqZGit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623729111, "uuid": "349edd93-7d47-4024-aa1b-3f16cd2502c5", "value": 164411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623729111, "uuid": "a7682b1f-e8dd-4af4-beb4-2c52e3098d9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623729111, "uuid": "53a40728-7cca-4193-ba5c-5ce367efb494", "value": "Cerere de oferta 15\u00b706\u00b72021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1457b5d-cda5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623739762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739762, "uuid": "fd652615-1087-4566-8224-1f822de1463e", "comment": "Malware payload (AgentTesla)", "value": "ede3252f66fa7bd7a3009d670cbb7348", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739762, "uuid": "d09a037b-0fbd-4559-bba7-88e05206a241", "comment": "Malware payload (AgentTesla)", "value": "633242128f27a84b53c349bceb0bd084ae6a603d4a97d998635f66dd58865982", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739762, "uuid": "80d93b8b-3fb3-460f-a239-b5343c34f99f", "comment": "Malware payload (AgentTesla)", "value": "f9a15bf9c28502fcc51dae8900e2a757282b26d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739762, "uuid": "a8208a88-1c41-4f63-a7b8-ce48b511b68f", "comment": "Malware payload (AgentTesla)", "value": "c4754d3cb66811cdbc51d59ea164b6c5be85b680db317435f6c5b40115b8973682e28de001698b2e50ea050e42e3ada5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739762, "uuid": "56e1174f-cfa4-4525-8402-1f78b8e7602e", "value": "20255B8C7555EF9EF4378A3185549C20E117ACAF8627820BA353B67F6A3F3C78E141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739762, "uuid": "a29bd6c2-e563-4ba3-9be7-46a4f6d9e816", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739762, "uuid": "4670054a-a63f-4cd3-a44a-1c171512fcd7", "value": "12288:bABlCjkF9VCZ6vePjJuxkkgtmirmbWmqevgrA1HHYlP+Ha2sGS7DvJnsPd055HIC:ala8AjUkkqmgciK2A1Yl2HaxgIFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739762, "uuid": "a293d18b-2d9e-4048-af98-bc7459f4a52c", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739762, "uuid": "5249f517-14da-4506-8a3a-f94e7bc54fdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739762, "uuid": "c35b05bd-ae04-467a-b2e3-4f9b52a3bf26", "value": "SecuriteInfo.com.Trojan.YakbeexMSIL.ZZ4.15612.31400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d0c94f-cddb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623762718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762718, "uuid": "60215520-da22-4576-9bc4-2cc31c4a54ae", "comment": "Malware payload (Mirai)", "value": "3575b155b5b7e81db783b1516bb09bb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762718, "uuid": "7719ad71-c6f7-4100-bc7a-5e71f1771e68", "comment": "Malware payload (Mirai)", "value": "63ad24bb4a28cbd6285757dfd899895e72c52b692c305678b332b215bcd19c5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762718, "uuid": "9176c0d4-f9ab-4e2a-9b50-a8c19d3780b6", "comment": "Malware payload (Mirai)", "value": "d945a84f2de742ba4c8c5b44c7f25fa382e3bef4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762718, "uuid": "8993af57-6c07-4c6a-a146-ca5d229d837d", "comment": "Malware payload (Mirai)", "value": "504764114e36f3d22ddbe919c582e7e2f8b8098eeb096107d84c7ad84492a3d7485b6c9229d5f96591e03de46e822b00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762718, "uuid": "1fb31acb-2b16-4fea-8b8c-21fe389a2257", "value": "AFB318C4B143E9F4DC4505743126FB375E36B1BA222FED97D3F89A636D92A02C80569C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762718, "uuid": "fc06573d-3b06-4efb-aaa0-32caf66c841b", "value": "3072:ksMRCvG+R8e7OJrlMq1z+tFKuUXi1lSx1ptXx4clO513pLBCHSUvXG0DP:r6CvBy4OBM2z+DKuUXqlSx1ptfEX3pxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762718, "uuid": "ab8f54a3-e2c3-40a7-848e-095f75f12c06", "value": 115600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762718, "uuid": "63a68065-c3b5-41f2-b399-ba3baf4023d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762718, "uuid": "8c76505f-a944-4682-b065-1d66ae76a042", "value": "3575b155b5b7e81db783b1516bb09bb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865971ef-cd7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623721598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721598, "uuid": "e33d9cb9-f5bd-4367-8c6c-90ec8033ca0d", "comment": "Malware payload (Mirai)", "value": "f46cb178412fce899ef0a8c67bb921f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721598, "uuid": "98397e1e-0c45-4973-9b75-48fd6d4e29eb", "comment": "Malware payload (Mirai)", "value": "64ef35b188238f0f72ef6cbac59e869bc9eb5193dc45082ee05219c0f342edb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721598, "uuid": "1c890bab-f92c-43d2-9587-b3a0bab138fd", "comment": "Malware payload (Mirai)", "value": "36e8ebddf51c143ce2f947ba5e0d81d75ec00406", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721598, "uuid": "5175e64f-6263-4545-b446-552cd8b2a91d", "comment": "Malware payload (Mirai)", "value": "a1cd5785b272cc3186f814878d7b54c9dbf48ff97f0e3c4d9b68357fe06dfd8eca37fa1a147b4f7001d9ce0f414782ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721598, "uuid": "3261a635-1de1-4baa-898c-b92713fae792", "value": "E643F84AFD81AB01D4D922BAFE4F114A33535B6CE3EE71029E115F2067CAA1B0F7B512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721598, "uuid": "d3370093-ac58-4124-b9a1-0512bf4ee44a", "value": "1536:bNnu3bI0xneM4PaAcx4PCQNdlebi7wcUIX9O:MLI0xe1PaAcx4PC+wcUINO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623721598, "uuid": "85245490-6c1f-44f6-8efc-946bae2096e5", "value": 55980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623721598, "uuid": "acdaeb3b-f785-44a5-a5ad-46a66fa4e435", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721598, "uuid": "b8173dc7-e70b-49d1-ad3d-8b4a76af75fd", "value": "SecuriteInfo.com.Mal.Generic-S.16345.19954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba89754-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736988, "uuid": "d8671e77-02af-4e91-9936-95279bcbfb79", "comment": "Malware payload (IcedID)", "value": "f06ecf7078242c050fb9994630d195c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736988, "uuid": "7abb55af-be78-4e1a-8eb1-7f9270e90b2f", "comment": "Malware payload (IcedID)", "value": "6514011af4f70c3c46a39f869cab741df74ca4600d0e5b16477936d1fc65069c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736988, "uuid": "a6819ca1-9cb4-4c82-b4aa-eff6168a9641", "comment": "Malware payload (IcedID)", "value": "85dcd198ae9092f704e074a96e2ba23ea9c0efe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736988, "uuid": "2e84af29-70cb-4951-bcff-f2594cbf1d0c", "comment": "Malware payload (IcedID)", "value": "3891c5b0e10156d83a4fe6de77ef380fb5b7c79c716a6da4bbbb69b079721bd188a458d20eeb7c55d669fa13e60af37a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736988, "uuid": "b0d25b66-789e-46ca-af52-436b82fc5d16", "value": "C5B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736988, "uuid": "8370551f-c7c5-4902-844c-1c1f94b7e2cd", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736988, "uuid": "39426c4e-4577-4987-b4c7-3d9cab0fbc67", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8L:t082TLrbNGoVMjPR5DxDRoF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736988, "uuid": "e35a058e-77d3-4011-b62f-15f3a9de7d29", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736988, "uuid": "5e67b084-892d-4a60-a66d-3fba19fc8d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736988, "uuid": "a573f550-f9d5-4224-927e-aa5e18bdf4f2", "value": "6514011af4f70c3c46a39f869cab741df74ca4600d0e5b16477936d1fc65069c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e3bcc2-cdda-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623762290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762290, "uuid": "0af8953f-baaa-456e-a1f1-a1a6eeda7788", "comment": "Malware payload (Loki)", "value": "96918bdaf41132ce7468777fea814d05", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762290, "uuid": "52b22687-4e94-4b99-a756-a8d8fc06747b", "comment": "Malware payload (Loki)", "value": "6583d461c94cee95d8a6e1abf196eed880c21164843a60d2ccc9ed4875b8abc2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762290, "uuid": "547838e0-d1c9-4ce6-abfa-3a98a6f4d3b0", "comment": "Malware payload (Loki)", "value": "6d83543f9b49c5627d6929cfc5413d1961da6e77", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762290, "uuid": "44e78b5e-70ed-4708-96f8-fd12b3e40807", "comment": "Malware payload (Loki)", "value": "09302d343980035a1af7809ee06f564b0cfe44993b906a6c25a638dbabd14fd3851d25aaf9637c16068a561a43934900", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762290, "uuid": "8713c812-a5e0-417f-b2bd-e3b8e60c7a28", "value": "D3E433495966CEC1D08D9CDB5B4597348269E0C8BD021E48BFCF184C02A7EE667F7A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762290, "uuid": "8e3f7eaf-65fd-499e-8d22-5a665909b4a9", "value": "12288:avoKKn67lufCpfdUz+FCSqwCgaM4c1pljBDjKCA/TNOdysVtwB+R5A:avhjkIKzfg31pb2CAqUq5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762290, "uuid": "72eacb21-9173-4db9-9aca-612c29d58c44", "value": 701500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762290, "uuid": "fe95f512-8ba7-4cb9-91b7-c3c791a3d606", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762290, "uuid": "63c213de-a319-4176-b334-18c1bf1e1c6e", "value": "Purchase_Order_150621.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7500ff-ce04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623780607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780607, "uuid": "b802b29f-da03-4dca-b6c9-e6ff2e86fd80", "comment": "Malware payload (Mirai)", "value": "264a946f1233cbcee834d5ed9a819392", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780607, "uuid": "23c7a876-e513-4148-b437-01a6462a76c7", "comment": "Malware payload (Mirai)", "value": "66124aa7d439018a3ebe974832cc2a1a9827927ce8dcd7a47206b6c700a4d866", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780607, "uuid": "ee6418ff-2450-4dcf-bc2b-0cc5294e6e80", "comment": "Malware payload (Mirai)", "value": "b36c20ae07ae65b6a8e2202d402271e279f10d2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780607, "uuid": "626b2103-187f-4640-9915-35390224214b", "comment": "Malware payload (Mirai)", "value": "2c6f60affb06dba49ce3b7141ac7c41e753e5a2acc16ac9424b993d9169d39e63ebd7f41f8a16a99c2e8302601201951", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780607, "uuid": "5683bdcb-a773-4dd5-991c-286b1d5c232e", "value": "C8D2E1B0DEADAD42E86AB63A4CDD8CAF70CCB8A37B37461517411842713BC41E1D4DD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780607, "uuid": "7d3ab8df-24b9-4a37-9d55-6753b6108c22", "value": "768:VmN8f6tfoQmQAXV7E1QDvyRVj1pmCEWqx:VmMJXFl7IQyvm1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623780607, "uuid": "1467e1af-ec5b-4e3b-8067-616ba60af75a", "value": 29920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623780607, "uuid": "b392aaf6-d860-4f63-8cd6-7b65c32ae12c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780607, "uuid": "9926f57f-b66e-408b-af3d-cd2a7f0ee99f", "value": "264a946f1233cbcee834d5ed9a819392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a69605-cdad-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623743132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623743132, "uuid": "6fae11d5-9b88-4a43-bca5-3185ad61fa29", "comment": "Malware payload (Formbook)", "value": "0c9a83fc75f4d9a434b685b3a2ff42ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623743132, "uuid": "34866d57-433e-4b75-8002-bdd1dfbaaff8", "comment": "Malware payload (Formbook)", "value": "66c88e666d6a8c03122b527176a9ee1b5b9e24a2aa5a49563e242be179760228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623743132, "uuid": "307137cd-a186-4a9c-9e15-0f7c00ca1246", "comment": "Malware payload (Formbook)", "value": "f25cc6cb2bd7c2e36221a9f42f6c04006d4c9e7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623743132, "uuid": "709a5a4f-fda1-42d2-b2f4-e6a6c38a746b", "comment": "Malware payload (Formbook)", "value": "ea4e28ae33bd67587ce196df31a319dd82d63aff6713ec6db60f115b7a0e5903a8b520db63c8e452d4913236ac91f68c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623743132, "uuid": "5b4c6c3d-0340-44dc-9831-0b76d37faf12", "value": "F32412EA32C80D67F65391700CB66674D5BEB61103711B8FAB2CAF2D7D024AB9639343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623743132, "uuid": "0511df16-4298-4f15-9256-2cdf80f6cdd3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623743132, "uuid": "d5c15169-595c-4b29-baf1-172d0f77f4f5", "value": "3072:cLk395hYXJIMp7saqNPfcdEXbMdMbpZo4BDaiGx4VxSI3Vn+lQeLoKtkmdt:cQqHKhcKXbMcZHONUnqTdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623743132, "uuid": "d998c064-73d1-4d46-987f-5b1e1a65f8bf", "value": 218890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623743132, "uuid": "a49e884b-8cd5-441d-aa66-d58046e31484", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623743132, "uuid": "73f4d9f8-8e87-42c1-ab5c-c61490894725", "value": "LEMO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e32ad48-cde9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623768802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768802, "uuid": "9784ee29-3c29-46b4-b4d9-edea7b8d615f", "comment": "Malware payload", "value": "da7e577b39dc1882d8c2f5819ead22e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768802, "uuid": "d1694fba-3b53-4d4b-8273-2e5819d55795", "comment": "Malware payload", "value": "66e4fb4c25d6f26bd7322782642f7b3ffd5747ca736e64868f8a3c76467bf8c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768802, "uuid": "76a1c742-d079-422b-8476-870856ba09c5", "comment": "Malware payload", "value": "4c7ff9565349068f73d96f48423ee5ae4f832fa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768802, "uuid": "3d73120a-ff32-422a-ae01-ec35dec6be55", "comment": "Malware payload", "value": "5cfa831e1a053e224a2b0a2dc652bd6facadd54583eeae262aba2828dff9cfe0e7a4d9f6927b88e8256f7f06474c490a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768802, "uuid": "cc56e941-9ce2-428f-99cb-bf45dfdc2ace", "value": "2044C943B2477626D0A89C7026ABD12A77FA2D77F21058033AC1BF3767349A77DB0916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768802, "uuid": "12e1542c-99ec-4f65-9dbd-4f90b41d9045", "value": "adaafa2c180eccb7addf1201d12c8322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768802, "uuid": "0d601587-625f-43e1-b85f-83b64e86e2ec", "value": "3072:SH1hZYJQKX+an/XNSn3N59UN9+xc9+OTPl3p1YCxsaX5vt42TM:eyvNy5aN8xK+OB3zYwHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623768802, "uuid": "a131e47e-1b08-4269-a0eb-6dc34c391ace", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623768802, "uuid": "1700f379-1cdb-43b6-98e7-b2475ea7602b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768802, "uuid": "6a82b521-c08f-471c-91dc-88d80acea357", "value": "Cailbers22LongRiflorderlist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9020ceb0-cda2-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623738365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738365, "uuid": "1cbd982f-8e9c-4243-807f-1f3929fe50dd", "comment": "Malware payload (GuLoader)", "value": "3d900d56e0e8284f5fea7752051fe727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738365, "uuid": "e9076049-2ff0-43f0-9cb8-be955d64771c", "comment": "Malware payload (GuLoader)", "value": "686b8fac1748af72f6e0a35af456c7f473de446ba5df5430411c9ffd4c8943a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738365, "uuid": "ac0856f0-9c54-4628-849d-5541d842c3e4", "comment": "Malware payload (GuLoader)", "value": "bf0e7023d260fb580b0ad196d6135d4e5f34968c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738365, "uuid": "492d241a-698e-4bce-aa97-95293e70b46a", "comment": "Malware payload (GuLoader)", "value": "4dddd9b930d1ea1094685347342202c7f65f24589dba1af8fe495249297e08fe17239d712a84d25b1b6d65ac16502f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738365, "uuid": "d4fb39b3-4be0-4111-983d-9fe3fa2f882c", "value": "EDE3B636F257A185F9128170FC159AFEB914AF312C438D07BAF27B4E6176ED3B6A0502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738365, "uuid": "19db1a1a-0e77-474d-9d07-129cfe34597d", "value": "2c08d8f9644132654eb702b279083d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738365, "uuid": "7a1f3127-e129-4f63-9f96-a1bc6374e265", "value": "1536:odUkRSto0lSTokgoofDDTTMpK31whjEVsZCmsRfJeyftNB6zy:0GoFgX//31whqsZafJR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738365, "uuid": "65c63838-9d0f-4e7b-a641-0d262d67d91c", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738365, "uuid": "39c0d8ae-4ae7-4288-974a-a302e5e4ad83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738365, "uuid": "3c9062b2-107a-45b8-af18-a29980f9c3b3", "value": "3d900d56e0e8284f5fea7752051fe727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f13092c-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736940, "uuid": "6b3eee92-aa34-4226-ba42-c8dd74b84d29", "comment": "Malware payload (IcedID)", "value": "c44b9831f0e842482be1e24935f486d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736940, "uuid": "ce63c27f-d0d0-4466-9b39-bd741b92cb68", "comment": "Malware payload (IcedID)", "value": "68bc03cd65ed2813d40346072b3efd9a12946a04a88027b848c134dfed9e2df6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736940, "uuid": "7c38ed1b-b518-4fab-b1af-510318918b7a", "comment": "Malware payload (IcedID)", "value": "94f23999d3c772a8bee97f9981e613766070f7d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736940, "uuid": "8d72ea14-0ee5-4b72-94c3-5e358fa9d392", "comment": "Malware payload (IcedID)", "value": "5bb45095362704017d81d13cfe3bf2c71b53a8132c9b87377e5e1ad610306197b12555c5711c60de9c292e3db12222b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736940, "uuid": "c156683e-ba33-461a-aba6-94f89ec7298c", "value": "4DB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736940, "uuid": "893b1002-47ff-41ee-a9ac-09ab6b8f2cc6", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736940, "uuid": "2001e6ad-e6a3-49f7-bc9c-290c7e32362e", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq83:t082TLrbNGoVMjPR5DxDRoFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736940, "uuid": "f070715c-e02b-4d0d-9a56-465ebb50296a", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736940, "uuid": "4247c052-21b3-4152-a6d0-980f3f178c21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736940, "uuid": "a32711b1-4efb-4df2-a49b-b9f008b8f365", "value": "68bc03cd65ed2813d40346072b3efd9a12946a04a88027b848c134dfed9e2df6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80909cbd-cdc4-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623752941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752941, "uuid": "4d28b0ef-f4b9-4a6b-96fa-af5a5eaaf1f4", "comment": "Malware payload (CryptBot)", "value": "b328b0a14920e302ffab5067f593b0fe", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752941, "uuid": "15a2ca17-776c-4f98-9ceb-f07bd7eaa180", "comment": "Malware payload (CryptBot)", "value": "692cd79942058297af62c116530bc7e70e23c2dfe9202a5d171ba27f09b044e8", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752941, "uuid": "deadf7a5-792b-4191-a349-3dac51fc2e3d", "comment": "Malware payload (CryptBot)", "value": "71f9a56484c84f2b50b18cff34acd4303cef41ef", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752941, "uuid": "35c5bb71-13bf-431d-88d4-13340a9a959e", "comment": "Malware payload (CryptBot)", "value": "a6dab2e47944b88447857ac60cd6fcbf5570258876e9e455fee278fef5a5a5b72889c3ef36112482c41a19a4f39b830e", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752941, "uuid": "14b553e7-e176-44a7-a6f8-a15d5de7aa6b", "value": "24159D82FFD250B0EA91217011F367F60E397E199B2099DBD2903E655A316F27A3B70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752941, "uuid": "0e6f89a5-def2-4a8a-8bfd-9132111c038a", "value": "b75a0e10d09dc263c2f3a47cd7d7c747", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752941, "uuid": "f6c6de35-4ec8-4455-a7f2-d8da2f097ffc", "value": "24576:LtmomKkUUtdsaBP9kvyXwJbsim5oaQ9xjM08tbAXOmgtQDp:L8zQElkvNLRA0SbAemgtQDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752941, "uuid": "a2979540-47f8-4fe5-a40d-272643d5f65b", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752941, "uuid": "5e4c3a55-44b2-4fd4-ada3-073ec2951273", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752941, "uuid": "98e9d224-cf79-4971-91be-c5b0cd69f96b", "value": "cryptbot_unpack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae412706-cdd0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623758172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758172, "uuid": "689a6709-65ac-4ea4-acda-f868b434df89", "comment": "Malware payload (Formbook)", "value": "3e961220355d19e5e1272fd963f4a3d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758172, "uuid": "fede82e2-194e-4099-a91e-15440297ef74", "comment": "Malware payload (Formbook)", "value": "6935472304f1b2e4e19ca521bf82ef1064f62ced4bf0ee3d1b6eac32a3f4b61f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758172, "uuid": "71120607-ac84-4295-beb7-e0bab135de19", "comment": "Malware payload (Formbook)", "value": "f2aa5470d4d9d9bf35946ef8dfdb4c15ac9aa8bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758172, "uuid": "ff2e1f27-4269-42e6-ab90-27f144a5b6ac", "comment": "Malware payload (Formbook)", "value": "48ebab214b5894688d1313e22f5a0e27c362459242205ba87b1792695000b7356d4b45c6f5186fe6e21e554b66aeb567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758172, "uuid": "470a0690-344c-4de1-ab24-5d0f85eeff9e", "value": "9E14121276E9C4B7E4460B7209F78B9BD1BAF300BA11514F33B40EBAA6265D3CB512D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758172, "uuid": "73cb59e0-8bec-4a84-84f5-58d65584f579", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758172, "uuid": "38a57588-ee3a-4751-a5cf-352024d1431a", "value": "6144:Ds9iskF7UH2fJSL4hvAOqFVOPluUT9djCV6T/e9lCbaP3mN:yDWfJSKvAOoCuUxdmVuW9lH3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623758172, "uuid": "3f1a1761-35ba-44a4-b0e4-520a85f034b7", "value": 206434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623758172, "uuid": "0df00d8d-1900-4519-9efc-c92c17e0c540", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758172, "uuid": "bd8477e8-2f22-4286-9a4a-b0182cf0f194", "value": "ekeson and sons.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce27621-cdc0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623751083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751083, "uuid": "9f271db5-77f8-467e-bd3b-a2542fee8d1e", "comment": "Malware payload (RedLineStealer)", "value": "d43c7dc24eccfcce50f14434d37ba6fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751083, "uuid": "e33c06c4-2e30-4665-a489-fc146d540c4a", "comment": "Malware payload (RedLineStealer)", "value": "69de80bd429baa31213095720ab61e8a8ddd60212e735388c4d1af4202e2bd1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751083, "uuid": "6a716ac7-eb8e-4d81-b194-534ff3a01e36", "comment": "Malware payload (RedLineStealer)", "value": "bfa7be7fa939a7bb12855c2bcf840bc74e56f743", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751083, "uuid": "65a26151-02cd-4622-8297-2224e617608d", "comment": "Malware payload (RedLineStealer)", "value": "9bc6c9f056cc4a7a207ffbb7f747fe34c60c2946c306063c040377cfd988f058853570467c1d8fafe052c2538904d393", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751083, "uuid": "0dbeba93-c98c-4286-9197-7ee4df31b710", "value": "4374BF10A7A0C039F1B626F85B7552B4E53E7AB0AB3890CF52D626EE57346E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751083, "uuid": "c3af4ebe-19fb-49dc-9bd1-b0327513a8a9", "value": "e2b37f0c5e7a27c9ff1ef2694c4bbeeb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751083, "uuid": "01c04b78-1ec6-4ce0-8aa2-cf106c76e3ac", "value": "6144:Z8pxxLHbkFXVsdOx1JreUqlsssgUZJbwbipXNPe:Z8pxxnkF+dOjhIDPOtwGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623751083, "uuid": "372ec8a8-6fc3-4e92-829c-63cf34a49c91", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623751083, "uuid": "9ffbd357-790c-4a68-b60e-3f7fa48f972b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751083, "uuid": "a15a1b9f-37fd-4ccc-b747-64d557aa50bc", "value": "d43c7dc24eccfcce50f14434d37ba6fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddaee37-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736911, "uuid": "a314003e-4a33-45e2-b372-5e77d4c7f9e8", "comment": "Malware payload (IcedID)", "value": "8f6427bddb2115334eb0478bf712cfb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736911, "uuid": "bf153cc1-1bcf-4d92-9509-1a40f8105382", "comment": "Malware payload (IcedID)", "value": "6a12c7b92a1ff5cea5cc23d32e4cc05f1ffdd343357f66b94ceb78096091f527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736911, "uuid": "08f6707b-3c33-463a-9b81-b0adc841955a", "comment": "Malware payload (IcedID)", "value": "f328ffcf606d0d89ccab2fa14b2b4c1fd826fd16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736911, "uuid": "5779009a-cefd-4edb-9626-ec5424ea1886", "comment": "Malware payload (IcedID)", "value": "7c534eb58616a362f66ab8cffc62b99e42089723d85aff8a410e4c5daeb25f12a311f3b558bbf37ca6fb67eb81b96627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736911, "uuid": "38a882c9-e6ec-4772-b2dc-32a1c3ac3dc4", "value": "55B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736911, "uuid": "b9a928a3-75e9-469a-84a5-be917793cd3a", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736911, "uuid": "fe008512-543b-4fd2-a16b-d203314de22e", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8l:t082TLrbNGoVMjPR5DxDRoFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736911, "uuid": "a2dac8a5-2a89-4468-b6bf-cf93aac8c5a3", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736911, "uuid": "8ab96086-b88b-40cd-a5a2-2c8b48e2b3d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736911, "uuid": "18eaef69-6817-4b1d-add4-12d15ada090d", "value": "6a12c7b92a1ff5cea5cc23d32e4cc05f1ffdd343357f66b94ceb78096091f527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56201100-cd75-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623718940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623718940, "uuid": "01d351cc-fcfe-45b9-8dda-369ae74c58be", "comment": "Malware payload (Mirai)", "value": "85b8e402c5b0744d73a7ff35eeb32bd2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623718940, "uuid": "838d7ed6-a521-4c49-b663-9f62d716fe21", "comment": "Malware payload (Mirai)", "value": "6a9e91138ed4b55280f009506979ace96392f11c2f99cc7e23943e4022d51361", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623718940, "uuid": "a6f65c16-e2b5-4d79-8b17-d86270f980cc", "comment": "Malware payload (Mirai)", "value": "99602537d5faa031e0d11e7561c1a68b8693b2f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623718940, "uuid": "5ab59f84-4e0f-4722-8eb1-f5169405ec21", "comment": "Malware payload (Mirai)", "value": "6cabc79f7bfde76d80c0432e27801a20b08fff5a0a4c9682ff2e467f7507fab53fc7813d5e0d12b70bdfda05bebedcbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623718940, "uuid": "31e074fb-3af8-4656-9d71-b916ef8c8d90", "value": "6493F846BC819B11D5D822BAFA1E118D335367A8E3EE7112CD105F2577CAE1F0E77A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623718940, "uuid": "c572c5ad-fe29-4273-a37b-5809a6cd2f62", "value": "1536:KlnPvjnm8ZEsvRe8VeEU16kvOe/qyvaP+YUBjKbBUDI28mlp8ial93x5hM1t5b:8vyPsfV1U16m//zYUBjKbBUDD093x5hS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623718940, "uuid": "6f0976d0-addd-4e4e-ab9b-cfde5970779c", "value": 94160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623718940, "uuid": "0bfd3510-2062-43fc-a3ee-fbad5ec54d00", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623718940, "uuid": "2ef5e439-23b6-4162-8417-7056fddfe565", "value": "ns.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f9ddaa-cd7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623721601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721601, "uuid": "cdadd9e2-ac32-4dd3-a3ba-1aa008159cae", "comment": "Malware payload (Mirai)", "value": "4413cf9895d3d35b3dfd8058c47ba890", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721601, "uuid": "76c75dda-4256-4d94-92e2-9066f43418d8", "comment": "Malware payload (Mirai)", "value": "6b34326e0d1a1ac0a2886cf29c13a489694a8d25a60fb3104960159cd05a974c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721601, "uuid": "75f3fec7-63f1-4547-b325-58530e868f29", "comment": "Malware payload (Mirai)", "value": "7f2c5a286c599cb65b7635416752d0525e4e7204", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721601, "uuid": "3437020c-b708-4530-8e3b-00b721995c16", "comment": "Malware payload (Mirai)", "value": "4f942e8b15752a52d78dff59d9c9c97e22609ae5e2b0999e0eb6c33f63a15515a90645125f77c83da9c8c204d622f79e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721601, "uuid": "efb12465-b875-4563-9fff-8db5c65efe4d", "value": "8A13530AFF654EBBEC2FDD3705E91B4530CD640A22A83B393574D928FA1A54B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721601, "uuid": "ca6d4d2f-effb-45fe-b4e1-909e1d6cc335", "value": "768:WLY2zTtLudI8Uvef+U1eN30NVgWPHBmVXimdt8pSj2ZUa:WLY2lxdG+U1p5cf8kMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623721601, "uuid": "741bf32c-4ab6-4247-8ea9-6c6fe301a2a2", "value": 43692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623721601, "uuid": "571372e2-50e4-4d33-b997-0be39e10f69b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721601, "uuid": "2261a180-e7de-4d28-abf2-ecd2b92cd1d3", "value": "SecuriteInfo.com.Mal.Generic-S.16527.8757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3d265b-cdc3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623752562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752562, "uuid": "4348c28c-2da4-4847-bf99-f26655c3d0eb", "comment": "Malware payload (SnakeKeylogger)", "value": "5b00f796ea4794873ee73d90f5cc383e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752562, "uuid": "5294c75c-d25e-4a7b-b7bd-af48778ab16f", "comment": "Malware payload (SnakeKeylogger)", "value": "6b490d67e105ec0df135c0c9c1eca6df99117f4518d30bf6fa8d80144c0ec204", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752562, "uuid": "0de98cec-741b-4581-b42c-58db5a76acbc", "comment": "Malware payload (SnakeKeylogger)", "value": "4e0b29681cea0f72eee95016d7adcacc9f28bdca", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752562, "uuid": "6b735213-fc3a-4b8a-b91d-5658854bdc80", "comment": "Malware payload (SnakeKeylogger)", "value": "63345d5d17a6c412b223eacaa819618644c885e08863e264ce6d16ec3a4079f8ddfbb9134230c1e58847937ceaad7b7f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752562, "uuid": "3f1b1893-4eaa-4c32-a17f-1716c2153a00", "value": "5EC423A5EFE44E19FB14DB78F59C57786CD9B709A01DCB29A80F328A0D29CAD0590D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752562, "uuid": "02801ab4-73d3-42bf-b2a7-2d97192db3c4", "value": "12288:7APdwfx5w2VYV0fv2nJkP1j61Fp2T4PF3l84vX55kw3fuRBfhadS9uLh:0kqv0v2naj6/pFPJzv55Zf0BZad0oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752562, "uuid": "748fefe6-673d-4b7a-ac86-8450606fec8e", "value": 574649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752562, "uuid": "cd51428a-efda-4642-ba2b-7286cb71f8f2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752562, "uuid": "82c176e7-c79d-422d-91bf-b6674a949573", "value": "6b490d67e105ec0df135c0c9c1eca6df99117f4518d30bf6fa8d80144c0ec204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dd02dc-ce0b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623783636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623783636, "uuid": "11e2fa2f-dbe4-4a22-80b5-58ddfa4482a3", "comment": "Malware payload (Loki)", "value": "79a9d9aad7aa0f173d507ce40795fb1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623783636, "uuid": "1a0201fa-00bf-4575-b7b0-2010e2f50098", "comment": "Malware payload (Loki)", "value": "6b69de892df50de9a94577fed5a2cbb099820f7ca618771a93cca4de6196d242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623783636, "uuid": "9f9d8f98-ee65-43aa-abf4-e5175c842ea2", "comment": "Malware payload (Loki)", "value": "8fc6daa41edac90d5851b2eb514816e300f3140f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623783636, "uuid": "d571421f-665b-4232-b5d3-6bfe71d2453f", "comment": "Malware payload (Loki)", "value": "e596e4ee545d26520722adbc7cc51e9a4b6c4f389f599741e2a8316a6f3e7108ba8d9b5ec944f50c9d929c307b5ef715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623783636, "uuid": "2c5593c3-3ddf-48f2-8289-de774d03d56f", "value": "06F3025A36C448B7D86B4FB6047BA5FFEBF497091B32088B27686F9F4D251C5A805383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623783636, "uuid": "1ffba60c-22f2-4683-9ad6-83c1bfbb69a4", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623783636, "uuid": "566ef585-39d7-4f00-bf97-be90d6a8e704", "value": "3072:DQIURTXJ+MD2H7yIY0c65Sz4MgZ44RD+79wkEklxnO:Ds9D2uxtISz+44B+hwrkPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623783636, "uuid": "6183e6bb-0fde-4ff5-80d9-08a5162370d8", "value": 165186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623783636, "uuid": "f3057bda-19d8-4e80-add6-36748a7494cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623783636, "uuid": "bfdce170-23bb-41fb-a4a2-1829c9136573", "value": "79A9D9AAD7AA0F173D507CE40795FB1A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea8aca2-cdc8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623754844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754844, "uuid": "2a5f85a4-3dd1-43d1-abe0-2fc97ce0ef0d", "comment": "Malware payload (RedLineStealer)", "value": "51f770017940eed9a4e6fc6cef96f258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754844, "uuid": "4b3cd9d8-2a68-4fb2-92a6-05a36dda64c6", "comment": "Malware payload (RedLineStealer)", "value": "6bb6382059170763745610333f5d787ad85861b750c217e3e04a9142d38af5ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754844, "uuid": "a16ee9c6-e96f-4256-8239-ac19c6225099", "comment": "Malware payload (RedLineStealer)", "value": "a9133eef4e76eb4f0ab1ec99829f35a3f824fe6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754844, "uuid": "f215bff4-6a8c-4dec-9766-5ca3c934d358", "comment": "Malware payload (RedLineStealer)", "value": "2973a83d5c1ca7b514fd38617dd3e61ac49b75d50cee39f615df5c3bea8d9a2eff3a6b2c500520d3e64433247fc13c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754844, "uuid": "b56171e2-f7df-4c39-80e3-3d6423d9b00c", "value": "D474AE10A790C039F5B612F84B7993F8E53D7AB1AB3490CB52D626EE5A346E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754844, "uuid": "f36c364c-9f92-4cb3-ac5a-458f0676d877", "value": "f8b8681fdae7ff6c00298505c40cf976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754844, "uuid": "6132d8d6-b1fa-4d93-b90e-f0ca77744763", "value": "6144:4v4JRZHTGrU3ZGslNkDS2rJV/ngGDeq22avPXGBZcDU:4v4JRlGrUJFlSXrH/ngqanXK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623754844, "uuid": "3b555f53-45e6-4a1c-9ee9-0a071e5d7097", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623754844, "uuid": "4ec26dca-d35e-4d41-ba72-08e7073e86bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754844, "uuid": "db6d5578-f53a-4831-b345-1e7e3a88c2a9", "value": "51f770017940eed9a4e6fc6cef96f258.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3add84a2-ce15-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623787614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787614, "uuid": "62af8c67-80be-4d66-9991-b5632e977ec9", "comment": "Malware payload (Mirai)", "value": "8f7c1ff3d768ca455ffa1b66e171cdab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787614, "uuid": "a73800da-42c8-4788-89d2-2644a530fc66", "comment": "Malware payload (Mirai)", "value": "6c23a645108bb5d5f5901c766decb940ba643e12fc38c69d9f729db6f5d993ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787614, "uuid": "5805c0c5-d028-4b11-98cc-e3e372401d31", "comment": "Malware payload (Mirai)", "value": "fee3d61ec56468a7086f68fa25dc0531039c5cc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787614, "uuid": "a75beb4f-1693-4a3b-becf-2c07c10d4754", "comment": "Malware payload (Mirai)", "value": "3e4d373aea51c1280f744ae1e878c394cdf03c5dc873039bda00df6c7800744525c357dc236bdcb1de9c575591b28680", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787614, "uuid": "41b04428-5543-4b8e-be5e-b87f792cbd20", "value": "8CB2C01AC0AE6EB4FDDB79395941E2817B619BDF7A61CDC016C15A110622D2C1F8C6D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787614, "uuid": "f5f95919-4243-4f14-b20e-c33da038e4dc", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo/VNM4uVcqgw05Vb:2AApCdvwJr69VJoA8FZtxCo8a44uVcqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623787614, "uuid": "90b773a4-ec88-4069-9587-43c794efa134", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623787614, "uuid": "64c3b05d-8bdc-478f-88d7-de79d6f719c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787614, "uuid": "184076d7-0c19-44a8-bc4d-1bd1896d71c3", "value": "8f7c1ff3d768ca455ffa1b66e171cdab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a350739c-cdc3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623752570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752570, "uuid": "78a8d815-f70e-450d-bece-82548a43c500", "comment": "Malware payload (SnakeKeylogger)", "value": "132d1574bec9b3cd6fe80e77f0414254", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752570, "uuid": "3b90147b-39c9-4ef1-a167-2415cc6df2b8", "comment": "Malware payload (SnakeKeylogger)", "value": "6c39ba2caa1579acd516e4c5e46c1c3681e09783d0e5667ed8d37f04021f3d3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752570, "uuid": "d9b0a16a-04ac-4171-a15a-76c1c19d9ba7", "comment": "Malware payload (SnakeKeylogger)", "value": "a4ac7d53fe99441c81a899fb5de98c53de8c0405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752570, "uuid": "79dba749-1bb9-494d-a1b2-09e371283543", "comment": "Malware payload (SnakeKeylogger)", "value": "f95fa27b97a6eea063f4e3d0755939007b2270a08328974156d67cfcb7d841d8474646aa16b367e34a8f74083edb76f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752570, "uuid": "b5e9b5c3-2cbe-4122-9fcd-43b2cd002874", "value": "0CD42221E7E08755D0BE13788A60A851CBB9EC63323ACB4D9D9539F93D73B1247C13A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752570, "uuid": "2bc6642a-22b1-4aa6-aee5-e60776195694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752570, "uuid": "2990c8a0-95b2-4c13-8c51-3b7a36e4cba9", "value": "12288:XRnZM4e/ZUdtbyOMz0RK0fOgEtzUN3BlB/eJnEu7h5et+EOj8xB:XRnNeBUdtOyKqEtu3BlQNEWClOjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752570, "uuid": "f4235327-4dab-463c-af80-2726f8332b56", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752570, "uuid": "eed01c0d-cb19-436e-b010-71b7db9d4b49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752570, "uuid": "574844b1-c981-4e7c-ae88-435c70f9c414", "value": "6c39ba2caa1579acd516e4c5e46c1c3681e09783d0e5667ed8d37f04021f3d3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa972ac-cd78-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623720102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720102, "uuid": "ef2cb1b3-ccb7-4500-bbd8-dc79fd53b9d5", "comment": "Malware payload (NanoCore)", "value": "1a3db07ce99e3d321989c9eb53b5000e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720102, "uuid": "a0883619-82d8-4c90-bb11-ca0da68f733c", "comment": "Malware payload (NanoCore)", "value": "6d0a05bee1ed3dde1d37ddd662d2368511d18d3f6145da453adae0c250b90614", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720102, "uuid": "c1b4110c-efc4-4bc8-919d-fdf2d073c6dd", "comment": "Malware payload (NanoCore)", "value": "1cd332bc89ca56f08fc52cc8674e9169810f3eac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720102, "uuid": "b9d41655-0546-4da7-9f32-b07fb3956a16", "comment": "Malware payload (NanoCore)", "value": "3972aa5634f2c3f456ede36a0c9473f4987c757084be78581b2bff35111e9a060fec4fd1ed00ca0c213cbb941bbcf190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720102, "uuid": "128f295d-cb58-4cc8-a2e6-3dc506e65ec5", "value": "2A941240AB264212FD4789BBE1F3CE895BA4BF2378D5E00630AC36594933397E1E561F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720102, "uuid": "93174b86-90c5-4cfe-8179-da3f5b4fe40b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720102, "uuid": "47abac6d-b75a-4971-bce7-c5aa5106c63c", "value": "12288:/YhIdTP9FNq0AwWQR2amUyS0YeYnghAHa:whkFAzQgxUDebUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623720102, "uuid": "172886a3-db03-4d3c-933c-53240f95a5b2", "value": 433816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623720102, "uuid": "e5e1bc98-7101-492d-a388-88c29d446361", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720102, "uuid": "25855331-110b-476c-bb6e-a1bd7541aceb", "value": "Order EA566821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654a2af1-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623769217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769217, "uuid": "8b6007ab-283f-4b13-8ed0-3a4903c593e3", "comment": "Malware payload (SnakeKeylogger)", "value": "fdf11301ef7ee93a9a93e7f80fd1c04d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769217, "uuid": "ce381620-d3a9-44e8-94d8-036b09116efc", "comment": "Malware payload (SnakeKeylogger)", "value": "6d0bdeedce14eec779b8333016ff55ffa6f05a1d2c074cab101967811e35b0b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769217, "uuid": "b0c30586-bfbc-44d8-a95a-fa6497de5e2f", "comment": "Malware payload (SnakeKeylogger)", "value": "7db8f5828fe5121234c97dc94a7ba040c000c9e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769217, "uuid": "c0073958-fd6e-41e0-ae3b-5b2448b64b5d", "comment": "Malware payload (SnakeKeylogger)", "value": "e7867863a89d7a857ef9f23edda99f65ec55f6b301dde0a8c4bbaf33523b24f5e0a6d55e10a02fe1475355c1cf27cd5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769217, "uuid": "f0bdce16-8b7a-4df2-9291-446b515905c8", "value": "DFA423BF32E49B7BFC4740362973B3AADBBFA287235082AFB7442EB505319C15945940", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769217, "uuid": "bd4f3ddb-74c0-444b-96b0-7f35e4dadf87", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769217, "uuid": "79e1f567-d6a7-4cec-a88c-001f126b91f9", "value": "6144:cQqHoY9Og4w/O6iQKbzsDvmgHmAPyTC1gMpByEKDO6+iDV6MiSD/LJH+IhGMyJgK:mh9OYi6vmigGcCdiDhxD/LJeIh3xPzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769217, "uuid": "d48c55d9-56a9-4135-8045-6d4249fbb719", "value": 454865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769217, "uuid": "2f981139-db25-47a3-bfc7-3ac5f22692fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769217, "uuid": "beede5c1-b16e-4495-8b3a-32d7cb8d5ae1", "value": "Consigment Details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b8d29e-cdda-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623762458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762458, "uuid": "921702e6-fa78-40aa-b275-4609f8c0de8b", "comment": "Malware payload (AZORult)", "value": "49d6b0ffcc6142e51b14e005c3490d4f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762458, "uuid": "06d10cd2-ebd5-4a14-8521-6b25baa28d6c", "comment": "Malware payload (AZORult)", "value": "6de887246d06a2031eebc6e8dc7636cee8f8f9208e95363c06063ca7c61fa409", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762458, "uuid": "6412d738-ad58-4575-b1fb-87bcb21cdea1", "comment": "Malware payload (AZORult)", "value": "deabb2c927cf31cc9e29a86abe5da55cac048bae", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762458, "uuid": "81cb2045-32f9-44e6-bbe5-1d24688fad92", "comment": "Malware payload (AZORult)", "value": "76b00fb19792a7f3d1cf032cac1608cb21cdff59b7a6559dd1226e7e387aa3db928c295ae8d997aadbc83ecf1f95341c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762458, "uuid": "51cf0182-31f9-43b1-9c0d-a992cbe81938", "value": "ACD423655C32839E69BE95F920B371E99ECFF34318D37E0AC8B946CE54C6DE8105E105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762458, "uuid": "5f062d30-5c65-4648-a0c0-6a90cdf50f6d", "value": "12288:yKKMawNbQQlWDJf8gm5+whmuGQG6qF54QXOrVLqTHXu85uFEI+XFrV:yK5kQl+fFmIcLGQG/sQXOJ+TH+85uF+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762458, "uuid": "bec0237a-00c0-486e-ae33-64c75ff456cb", "value": 627845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762458, "uuid": "d99f5346-4a02-4f18-a010-301f7e62f66b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762458, "uuid": "77d0f581-b598-4d2c-aaa3-3a7bcb06046d", "value": "Purchase_Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6bf110-cdc6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623753820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753820, "uuid": "5ea1f1ef-aa2d-4017-bf1d-c37c41accecd", "comment": "Malware payload", "value": "05ed376b3de1d54ac4af50d10b1f08c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753820, "uuid": "92cf12b9-c0cc-4ed1-aa50-d7377622ec10", "comment": "Malware payload", "value": "6e992161f236fbafbb836065a819195d69af9ba7544ab71542111ac2b3ea8664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753820, "uuid": "43445e71-f9a4-4a6c-8d84-aaef655f6abf", "comment": "Malware payload", "value": "def26ad3020710b39b79b97f4684d9e057c97b1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753820, "uuid": "0c8e621d-8ede-4a66-bcc8-164298546efb", "comment": "Malware payload", "value": "22178416b6d1fdd62e1f6e815a6c0a0ee39cc9a8e7795d6823e592e69bfe4a54b992334ffa1fd8f74398b3e65afa72fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753820, "uuid": "07938931-5746-430a-be0e-f768755ab28a", "value": "C915F102BBC085B2D46A453484AB9F66A775FE006F6147CF2758332E1F727C0AF39A95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753820, "uuid": "e4c2318a-4bbc-4293-bd27-6d9d4430d418", "value": "dabd35e6380e4e172d5ef74c7c6e54aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753820, "uuid": "43531294-de2a-47b0-8ec1-2042b25609fc", "value": "12288:CquQ++lm14uoyqT4NOYoF902Lttt5SF1/uVfGG0eAyWv2xQcu61tGd8AKFUx4HUF:BuQ+BJsUGF90GJ5p0eApNdNKFtHUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623753820, "uuid": "2cddac99-b38a-46a0-99af-3f26c499428c", "value": 896757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623753820, "uuid": "c8c7c36c-ba50-41bf-af9e-e66d7bb69a6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753820, "uuid": "54e35751-3c9c-493e-aa96-3a1ebfd54299", "value": "05ed376b3de1d54ac4af50d10b1f08c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3120cc-cdb5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623746463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746463, "uuid": "9edbd6a1-25b2-4e9f-ad70-a471f11340e5", "comment": "Malware payload (AgentTesla)", "value": "74182f3e655329b3c6ae175ebffe3b76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746463, "uuid": "ecd4a30b-38e2-4efd-91a4-8e11e5a050c4", "comment": "Malware payload (AgentTesla)", "value": "6e9be72aed4abeba3b171ab786f8b326d8c08d449dcb0e7610abe3f0b8405267", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746463, "uuid": "b09573f6-9cc9-470b-a253-a5f520b3d465", "comment": "Malware payload (AgentTesla)", "value": "0911386d4a31934b3bdf6ed3c3386b8e660a75b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746463, "uuid": "24bc1e38-f280-4b7b-bfcc-5740997e3a40", "comment": "Malware payload (AgentTesla)", "value": "d9990e1da3b4fced99e4d1ba12b53f78adf54241fdbb1b22dd50bef7ab0f8a2ab3b39660397d01044d79f66fb775f01c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746463, "uuid": "e9e92abf-1818-4b1b-9922-b7c870d3d40a", "value": "51A4CEB9B3846BAAC3184F3AD697355443E0D113B332F31BA8FC78E46921B485B7E516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746463, "uuid": "271c9102-2e8c-4f62-9d07-99edfd12a06e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746463, "uuid": "b9e84c0e-cc9e-4ea6-833f-a92178d1d060", "value": "6144:uFsS0SSWGp2ek9lWSybaM2RG+zcwxOVbcEkXlbPLnEW92tERnHXDcAJYKu:7SYWGEekrWSVM4GSYbcbhEd6nTPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623746463, "uuid": "75293123-8a27-4e38-a4b5-8fa26ea3d01e", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623746463, "uuid": "abdc6f39-7645-4bca-86c5-70eea38c246d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746463, "uuid": "14233031-a7e0-403c-8ed8-1258117c663f", "value": "PO-4567-09.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ad87fd-ce15-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623787600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787600, "uuid": "1d731e52-cd51-4b9b-bc10-10ac06a21cdb", "comment": "Malware payload (Mirai)", "value": "d26ad08e92860dc30a5cd2518e5a3abf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787600, "uuid": "64a3b23e-cb35-4a68-a45c-77470d2ac3c1", "comment": "Malware payload (Mirai)", "value": "6f959b61c487ad5d77da59819e3f178b8859c0f48ebec8135a61831776525832", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787600, "uuid": "e266d917-26d2-44d3-a6d9-64f646fa53ef", "comment": "Malware payload (Mirai)", "value": "b7e63ae972ee64f4b775e032f188266a1adc9c87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787600, "uuid": "3842a43e-e47f-435e-bec6-92b6936bf259", "comment": "Malware payload (Mirai)", "value": "18d0296d39115ee0aff4df3ebcb0e9ebd9c3c802d2af1f9c5e201ba4e45e6845b626a4182c13d4522d3b8a1326343c81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787600, "uuid": "27dcc405-ab6d-4940-9ff4-f0c5de28a4c0", "value": "8C333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787600, "uuid": "42801faa-bf59-41a9-9d81-48807deae7d9", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380DB:dsfIBZeNlJDFj0imvppqmUJP6Lc8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623787600, "uuid": "4017be7e-7762-4e24-a7f7-60ec7a79a1cd", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623787600, "uuid": "e96f3df1-09f4-4eb5-a85f-0886a5424c80", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787600, "uuid": "cbc7023d-5db0-4c78-bd48-b97cb715f120", "value": "d26ad08e92860dc30a5cd2518e5a3abf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f8459c-cdd4-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623759930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759930, "uuid": "444a7328-5e90-4f3b-9801-bab282317ea1", "comment": "Malware payload (Quakbot)", "value": "2a73d3b181923f7386b6cebb7ddc1077", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759930, "uuid": "b2d777f7-4e9b-4397-8c22-aa10dd51ddfb", "comment": "Malware payload (Quakbot)", "value": "6fb7e5e1dce806ff99a335db2ee5720e2c62377232ca4eb9c3ab4e53b5012f2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759930, "uuid": "a08ac940-325b-4998-9b06-7810d51bdf1b", "comment": "Malware payload (Quakbot)", "value": "cc611c21da8380f3cd8c7218a72076a1e7dd465c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759930, "uuid": "4c9d1420-ea94-451f-a062-a0da9624adc9", "comment": "Malware payload (Quakbot)", "value": "be40665976d8c09a8461fa4040586a737b0a9ac9c53d79dba7c4080723def89c6e609d6ba28cdbd751c58e4d177b84bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759930, "uuid": "a95042bb-ce34-4136-890c-d086e09017ad", "value": "8DA4173777DEC426FB271F7EB1839A5405F2ECA32532512E01E03915F97AAB428A6770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759930, "uuid": "9f95d73f-d795-4885-a031-6d451bece55f", "value": "231d7e371932ddea1d758683abfc0a8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759930, "uuid": "f33c3c21-b844-4bf6-b52b-c29dd448b7ca", "value": "6144:RGoV8njF/EeBfCFH7OEn1J8JRO+njE2X2J/7vKsakTixuc:N8njF/EqfCFHyu1+lFGwuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623759930, "uuid": "5f242b2b-7233-44a9-b8df-0bc233b28275", "value": 460588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623759930, "uuid": "30f2dfe8-678a-451c-ab76-a8e4d8a9c279", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759930, "uuid": "35d8a0a5-f465-481d-b3a9-3ed9732995d6", "value": "lipa.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9a1e25-ce2c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623797576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623797576, "uuid": "94be98b9-028a-49e3-84f1-1ce089015478", "comment": "Malware payload", "value": "ed59308f9e2b59ec4195a99788cee8ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623797576, "uuid": "d0d6c004-d214-4d30-9fa5-ef7d13ccddae", "comment": "Malware payload", "value": "6ff9c8970fd7f82d4e1f448f9d9c32a7f8888eebc3a4a1a0c7c3f1d35965562a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623797576, "uuid": "eafb703b-a8a2-4860-9abc-d54dc2e7bb45", "comment": "Malware payload", "value": "e551671c761bd95746410e2e9eaf2b375f7a330a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623797576, "uuid": "4a6ac6c4-daf5-4284-98a9-dbe730fb2ee8", "comment": "Malware payload", "value": "e961e3b35ade733e876979c8f2c684fa830349ef6639700eec107011ab88c9e1d6e876a08632c9673dfc551ee8a204d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623797576, "uuid": "37dfe777-2395-45b6-a4ba-10446795698f", "value": "B4F3E5631F594473C2381AF6D8B8EB1F2269DD221953F28CA305F29D8928E5DBCF52D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623797576, "uuid": "b3841f9b-ad69-4eae-aece-198a16230b03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623797576, "uuid": "6d234b6a-a7f1-40a1-83b8-2f7b40de45f3", "value": "1536:dHqqPmUWdlNl0U8j/loojDK0op44lK4OZJab7ugtKbudIZcqbzeS5sSD:d/Pm5TWhdxV6ePZAXugtmuWZcqnV3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623797576, "uuid": "f498d089-6043-4fda-ab16-fec0201ff8b0", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623797576, "uuid": "382d2f28-07a6-4e98-9828-c2849f1b38de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623797576, "uuid": "ce63a0db-c934-4a4b-93b5-49d563916cf4", "value": "ed59308f9e2b59ec4195a99788cee8ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a069bbef-cdd8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623761585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761585, "uuid": "62a572bc-975d-4028-ba22-738b65c9e132", "comment": "Malware payload", "value": "793707365df26450bc8642f518a540f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761585, "uuid": "066e1ecb-f6ba-479e-949c-68e2c5acc7ca", "comment": "Malware payload", "value": "7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761585, "uuid": "79bdae45-78e4-480b-b69f-6850d3c19781", "comment": "Malware payload", "value": "66649127ad784288c393992971a197c10f86a8eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761585, "uuid": "0d901ea8-f666-460f-b1da-6838341dffbe", "comment": "Malware payload", "value": "eb09bb2bfec470b3938e301a69dbbe173049007e275e080b15b351ea4ccaa24a5e733d48e7aa64446993bcc6096d40f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761585, "uuid": "5eed9c61-3d03-452e-8776-da6856822bc8", "value": "14657C32B2918437D0632BB89D2FB3A56939FF102E34598B67F51C4C1F79A5039292E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761585, "uuid": "fed3797b-acc6-46d7-a3b7-e0337a2622bc", "value": "019647f8a1eb3148b0e2b8be3fbd329b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761585, "uuid": "5e6ef273-a26e-4f2f-85d3-faaec009ab06", "value": "24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761585, "uuid": "8620cfae-feed-44d3-b70c-3a5bf86f6e5a", "value": 1455616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761585, "uuid": "7e75cc29-50d5-4adb-b355-216c7d49d5a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761585, "uuid": "df635b74-abd5-4692-a129-022f79497865", "value": "SecuriteInfo.com.BackDoor.Rat.281.18292.12946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d1a829-cde5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623767048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767048, "uuid": "5babdc7b-2e41-467f-aa35-169bd90b0f4c", "comment": "Malware payload", "value": "347a50ce48d1868993dc00ff5bc90cd8", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767048, "uuid": "21146ec6-6c4f-4442-acc6-c9e50972e431", "comment": "Malware payload", "value": "717deea64468edfe7837410aed2a54ff7b9aa07a04ff7b52d2b6180511b2c869", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767048, "uuid": "61da477c-c832-4364-bc2e-c0746d4e619d", "comment": "Malware payload", "value": "5da9fd3c826feec0a508e47d391a7da91f6983bd", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767048, "uuid": "420801c5-364d-463e-818a-b554f2f6cb44", "comment": "Malware payload", "value": "7496a7dcf15d2483f8a1f4fde7e6f078e515755014c27617f5f615a7bc07455827033c5f0ba25a5cdac35ed8dbb1386e", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767048, "uuid": "dddd2008-f070-4850-9da3-aaa8058017f5", "value": "18E18E3EE11C9409CBB60F39CCA62AE179E698463143BB09E0C055EE0D5C72A776E0CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767048, "uuid": "c9fc5c6c-fa56-4e50-8075-ba96e42cfdd4", "value": "192:ZILie0deldbofVrUaezzlnYfOOEzDRCQ9fL3:m2edYrUaozlYf0R19fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623767048, "uuid": "a862afbd-9e85-43f3-8de1-db64b248b5d3", "value": 7340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623767048, "uuid": "217b1fc6-af4a-47e7-92f9-30e4b358b2e7", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767048, "uuid": "69b11fd9-8b86-431b-bb07-d6d2df657d7d", "value": "Swift-pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a848520-cda7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623740395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740395, "uuid": "86e86041-24ce-40a7-af43-f33d847b4fa0", "comment": "Malware payload (Formbook)", "value": "c22a0d2e3793852a79c30494607e5e02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740395, "uuid": "668774df-4cfb-4428-9a92-be6677848fa9", "comment": "Malware payload (Formbook)", "value": "72a002cd9cd49afe6f15c5dc2ad7e3f65471b21fd4331202183b87c7ebab7fe3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740395, "uuid": "8d679873-3bb7-4561-bd46-2b583f50b175", "comment": "Malware payload (Formbook)", "value": "79b1412b2d504828037c9419eec4345a50d5f287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740395, "uuid": "8a22a401-fd30-4076-86ba-95b55c7058dc", "comment": "Malware payload (Formbook)", "value": "66ded4b90e687833d7338ce923f6173e1aac858e64c16f5a864dee34e1649bc8d2947cc8b401239ff91bf117432ce368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740395, "uuid": "e6ce6cf6-1428-48d6-8398-173b83578be8", "value": "E934028B75DD28ABE5A112700AB76B2AC3F3EE405510798B77963FEB39322D34509343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740395, "uuid": "3e490e49-01b6-41cd-a210-9c0d0ed0e0ef", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740395, "uuid": "33b4cc22-e585-417b-a910-feb413cfc4ec", "value": "3072:eLk395hYXJeFkM7NEahPWD1sooW3fkPDOo7/uy8XpocOux7OnRoDfNauAKSXAYbb:eQqC7dUj3f56CpoJ0qWD1dUbrj5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623740395, "uuid": "57dc5246-7225-41f5-8b1e-3e18cc6e4253", "value": 249255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623740395, "uuid": "e8847a42-84e3-44cb-92af-8e7097385224", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740395, "uuid": "7d47855a-b4e6-4083-a39a-c30e107dc85c", "value": "scan202106150100101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d662f9dc-cd96-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623733329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733329, "uuid": "8971c654-5854-4e3a-ac54-4e7c61b0adc7", "comment": "Malware payload (AgentTesla)", "value": "69dd69a8acca0e96d45ddc728acd1bfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733329, "uuid": "9b7ca0c1-338f-4568-8518-2105cb5d7858", "comment": "Malware payload (AgentTesla)", "value": "730ce08a2b4c1e2114ddbbf4f1fb8179732d1d30d691fe329712f1963c06e824", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733329, "uuid": "b15aa159-e50d-43dd-acb4-2383210b39e9", "comment": "Malware payload (AgentTesla)", "value": "3ba93bf3ec1dfd08ba871d868053269d5a49e6cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733329, "uuid": "c424e2bb-71e5-42a0-b8bc-51219e3a2d9a", "comment": "Malware payload (AgentTesla)", "value": "f968b515572dd9a8772fad92cf7c5d9ac89ef8e0d014c76ac194739cf010c863ea6465170e8a2653f6750ba237492bac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733329, "uuid": "7884ccbe-5a0d-4ff3-90e1-f5a35c6aa2d2", "value": "765523E2FCD84F6FC9645AB5059BD23CC621DE282744E45A336A3641B7362F743823B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733329, "uuid": "9ee98772-ddc8-426e-b988-efb4fd46fd98", "value": "24576:upRBilmAdZZ6rdrCyUQzusgc4bPoM0bC3BkwycGOqtIkpbwsoFCfeUsG:upNAd/65eyJzujnkhc2IgbwsBey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623733329, "uuid": "6bbfde45-c01c-426f-956d-63fcb9824719", "value": 1285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623733329, "uuid": "853f244d-15f8-4716-9ac9-d9907c89a9f7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733329, "uuid": "175b5624-7dcd-44fd-9e7c-d5650e212863", "value": "payment5001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d203594-cde2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623765713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765713, "uuid": "5e83c9c5-4df4-426c-b0c6-defe173c91fa", "comment": "Malware payload (Formbook)", "value": "db582994c2605735c2922073ebf2a358", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765713, "uuid": "0d35c5bc-4741-468e-8609-736ce045fa26", "comment": "Malware payload (Formbook)", "value": "736b74d03edff07c49f26720ebb765560f72532043ad14319ebe1fccfb246a5b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765713, "uuid": "cb1192a1-c4e8-477f-9587-459cdc777d81", "comment": "Malware payload (Formbook)", "value": "87712ef1f41377925e3def23a7d6725b69b306fa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765713, "uuid": "6222c41d-cc60-439f-8128-32d9e0f76192", "comment": "Malware payload (Formbook)", "value": "081179db947bebd04aab7b249c9f8260e5a59d92badc630c1af35b9e7a120e99f6314b6501ef4eb5267e9a5a0cc7c20a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765713, "uuid": "85ccc6ae-3a58-4134-88c2-0688a0bb7a35", "value": "525523F9FC8E9F3FE23819B64E63649C2B588E18570054236759BB6731372B2139522E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765713, "uuid": "df890b33-4138-430a-b510-649f1b3da194", "value": "24576:rwrwGbbMPt7T6uckQmxuTJoCczbwCgzZ8Na4WCFDzoDKeWsvACiF47ID6mIzHR8T:0k116N93JWbSzZ8yC2DK73jF8IDjI98T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623765713, "uuid": "41adfb7a-678b-4464-8a76-092a0ca4dd86", "value": 1399808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623765713, "uuid": "483e47b6-802b-4f44-ab9b-01b07c08e6df", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765713, "uuid": "20258f96-8aeb-4edf-9068-e721851a0830", "value": "INQUIRY for IFM 20207.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d9f1ef-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736970, "uuid": "7b25e916-e1a5-40a4-9d7c-58ced7c437e1", "comment": "Malware payload (IcedID)", "value": "3a8da75aae1f805fe49822af2e448cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736970, "uuid": "fc5fb774-5ad8-4feb-ab64-5427f0871940", "comment": "Malware payload (IcedID)", "value": "741b4fefbd21f9bbc8f889553ab21a19b07df0e3b1a2efad7bcc50d4d518c066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736970, "uuid": "28ea9799-96ec-4bab-b8f7-4f4d8aec9bed", "comment": "Malware payload (IcedID)", "value": "5be0904749a5ccaff2fb4c10e3e55fcf7c748ba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736970, "uuid": "9d7c836c-1d12-402c-96e5-5f272217c312", "comment": "Malware payload (IcedID)", "value": "5ee1eaca96baab57837279c7e4ee82328eb471687783edf6ec2648d23cb68601b6628d42e382117ec45a41480ec507aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736970, "uuid": "9f2c5338-85d9-47fc-9080-34348e0bf6ed", "value": "2FB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736970, "uuid": "91337a31-c045-4afc-8c75-e5beccb264fe", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736970, "uuid": "dd3a845a-4875-4b88-b555-931b6eee1e57", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq88:t082TLrbNGoVMjPR5DxDRoFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736970, "uuid": "a6319bc6-478f-413c-93fc-cd01212c4e58", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736970, "uuid": "f061aac1-3c47-4053-9923-9e6ba648be4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736970, "uuid": "6adffb7e-7aa8-4f12-84bc-cb50a62a8666", "value": "741b4fefbd21f9bbc8f889553ab21a19b07df0e3b1a2efad7bcc50d4d518c066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014e81c6-cda6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623739843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739843, "uuid": "c7e8c69c-f625-43fa-a111-a20a813e27e9", "comment": "Malware payload (AgentTesla)", "value": "bf300e4cb042c9439252fa3e41ba56d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739843, "uuid": "5c8b0d5c-cd8f-4b31-9afe-c6ccfd04e496", "comment": "Malware payload (AgentTesla)", "value": "743f2455a7a6da6adcd800890c675181ce9cf56ac9e30e13106f50b19e53010e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739843, "uuid": "780e29e9-0eae-4d27-ad3e-fec2c3af78ec", "comment": "Malware payload (AgentTesla)", "value": "0b42ec4e8fe6e23e1e43a9eb72c9e1004a5619f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739843, "uuid": "b130c095-2f1d-4738-b94a-bea1fcfbe818", "comment": "Malware payload (AgentTesla)", "value": "164b3e8365d1a0d2aef00b5580414d370dacb38f1c0c3d9b543a56362b549f7a8c3e94aa930281f87265e3caa5e30175", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739843, "uuid": "82c955d9-c936-414a-8086-11d2b7ff7e43", "value": "E315BE575ECE53AFC6658CB69B30AC56C2311CBA260963123DC234BDD93F1EEC99E412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739843, "uuid": "25dd9a3d-c1d6-4822-88e4-9de9d561e364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739843, "uuid": "96814f1d-04d2-435c-9f47-df6b5645809a", "value": "12288:MSk/PSMPQipP5h2rCCU9aKkUv1cYgPKc6ys+tIlMvF4koWi++S3w91VoBv9YR:MSk/Sip6GZxv29XDs+zojH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739843, "uuid": "d6cad534-5421-42db-8498-27bb6b016990", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739843, "uuid": "44b31101-64f6-434b-8bf9-6008d6b12234", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739843, "uuid": "3826da84-9803-4e84-ad60-49a5d1655ac5", "value": "AWB-18267638920511_Pl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb316fcd-cd81-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623724290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623724290, "uuid": "dbea27b5-3600-4b16-a5eb-c9a406806035", "comment": "Malware payload (RemcosRAT)", "value": "3e362679593f940a622fe45135a5f45d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623724290, "uuid": "b596819b-eafc-41f0-86b6-107f0200cd5d", "comment": "Malware payload (RemcosRAT)", "value": "755d1705b3e251b03d2dede382eab3891eeab12db5550846a63dac632cdf04a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623724290, "uuid": "a00c5129-716b-44cd-a4f2-a4c0a370bfe1", "comment": "Malware payload (RemcosRAT)", "value": "9479d694e25e8d4d005d9dea69837f5e0e22cbaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623724290, "uuid": "d65aa86f-b542-4473-bde9-9de03851f109", "comment": "Malware payload (RemcosRAT)", "value": "3afc715f03a126ae6812994e8e8c10ed5e6d9054c2cb5d54462c64459e24ba6d0478ff6c02b6bbe9e588788e532d699a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623724290, "uuid": "8359961a-c8aa-4ffd-b90a-fe1a7b45db2c", "value": "8E826E1697801AA1DA5F5B31A0F05F081639FB4B7FA2CD576759D0488D43B0F09A8AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623724290, "uuid": "7dd6e7cc-deb8-4f48-a2b0-ed6079ac38a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623724290, "uuid": "71b4cead-625a-4b28-998a-8bb05d004f8f", "value": "384:ijIyFeQXzaeQFeLfW/Pnkcotbg1EXP2F3r/h8:i78peQkCkcUbg1Eizh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623724290, "uuid": "fe30500b-f443-42a7-9ab7-b58da0538fea", "value": 17792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623724290, "uuid": "e6a1a5ef-ed08-4032-a671-b1d2ca43b9c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623724290, "uuid": "2bda068b-b852-4557-b1ca-f8f374ec79c5", "value": "Factura Serfinanza039947665133458256509618413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bbebd7-cdd9-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623761802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761802, "uuid": "07bfd62e-6910-48c6-8313-ef7448b0394f", "comment": "Malware payload (SnakeKeylogger)", "value": "f16c5825676c2fb12d114a9c0dac6fbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761802, "uuid": "03fb696b-af9a-461c-b523-05abfb570fe3", "comment": "Malware payload (SnakeKeylogger)", "value": "755f2e37b933b8b0d9521cf1419c4188ff1c79a4a2ddfa11942e5382c28c31f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761802, "uuid": "cff6b14f-9765-47cf-af93-6730f5b92b01", "comment": "Malware payload (SnakeKeylogger)", "value": "763b4ab0d9b06c84c859f7e7ebf213d7132d33e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761802, "uuid": "4d58a70d-a70b-46c1-b395-57d9d2364c0f", "comment": "Malware payload (SnakeKeylogger)", "value": "5819f2b5b1c944dfa62deab7ad2000c1aaf390447a5a02f3d651499e743c8da4068007f80270b3257c1a9601c6f0c299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761802, "uuid": "529818ad-5dfb-4f9e-a996-bdb1e0fc91f7", "value": "73B4128A67E086E3E07E407DCC96DB5A52BA3D0C2693404E1F34F92D7C752D9E816E4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761802, "uuid": "1be4d2db-3a68-4101-b4db-a98c3cbb2027", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761802, "uuid": "761c6984-098b-40f8-b02b-f6ba4c2319a6", "value": "6144:cQqKFey4W3d2yhMjSSqlsXt9SjjZPZalRK/bbj+KioZhwvACQRXBoSe3ut:XgqxMjgsXt9yjlZvzBkZQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761802, "uuid": "55dd93dd-f555-4645-9146-65c25448e05e", "value": 531422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761802, "uuid": "303cda44-722f-4340-ac46-e5ed23dbd55f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761802, "uuid": "75f52a3f-7301-4105-8ccc-b14f73895cb2", "value": "TRANSFER COPY CITI GROUP00048579_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8760a010-cd7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623721600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721600, "uuid": "d2343248-3190-48e9-8ff3-e6383260905e", "comment": "Malware payload (Mirai)", "value": "1afbedcdcea304089ff46a7a102a2286", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721600, "uuid": "3ad6c8af-ecf4-4fd0-9bf1-4f687f7d9bbf", "comment": "Malware payload (Mirai)", "value": "75aa0371f6c3b08bb619bd83cb5fe81ec475305b8832fd171561811b71571a76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721600, "uuid": "d724fc31-164d-4103-824b-9c8483821d6b", "comment": "Malware payload (Mirai)", "value": "46aa1dec87a7fccc8afb0136e0ace402228b4fa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721600, "uuid": "b148bd0b-8d66-4b76-aa8f-04565762f4a7", "comment": "Malware payload (Mirai)", "value": "0070d6528004448077b410cd2cd3641276f0ec08538bf7a143d56a923b222970fb4271bf005dfe507802ebf66fbe14bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721600, "uuid": "f39115a6-2e67-40cc-8888-f973c206aed2", "value": "7DD2E802B71D0E43C1622EF03A3B57D1A3AFBDE121A4F248760F9A49D5B1D365286EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721600, "uuid": "0a8d68a4-7b5e-458d-8510-0b135a1e59bc", "value": "768:ClUgFkt5LvR/kRCp5JIOyLVVDeZ57fTtHj0Liv:Whkt5rJlp/ILbDU5ntHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623721600, "uuid": "537a5eac-805c-4b25-8804-de31322c5583", "value": 29632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623721600, "uuid": "db9bbfaa-caec-4145-bf64-1346ea5ef195", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721600, "uuid": "a77e4950-3731-4897-a53f-16f8d30ec332", "value": "SecuriteInfo.com.Mal.Generic-S.29328.31146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ee7767-cdc9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623755225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755225, "uuid": "df3d4e1f-d1ba-4aef-ae12-7ee811f296a5", "comment": "Malware payload (AgentTesla)", "value": "ae82f3fe40ac39771c4125f44cfea7ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755225, "uuid": "e82507b0-b47b-4a2f-a212-2bf49c7b5834", "comment": "Malware payload (AgentTesla)", "value": "77a588872159997997e20a73e6655ebc0dbc9eae7a7d0e8ec457d1e41c7c1f72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755225, "uuid": "993e6ec7-8a62-4a6c-90b0-fe4a0ae58ba5", "comment": "Malware payload (AgentTesla)", "value": "787da79c22843a7a9cb0f667528955673bd55ed1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755225, "uuid": "8f5cee12-d1c8-4bf8-a6f1-eee6d4b7bf57", "comment": "Malware payload (AgentTesla)", "value": "b62b98879145f54d9776860207f939af29cb7bafe8b35c4fc7081550aa5d84b866755101e0d511021cb5f3d3ff5f3694", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755225, "uuid": "486aa0d8-4ff2-4375-85f4-9ccde022a596", "value": "DCF433CE64E6C037A9E134E16753FE04047AC23EA5E0D65081C3A3B49EE95F72B91A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755225, "uuid": "71098110-5aa1-4c75-99ba-1a8776fc68b5", "value": "12288:+N4ZzBYkgf4wqMzvRm3gU64+3/db595ZJN0+3XsSs5Pahw0HjKTM31TZ7ve:+izBxgUMGgUind0SsR5yhw0H4M3197m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755225, "uuid": "1fe4caba-6fd1-4fa5-8837-219d2f1a46a7", "value": 751667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755225, "uuid": "d40369be-5316-4759-8f96-9320e5a54dfe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755225, "uuid": "acd5bdae-b019-4c01-8fde-242040060d4b", "value": "HL-883258100 DOCAU BC ORIGINAL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebba998-cddd-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623763568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763568, "uuid": "d2bb9b2c-cd7e-468e-a696-621eaa634341", "comment": "Malware payload (OskiStealer)", "value": "f7dac5ccd0edfb68039c6fa91c1e6b28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763568, "uuid": "a9abedeb-d5b3-4a98-94d6-ef86df462e26", "comment": "Malware payload (OskiStealer)", "value": "77b4f58b1d23281f1ec28fbf39aed67da97011a48a489381c350e79c45646e3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763568, "uuid": "def4cff2-f6a9-4ff3-879e-fd1676820f6f", "comment": "Malware payload (OskiStealer)", "value": "1eeb2bb6ee1e1b001a15b44838fe4e950c628b9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763568, "uuid": "a3b7676c-eb0c-43f7-bd4c-bd5e85660090", "comment": "Malware payload (OskiStealer)", "value": "d3d767ca208b8bc8fff5c9398959fa56d35c6ab059082e790fa0eece77aded039d2093ea6290d387775d686e9f37549f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763568, "uuid": "69835a51-9a02-4104-a0b9-5aadc00a7896", "value": "EC3623B4E350D079E4930035EAA547B9FDA8F9315B4980C7A7D21B2A4D782F2DB721E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763568, "uuid": "85fad5c7-2ffb-4853-9a0b-ec87b2548ec3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763568, "uuid": "3fcb4bd0-b4fc-4dc3-9b73-1c0b166f7cf8", "value": "98304:lKpaglerGmT91phMuNb5hzjVPNkVHh7jOfBjj+E:kpatrFTJZhVyH16BP+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623763568, "uuid": "4e651e1e-5f80-4a50-ae05-33e702fa82c1", "value": 5218304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623763568, "uuid": "d15a448c-493e-4e5e-95e1-642717cfc211", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763568, "uuid": "34b74020-a370-4180-a16f-1e6478dbf33b", "value": "F7DAC5CCD0EDFB68039C6FA91C1E6B28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b1024a-cd95-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1623732891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732891, "uuid": "c18b6762-89d2-454f-9b47-374c296545f1", "comment": "Malware payload (Vjw0rm)", "value": "b1b2dd2213146d45738d8ca5e9587378", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732891, "uuid": "55b40c6d-c3ad-4156-a451-2c80ff6be1ee", "comment": "Malware payload (Vjw0rm)", "value": "79899cb1e5d57cb43da0e8c306c211b7992e647af5c598a4c7522d306f255e09", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732891, "uuid": "c4b296a3-00e3-415b-af50-9a32e8978d0d", "comment": "Malware payload (Vjw0rm)", "value": "87b3e3971dfa9625e989b1efb38af810b2f2a1dc", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623732891, "uuid": "4520de28-59d0-4ff1-af2d-b2a4b62f9209", "comment": "Malware payload (Vjw0rm)", "value": "4696e31249857b3907a57582154127ade8b7fb9d5a4c4f2b958a653d7428d0cb957c9cd12d4b9000ef244a06e7759ee8", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623732891, "uuid": "4873eab8-9cd3-4955-b304-d1c391bfdb0a", "value": "E1E19ED2CE79C06ADA4B427005C8AF1A963F4207CB9697FCE987D118C45FCD2E971AC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623732891, "uuid": "1f06cf53-d25f-4c1c-bb0f-7c16af51a3da", "value": "192:TX4puL0iwhtKqsR5mo2P6L8q3Fot4vr3t:THwhy5F2yoUPrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623732891, "uuid": "1da5f382-e826-4b5f-a975-2bf751a22002", "value": 7440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623732891, "uuid": "2041d71b-5bc5-4c6b-8c45-975201a5ee5a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623732891, "uuid": "5240fad9-89ae-48ac-ae9a-df914296fb44", "value": "1ZNMAOPMAS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588db19d-cda5-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623739560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739560, "uuid": "cd11abc3-c247-4d52-8564-c87e82f7fefc", "comment": "Malware payload (RemcosRAT)", "value": "899b47a0b0d0d8022f68c80cd318e88e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739560, "uuid": "a5f68bf9-f89a-4bc2-b9e3-c33477090ec3", "comment": "Malware payload (RemcosRAT)", "value": "79e4617ae582f1bb2d40997fc5acad76293cc91dfeacbf23145052b4a8487d26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739560, "uuid": "d31df9a3-e19d-4326-924a-41f11486e109", "comment": "Malware payload (RemcosRAT)", "value": "c714fa510529ff5ae7840d727f03211e7c03b3bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739560, "uuid": "6868bd41-b8bd-44af-b76e-b9f64ffc13bb", "comment": "Malware payload (RemcosRAT)", "value": "dbc1791dd8aef2a89b3bf779dc25f5705423e945787a284546c53f292061cda3510bfca0e08cb105e208178c77c2d23e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739560, "uuid": "1e09dc8d-c6f8-4eb4-9db8-412cc906e903", "value": "61156A69A2650931D82716B8CE7BFAE825DE3D1136648D061BF73D85EE397C7200A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739560, "uuid": "8204d732-089c-42c8-b0b0-a6fbde5ccfb6", "value": "5d03253373fb0f9ff309efca685fcbc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739560, "uuid": "045a831f-c13e-40b0-819b-8c780072dd58", "value": "12288:uu62O21Q9SUxQTnn8rh5aFUdMUgGj3LxRoBQCpK/yYPtbxPjtTHDfPnbetkkkAqK:x5RKggrhmWPyIPtbxpgq/XQBwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739560, "uuid": "8b343210-0685-4b57-ac57-1f83733370b6", "value": 932992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739560, "uuid": "a47928ec-27c7-4b0e-9930-b75fa5d64160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739560, "uuid": "7fa52e6a-44d2-4320-af7f-05a9cb4614f9", "value": "Yeni sipari? WJO-001, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b22c1e9-cde9-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623768663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768663, "uuid": "556c201f-cd67-46b6-a39b-35dc2b4e1e5d", "comment": "Malware payload (RedLineStealer)", "value": "714e2d581d52f955592a9d77571a9f9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768663, "uuid": "f9b68b03-4228-4039-a747-5f6794f3ff17", "comment": "Malware payload (RedLineStealer)", "value": "7a6db2fb6f1844f2003b1b6d914728331c90c9aab0adda7e75dd13c69c05aa2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768663, "uuid": "01664226-2882-40c3-9dc5-ca16921e9d61", "comment": "Malware payload (RedLineStealer)", "value": "0b65bf32f3ed1d5c869852d96edb6d9aebc2b303", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768663, "uuid": "448503cd-07b8-4265-9589-2fe8003add67", "comment": "Malware payload (RedLineStealer)", "value": "8c4d0b6a1a04a076ac51208c95583cdedd9c24db7bbd0d717bd7f8e97e2489006d651589da97467d8a1736aff9db87f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768663, "uuid": "2990b094-ea1c-45da-8959-2db7b98104d5", "value": "2174AF10B790C035F4B222F44B7953B9A53D7AB1AB3890CF52D626EE5634AE0EC3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768663, "uuid": "27a2ff6e-71c0-49fa-acb4-958e1e2041ae", "value": "709d5c7631204ea8a49d3c234309fc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768663, "uuid": "51b8d4f1-6b8d-4cca-8d0a-3aead8de5960", "value": "6144:FmvYYR6nDAZHc3eIXNns65C43xP2eAlHQKDKNHFqN2sj:FmvTRoAZ83JNsmAJGNE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623768663, "uuid": "53e5c679-e508-4a33-b10f-a2b323ee1fd2", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623768663, "uuid": "cd4c0524-fcf9-42d3-b57e-7c44f53b61bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768663, "uuid": "affc8dcc-a75c-47e8-8243-6e17608ea008", "value": "714e2d581d52f955592a9d77571a9f9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1980bb3-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623769371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769371, "uuid": "46d9c51e-af0a-4faf-95f2-687f42b4b8f6", "comment": "Malware payload (AgentTesla)", "value": "c71be1c6b68bbcc05d9f4a4fc4c5c840", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769371, "uuid": "50914a5c-4300-4a4e-9d0f-df851351c48b", "comment": "Malware payload (AgentTesla)", "value": "7b0340db069b8349072b08b00b101e2f980baecddc4f8038aff3068bb23ab949", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769371, "uuid": "f8c36dbb-c421-4a9e-a226-9553f4cb4d0a", "comment": "Malware payload (AgentTesla)", "value": "a5878b5bf506ddadf4a98f5f3aaebc50e533f501", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769371, "uuid": "e330a3de-7f16-42b3-93e5-36e60cd01920", "comment": "Malware payload (AgentTesla)", "value": "bb9bc77c8bb2f9b91c9707acb7c567baf154fc7894cc7181ab50b8f0a7d0fe965e92c6a66ee4206b2120a85d76d68228", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769371, "uuid": "2fe3458c-2dc2-4d54-9b50-bed004b1300f", "value": "9A25BF575ECE52AFC5698CB69730AC56C2311CBA160963133EC234BDE93F1EEC99E412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769371, "uuid": "dc2bdc58-92d4-46af-a50b-99e8a5266ac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769371, "uuid": "64fee315-7090-4128-a3c4-246099015c5b", "value": "12288:OTSMPQipP5Hd2pAiMUxe5dfliO2sQh8BMvkzOt8R2tf3uB:Oeip9+AiFxoddEOMvkC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769371, "uuid": "33be649b-fffe-4103-83c0-6a0c45ddafa5", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769371, "uuid": "41b6b60d-e97d-47db-a626-d853b2592a1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769371, "uuid": "4eabcb5e-9b0e-4ac0-913c-af4db4ddba5b", "value": "#3120334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41486e10-cddb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623762714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762714, "uuid": "fbc53725-9c02-465d-a8ce-4eed95c18c9c", "comment": "Malware payload (Mirai)", "value": "44795d9dfdaf6aa1c46c99e28ce0fd7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762714, "uuid": "31b4cb36-47d0-4da1-8a98-fb00d7b87f6d", "comment": "Malware payload (Mirai)", "value": "7bf2d60dcbba36b48647684728a525d378f99ace9f9146902abbb210b762a302", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762714, "uuid": "fb3932b7-7d88-427e-9752-46d61b51a78b", "comment": "Malware payload (Mirai)", "value": "24b977bc99fc664b32a718158c37c8171ea4f223", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762714, "uuid": "914e4ad6-2172-4eaa-821b-2267ab411a31", "comment": "Malware payload (Mirai)", "value": "c120db52223d7fd499d89aa4a63931c7ecdf66a05bb6c178e917a786c2ea11120255dcd71fa48eedad415d1cdc17491f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762714, "uuid": "760cfbbd-0760-481d-99d4-cbe4f8cbcd8a", "value": "FAF3830E6F158F7DFBA9823587B78E2A964833D626E5C441D05CEA021D7028E741FFB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762714, "uuid": "3f483760-605c-4a05-9f82-ec956c09e77e", "value": "3072:RLKIHeq1iclvuo90Hap/T4Q1kPR3zu19XqmSRmyp9lClOa3361h8NXU7XZsZ1qC8:AIHeq1iclvuo90Hap/T4Q1kPR3zu19XQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762714, "uuid": "f32d5d96-c386-4c95-b0f6-055358c64e88", "value": 161164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762714, "uuid": "13e0480f-4879-4077-9977-90e20f49fe59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762714, "uuid": "d6785382-1e0e-4056-a3ff-b28a2e3cc840", "value": "44795d9dfdaf6aa1c46c99e28ce0fd7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fc6d0d-cde3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623766208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766208, "uuid": "15f1eebb-873e-4ff2-b348-fc9ace0ccd94", "comment": "Malware payload", "value": "979639cfe3122c7a0eb5618ca8dfcaf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766208, "uuid": "97343843-c0dc-4fc8-bdba-c30bf8de963e", "comment": "Malware payload", "value": "7c46b92d95fad53aae24c3ab850e055e7ce847ae25a2e963e6ae185b53a635c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766208, "uuid": "70e4e314-5c80-4333-a231-e95eb3a58b59", "comment": "Malware payload", "value": "d3dc60d0c9e0e0540494ecaa93409f7d1d203250", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766208, "uuid": "7712f1b4-3419-45fe-965a-0d8199aa2237", "comment": "Malware payload", "value": "72b7647ea3a18ee55221e9906c0c73656bbf25b0ec10e7b035af6e222359a2099461aef88e83d3accda3e6b0ff67ab29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766208, "uuid": "411738d9-f8b5-4593-8dab-2caa3a90d7d9", "value": "6905CFA01E246FDBE6F50834BCC4634206FBAD167752E3C26EC075FA5897F826B22355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766208, "uuid": "a5fd8c2a-2360-4638-a0aa-49d916e3c18a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766208, "uuid": "8ad1144d-6c1e-40c0-a41b-62c847cbdf7c", "value": "12288:wA1ulGlOcFW+SLqCYQsVTGnPha1Z5DrvgnE8C6tlpe3PfjUR6dvquwaHpcavQ:wA06SjtsVIKZdLXalYPgREquPHpcavQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766208, "uuid": "bd157651-33b8-4910-be51-d22224bde7e6", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766208, "uuid": "b747bfd7-bb13-49aa-9e9a-2c63d5cd30b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766208, "uuid": "8e614b23-3ed0-4d88-8a0e-10b070e06b13", "value": "70654 SSEBACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3855994e-ce15-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623787609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787609, "uuid": "fc11a2e7-89bb-4c56-8315-8e5f8c069eaa", "comment": "Malware payload (Mirai)", "value": "24707087ca2f485fb37a98b4dcdebf20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787609, "uuid": "8571fe2e-ed6d-4c40-a4ea-2a2f8842bfff", "comment": "Malware payload (Mirai)", "value": "7c5204ef5735e30207089bdca582ed67513d3ebc4eb26f7ccc6ee546de86a034", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787609, "uuid": "afb59773-a4f0-4870-84c0-a577e1b7167b", "comment": "Malware payload (Mirai)", "value": "f130fccc07d6530c162392dbd690e25b12dfc3b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787609, "uuid": "b8af34f5-d4ee-4236-bac4-9213b8b25313", "comment": "Malware payload (Mirai)", "value": "d4c2b159b434ee8f481a8415ce95fd438331651dff980418b77f083035590082b727be2a8c6abb1ac5035ea568927cc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787609, "uuid": "3a56f1ef-626a-4a50-8327-2c55bf548696", "value": "6AD2E1026640FEE1C5B00231E8668A9B72267D79D1D130FBD7390DFCA6E9A0D47F9982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787609, "uuid": "87898637-bb74-4f53-9117-23f914b4f716", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgZT9q3UEL7N:WRwynNIOQQ1KMwZSLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623787609, "uuid": "a8794720-d6f9-4f07-961b-2c4df0683314", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623787609, "uuid": "147efa48-b5d5-4087-b924-a2e555f5762e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787609, "uuid": "83ff0b65-f1d5-492b-a427-4ddd1df689a7", "value": "24707087ca2f485fb37a98b4dcdebf20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adb3485-cdd7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623761039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761039, "uuid": "834c7a7c-8f51-4ba1-981f-070bcdfa21b5", "comment": "Malware payload (AgentTesla)", "value": "c7242d2159b091133f226a8085146c5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761039, "uuid": "6942886b-a537-471b-8ad0-163508aa9f38", "comment": "Malware payload (AgentTesla)", "value": "7d330e99d8984003178e9901572adc43d719d4618aaa076a8e697eada127c014", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761039, "uuid": "985c89aa-9679-41c4-815e-d6d0fc9df5a6", "comment": "Malware payload (AgentTesla)", "value": "f7a2290d7a53b58577ac0890768af7a15464b0a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761039, "uuid": "6d5f6ab4-1141-4153-9777-5eb6b1c19aba", "comment": "Malware payload (AgentTesla)", "value": "4b6fa8f8d6c1bc52727f77a66702e73d4a0d08ce6917445f1e368499248d16bfa27182cd972d13cf520dab1051ec4168", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761039, "uuid": "a0ea1a8b-74be-47ef-9c50-2d61cbd48efa", "value": "2715AE575ECE57AFC5658CB69B30AC56C2311CAA1609A3133EC230BDD93F1EEC99E412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761039, "uuid": "08ae297b-ca7b-447a-94fa-e9f2433d5cc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761039, "uuid": "3270534d-b52b-4ad3-985e-d05503809f40", "value": "12288:Me8SMPQipP5Wckik2ft+Av6ZxZmLIqQewIantqm/lh/oPwryCVoFU:MeLipwok2R4ZyXwIMqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761039, "uuid": "33757dc8-a748-41db-b14d-fec76b998de1", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761039, "uuid": "50b511fd-a78c-4cab-85d2-e7cb8031b10a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761039, "uuid": "6bc4350f-595f-489b-b64c-6e44f0e5f9c7", "value": "purchase order#290435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd40de8e-cda6-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623740158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740158, "uuid": "862d34a9-03ef-452d-9fc8-dd3c50056954", "comment": "Malware payload (AsyncRAT)", "value": "04abe769d2042a2cd89ff058abc79bcc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740158, "uuid": "788dc2d8-e545-4e1d-8211-c8fb953d1edc", "comment": "Malware payload (AsyncRAT)", "value": "7e582319d9aa782d8cf4753ebd31ad2251abf03c688f995664627f1a01e05ece", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740158, "uuid": "ab680463-5f92-4b5f-81c3-be256c733f03", "comment": "Malware payload (AsyncRAT)", "value": "0e5214d961f8f457f545e0bf2f7fb1361657d57a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740158, "uuid": "2d0d32e7-3387-4945-9798-70e92e74f257", "comment": "Malware payload (AsyncRAT)", "value": "8c37b1600f4c3751052ebc4e5ea3b14dc3c54a7578ab028b31115265fe4faacf5ef3782759f96a57d6d58032e007c629", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740158, "uuid": "6f44d23d-4434-4a91-ae36-33c7f26083dd", "value": "AA059E9C7650B5DEC82BCA32C9A45C20E6217C6B530BD20BA05732AD9E7E687CF155F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740158, "uuid": "511d78a3-cef0-4796-84ae-5cf2c20384e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740158, "uuid": "634888da-a1bc-4134-9404-e1241be4772b", "value": "12288:xDQAU5239VCZ6vB+WwWz1/bKV5Le6gnWdn8xBoOKK2pBotCnTfS2PSc4HuTNeqmZ:eAhjB+axmnS6gWer2aYTFiZh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623740158, "uuid": "46386dd7-e31e-41f8-b511-4bf07a346178", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623740158, "uuid": "7c34883a-b2e6-45fd-b091-4907bc58afd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740158, "uuid": "700d0795-d6a3-40b6-845d-3b09f3cabea6", "value": "Profoma Invoice1506021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256522e3-cda6-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623739904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739904, "uuid": "a2b09666-c19e-448a-baf7-0be954302617", "comment": "Malware payload (SnakeKeylogger)", "value": "7312858cf98a41917a7de7975e11322e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739904, "uuid": "cf4e7648-8570-4121-b326-8d1b144fe784", "comment": "Malware payload (SnakeKeylogger)", "value": "7ee7904969171bddb151071e7b02b14f7f9a560e25ba461c360a3f6b41016df0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739904, "uuid": "3d770c7b-737d-4b3a-8c66-006df3a997d5", "comment": "Malware payload (SnakeKeylogger)", "value": "9e89b172cf54ae347df7220ff3d08116b48487c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739904, "uuid": "4c38942a-b46b-4e56-9f2d-2bafc8ee8070", "comment": "Malware payload (SnakeKeylogger)", "value": "ff3a6981e61b91ef89934eb9ffa38f3e17c7654069bbe1f69afaf81acf6bdbf75ec468b5b2fc954d4dd5ac87f577c552", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739904, "uuid": "4346df46-ca19-48d1-8754-226ba240fede", "value": "D1841212A2388705E68A447F84E392F21FF9EC544E52D15B2FD97F6C12737A903E3889", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739904, "uuid": "2bd40955-9d4f-431c-a189-4a608b6a3cb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739904, "uuid": "0a94d628-fda2-490a-adeb-1e794ad9dea3", "value": "6144:K9le5u3MN+gdd5ra/OFeLLSLedBu3sSrTH3CSgikbyRYhCXiLoU1:KneB1j2/ZsedBuRrTXHgieg5U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739904, "uuid": "5c548744-7e35-49b8-aed1-5925f56009fc", "value": 392688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739904, "uuid": "cb09f16d-d672-4d71-8b8c-28ba551db8fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739904, "uuid": "e393878a-4df7-40e6-a4a0-05e65e4bca46", "value": "7312858cf98a41917a7de7975e11322e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652b0499-cdda-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623762344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762344, "uuid": "f0616b7b-522f-4b6d-89df-323b3106b51e", "comment": "Malware payload (Loki)", "value": "5a490987b71b5bb74fcc8bdb0edd7d17", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762344, "uuid": "c2f38e9c-dad1-4bbd-a91b-3c99bf2d3747", "comment": "Malware payload (Loki)", "value": "8059617f975fc5b874900bcd794795c1442ad4dd9b00bc21d9c54607fc3291ce", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762344, "uuid": "9e8ba915-6e56-435c-b523-a5037203e022", "comment": "Malware payload (Loki)", "value": "0c429a64850355c6c736c317afaa9766df737802", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762344, "uuid": "3d9de337-4343-49df-962c-926815ad2aba", "comment": "Malware payload (Loki)", "value": "6335886b35469dbf3663d830a3bb6ad156e6acfeaa1380b2927e8ea25ea040e0d1719f720b8450334295752eed7ea070", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762344, "uuid": "c517dd32-31c7-4fa1-b5b7-ac49b1f2b991", "value": "A7D43388907FECC46ECD75E7A1B428511F8E4561AC228FF6AC6E631DE4ED264342960F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762344, "uuid": "32e2fca2-0695-4346-baab-834768f33d9f", "value": "12288:yuC7CytgBcSIYKlDPJYOh35CSd57ohOAaYezJZC+g7IaAD9emkINkujhs:mOSxTDPJYVK57EaYey+g3AomNWuj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762344, "uuid": "f37a782f-148c-4dfa-a9ae-ba442ca33ed4", "value": 647251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762344, "uuid": "90cfdb02-f2f0-4dd5-8d5a-435288ee81ba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762344, "uuid": "d37ebb26-9dee-46e5-925c-e454fef31b48", "value": "PO_403.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28285859-cda3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623738620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738620, "uuid": "eae06141-4094-4172-ba7a-8387ba70efa1", "comment": "Malware payload (RedLineStealer)", "value": "5a5fa2fbc1d9f256d1fe153be2b01825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738620, "uuid": "fc1e3431-321c-4bb9-a4fc-32d1cb62221b", "comment": "Malware payload (RedLineStealer)", "value": "80ea205e78f22566396973785f1d677f5743939a5d4062df08add01fee31a3ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738620, "uuid": "03e94da5-ffc4-4fde-aaa0-8c0c6d65ba0b", "comment": "Malware payload (RedLineStealer)", "value": "fe568085b2af4003b4d3b4165851474219bf4d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738620, "uuid": "dcf708c8-8faf-42fe-91a3-0182be27d6b3", "comment": "Malware payload (RedLineStealer)", "value": "d5dcf771f8299384bb0e58a7f3d0e1949531022b9f3f78f9807fdfc1a9c8ad936af96ec78b27cc69a2e504991783f690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738620, "uuid": "7a6021a9-112c-4ba3-b010-7ca5061933b8", "value": "2145D0174ECF876AC2680CB59376DC5682724DEA296473223FC035ADD9372FED89E502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738620, "uuid": "b9e4ca71-93ae-4c9c-90e1-8f468aa15cd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738620, "uuid": "410958ab-0c56-41c1-8034-14014a059166", "value": "24576:UXq5ipIEl4ZNVjCFsm1d9GqLm3Ra2m/9:UXqnEl4VCW4d4ha/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738620, "uuid": "1e65bd0d-d460-4507-8761-1fc3b376bdd0", "value": 1196480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738620, "uuid": "020a2876-12a9-420e-8a4e-2f74951631a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738620, "uuid": "ab8a2795-9802-47d4-91da-6a8e1208e2b8", "value": "5a5fa2fbc1d9f256d1fe153be2b01825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ba28e3-ce15-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623787629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787629, "uuid": "301fbbf8-337e-4d8b-93ef-2cb1457dee8d", "comment": "Malware payload (Mirai)", "value": "117c41308b574989b9c58edd0e969c97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787629, "uuid": "9d3fbb87-f8ff-4a62-ab24-4cdeac2f2a45", "comment": "Malware payload (Mirai)", "value": "81a6d5883e0973afd2e0ead16649e5bc7d601bfaf43040719a010f199ba7a3e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787629, "uuid": "b8434ae3-4dfc-4d9f-b519-e2969b5a0691", "comment": "Malware payload (Mirai)", "value": "580470c2d85f8f1cccd67ed3b5b9ad723859c344", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787629, "uuid": "26560810-f201-4747-8d1e-f41c3690a99a", "comment": "Malware payload (Mirai)", "value": "911183329b25586b4d45b21707a99f799af4a4be0135d57607c90d8b20d2515eefbb03c3083cc0adbaa0496fb070f8d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787629, "uuid": "3fe5179d-3903-43eb-9473-9c5d03d12c5a", "value": "D2A2D01822CDEA72D170903BE13CC347AADB43BA52FE313E1E18079DA49591AD3BE945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787629, "uuid": "c0c1fc6c-2d46-4ae0-98b4-03cb72aebb02", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbmbhymdGUop5hXW:Ypoh/DxCvhdR4IjWVFbSas3UozJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623787629, "uuid": "7b0b6b1d-48bd-4ab1-87d7-c3cd2cf59597", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623787629, "uuid": "61500254-7cee-4fb2-af9e-d19c7c64378c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787629, "uuid": "98babc30-08f2-4253-ad46-8ee79904f95c", "value": "117c41308b574989b9c58edd0e969c97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba6029f-cd96-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623733149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733149, "uuid": "3202b073-7cee-4904-8835-6771feab7b72", "comment": "Malware payload (AgentTesla)", "value": "c453b3e97b573ff0e15186ec55db2451", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733149, "uuid": "828057cd-961f-47ae-9ac7-3197f4a7eee1", "comment": "Malware payload (AgentTesla)", "value": "82463fa24ce4a50ed4d98b3279d41bc14dabbee2cb211d8951e864ff6d83786d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733149, "uuid": "60e82f70-c579-441b-9afa-a9521a0e47c0", "comment": "Malware payload (AgentTesla)", "value": "1198ee5522d9857f9d7fc1678c2f3f9c6b36e4c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733149, "uuid": "dbadf878-2958-4a0c-a230-479413d48290", "comment": "Malware payload (AgentTesla)", "value": "7fc121679232ec1f4f6d7e9f267ff6454be6cde54682e214770a6be21aa3561f49c4fb99be64bea146fbce03b43cc324", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733149, "uuid": "5de7888d-721f-4df5-b4e8-7704dc1cfc58", "value": "DD25122067949B16E17D87FE5070101113F4E21BE722D75DEEF891E65BA2B828AB37C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733149, "uuid": "d629b3a1-7374-4682-90d7-b967bf999b8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733149, "uuid": "b5f57977-ede6-484a-bce6-d64b9484f4ee", "value": "24576:fZMFlNELuYA5O/iTW/chf1336jKVmT0LuV35iq//U:fuFlNLB57TWSf1H6jsLuVpiq/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623733149, "uuid": "30f898f6-67d2-4f3c-9d7b-cfd405aafc31", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623733149, "uuid": "46eeef4e-33c6-457c-a075-5a82bec30d5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733149, "uuid": "b46ff214-22f1-4b8f-abee-1e85663d2292", "value": "968 9449 2324 COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8435580c-cdfd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623777429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777429, "uuid": "70f7af08-3c40-4703-90f9-304c2c4cc182", "comment": "Malware payload", "value": "3283203daaa2e26233f7fa099fb823b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777429, "uuid": "7c979ceb-aa49-40f5-a184-76d6aa41a318", "comment": "Malware payload", "value": "8282218eddaf268ea97b6ecea9ae51a52ce6fa063c198c5e5ef02ec95f23c7bf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777429, "uuid": "c7c228a8-438e-4b42-af63-4db6c5e6c7fd", "comment": "Malware payload", "value": "3ab34ca8c5aa1792212fd956118db367d3ea1adc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777429, "uuid": "37dbee1b-b3d6-47f4-b534-6ea01ab22811", "comment": "Malware payload", "value": "85ef15829e6bfd57dea9d6bd2329bd3099f9dfc7b83b56a1fdcb25b50fc3d8c811abeb40fd6362da652b396adff956c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777429, "uuid": "998cd091-667e-448f-95b9-93cebe3a22ae", "value": "DC258D01BA11F024E5AA01F44F6DD79DAB1C3EA19B5422CB73E56EDF6E6D1E3A430309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777429, "uuid": "c87925be-8c29-40a4-a1a2-eecf04c5c2f7", "value": "5631b8b671d77777e9f81d7224f501a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777429, "uuid": "da2b6778-e3fd-496f-a6d8-72db800b2d42", "value": "12288:HjyaZO+bee+T5uQ63I55CTqZN+a+6tVhbYTzGC3evhTrP0MGsz0:Dy8O+qeU5unPTqHbYuOevhP8M3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623777429, "uuid": "e89d6fbc-58e2-49dc-a441-ee73ce868c95", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623777429, "uuid": "597357ce-2378-4f22-a51d-190169c6fd60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777429, "uuid": "0e2919fd-8df7-4be8-a670-9d8c3e297f09", "value": "app.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3c9916-cdca-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623755322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755322, "uuid": "c53d79b2-d0c9-44dc-b6ad-02ac85575148", "comment": "Malware payload (Loki)", "value": "270d2530c6180335ca4767b975fe9eaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755322, "uuid": "2ac87935-ca60-4894-882c-1883a894a5d1", "comment": "Malware payload (Loki)", "value": "8294dcbc3399da59a1eae308b1a95d157f85303317282e19a3d201b665bad9bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755322, "uuid": "a746a011-08b0-49cc-8add-012edf685a4a", "comment": "Malware payload (Loki)", "value": "01dabab71267443220d1bfbd333375a1e3808d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755322, "uuid": "e98158fa-f42a-4636-8415-ec2968fce778", "comment": "Malware payload (Loki)", "value": "8a999dc7ff9e6e52d4cfd3824cb43e49419a1b96403db85dfbe036b14c082350b5706a28cdca10db054ba2f2bc077837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755322, "uuid": "99cf8325-2323-4ee8-b91f-46d360b60176", "value": "23A412C5B385E690CD339F3ACCE79AF0067C8D45A416832FD94879963BB13F80592E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755322, "uuid": "5c138269-6b8b-4198-ac7e-ba94683d5687", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755322, "uuid": "008ca9d7-41b4-473b-894f-7ed47202bf4c", "value": "12288:vjrZFZHgtsiNGqC1jyvs6Q8cHCE0g1XBCcGk:vjrnlg3NGqY3vhVXBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755322, "uuid": "c35c4aaa-acde-45d0-b49d-dce34ddfaad1", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755322, "uuid": "2afabbdd-be6d-4fcb-8702-7986b8932afa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755322, "uuid": "34f52ed6-78cf-478e-b4d6-b74d590eea7a", "value": "INVOICE.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f809010-cdd5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623760134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760134, "uuid": "ec3fa053-181b-4e4d-b551-22f95b32750b", "comment": "Malware payload (Formbook)", "value": "45efa9779ec5f51bbc501dbb6bbbba3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760134, "uuid": "764bc016-d9f4-4123-93eb-00f0d000139a", "comment": "Malware payload (Formbook)", "value": "82c32dd8462adfec60639b321066c7f9a9e5377dfd442bcf2537a036e8ce7218", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760134, "uuid": "2bb708b6-880d-4a30-9273-e3c3dac20413", "comment": "Malware payload (Formbook)", "value": "a1fa461051eecf5ad7fd5b60ce26775daf4375ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760134, "uuid": "05a55283-430c-43ab-b1db-5dee16c5bdf0", "comment": "Malware payload (Formbook)", "value": "248820c507733f7cc3beda6e237feb67cd6cb9f3c2671ad8dde6bb8f1b723286551eb62036bc53d899fb8ed66661b7d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760134, "uuid": "e666c430-47d8-4562-a0b3-635ae5b7391e", "value": "E184F01591D8C85BEED87836EF60D5FB8326CD8E45188A2717FCBE9B36BC08B7241251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760134, "uuid": "efa45fdd-7650-4b4f-afae-0dd71c2839d0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760134, "uuid": "6e690cd3-7215-43f5-99fc-c0db1fd8d729", "value": "6144:RQqOQKFQpePgWcnnbtkjQptvdh+CiueMQiCkCltyZFUw8TTHt:uPFLgWcEQjPti9y1Cl0ZFdAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623760134, "uuid": "bd324e36-14c9-435e-a8c8-4be5574e72e1", "value": 382131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623760134, "uuid": "8089e77d-ccd9-49e6-b667-8042d51544ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760134, "uuid": "9726bdcf-a7b0-4a18-b830-87c7831031fa", "value": "45efa9779ec5f51bbc501dbb6bbbba3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a3d09b-cdc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1623753990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753990, "uuid": "0def2d6b-dd91-4606-9435-44529240458d", "comment": "Malware payload (Gozi)", "value": "1c515412aadc706a293f56a7e1d53428", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753990, "uuid": "8afb7a09-5650-4dbe-bfb7-09991fd82077", "comment": "Malware payload (Gozi)", "value": "8326f8abd9a81a780fd5cbbc85b4e9f0fe8bed61bce669372ea5e5902093a2af", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753990, "uuid": "f521926f-2256-45a7-9c8b-c6ab7f2b385c", "comment": "Malware payload (Gozi)", "value": "82c9f94372293de7e0f02d87b9d0cbbb5f2c1667", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753990, "uuid": "f85a2c30-2a64-45ac-a2f5-b3a5b6d389d6", "comment": "Malware payload (Gozi)", "value": "098458c0cc9cc36814b6838b6b0fd031c4d9a854a7af22b66115f9f59f946e3f47ab8f9c9edba2418ff577d7952f9ef1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753990, "uuid": "ce9d03cb-a665-48a6-9dbe-1f156ac76a9a", "value": "91138D02E7D104F2C76206B02421EBFE67FA837017745586A72769CB6FB19A7E53D20B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753990, "uuid": "09f75d8a-b939-4695-b227-3beeb0b7c79b", "value": "768:wcBjK63se8PsvX86r/g7WfWy2lOKncpz0C1f7lI8RAOf5G4GXh:hBtsXkvM6LWW12lut0C1f7TAOoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623753990, "uuid": "f00609a4-a699-4978-8ecd-99f5bb53a452", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623753990, "uuid": "bca75763-7fb9-45a4-8e6b-a7a0bfffe99a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753990, "uuid": "50f1f434-4494-4ae0-9a17-9e6d0dd5e681", "value": "2fb0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a06744-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623769209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769209, "uuid": "486daf42-add8-46ad-a11d-196689b87665", "comment": "Malware payload (SnakeKeylogger)", "value": "3798291c37f367e5df40da98ccd234f1", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769209, "uuid": "62747599-42a4-48c8-9e05-192ddb55f436", "comment": "Malware payload (SnakeKeylogger)", "value": "83f0925d885d15511053d311e01de338776ece5ec42af6d3f39b0ac4cf3379c9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769209, "uuid": "e9c2ff5e-ac4f-4cbb-9d4b-016d374d9d8d", "comment": "Malware payload (SnakeKeylogger)", "value": "3917fad83ef59ace5881acfeb675403e8ca16bc6", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769209, "uuid": "6a09fae6-6946-4b95-91cd-0d2fdf686271", "comment": "Malware payload (SnakeKeylogger)", "value": "780b28d880573ade722e4615fc150fb7e7c87dd7b66bff3d8f6a1d5ce9fd68b6c294add497a4c36f43d92391f64d9a8d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769209, "uuid": "a4b88aa6-b18d-4e96-a18d-c035ebd597f1", "value": "219423012B8AD3D8595F8F8E2A1D25710F5D59FE3476941DFDAD602BB820F77CE9040A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769209, "uuid": "47cd408f-a8ca-4805-a0c5-bbb02744ed0e", "value": "12288:H0Adt6u6dtDJ1dqxvl6XfcsCLxOVaVwqkEcVbK:HldR6dtDJ1QxtwfcxOVmEEcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769209, "uuid": "30b3145a-e6eb-4a09-8e5e-c39e75bffacd", "value": 442194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769209, "uuid": "981ce565-5871-41e6-8036-80c31c32fe3a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769209, "uuid": "e7d4f16f-118b-4ddb-bdfb-0e77f5a1305d", "value": "Consigment Details_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399b2ba8-ce07-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623781599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623781599, "uuid": "92316301-9bfe-4294-8e9d-ad176e4ffb29", "comment": "Malware payload (DCRat)", "value": "8ff7b0b0c35c393f308f987171721ba0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623781599, "uuid": "4b7de8c3-3402-4c96-a8c8-5401382d05bb", "comment": "Malware payload (DCRat)", "value": "84ad4547b1b6eacb1fa94a456851380b0cdf04a30d5461cf9c7e5dcededd8a1a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623781599, "uuid": "7e2a992a-3d12-481f-8d2d-7af4de5845e7", "comment": "Malware payload (DCRat)", "value": "b5cf15448f31f9406ae56863569518a203c3bd7c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623781599, "uuid": "bb75cab8-7a9a-4dfa-8cb8-53d8e3a672e7", "comment": "Malware payload (DCRat)", "value": "e5160817bd48320668d9dc9c77e1416658dc0292edf92e7e709f869d9fed076fa39f2b8c30b80e4a903b56869cf774b5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623781599, "uuid": "8c54b3c7-4369-40ef-ab86-f9cde7a456bf", "value": "76646B2A77EC9E11D1BF87BAE4F24946C771E413AA92FB0F09C253991D27304AD40B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623781599, "uuid": "8ffeacc0-14eb-4ada-88f9-7af65b578416", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623781599, "uuid": "2846dcbe-549c-46af-b237-a68fa84e031c", "value": "6144:7qqDLO+vYJgQSGwWL7Ib81EmDHICDWlqRZKWXaobSVpDpB5kFC:2qnO+HJYL5B0GBXsKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623781599, "uuid": "81e93af9-ebb4-435e-836a-02ee4382cd3c", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623781599, "uuid": "048d7205-7a6a-48be-aa35-c803ce6dd8d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623781599, "uuid": "b2871301-1f73-40a8-9ec0-880747f85e7b", "value": "8FF7B0B0C35C393F308F987171721BA0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8524044a-cde3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623766263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766263, "uuid": "b24b93c3-4510-4239-909a-f266ce9043e1", "comment": "Malware payload (Mirai)", "value": "8310c639f3938f3bc80ed167a605419c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766263, "uuid": "53f5d47d-34b3-4e7c-ba6d-670925c6904b", "comment": "Malware payload (Mirai)", "value": "84eb53efd0d82edfaaaf916a2a233fdca5b6d49cd29e2add0ad4758f72e31c5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766263, "uuid": "6a5793ab-7d60-48e5-a021-69dff38c39eb", "comment": "Malware payload (Mirai)", "value": "4e8ba9862cc935224d16d1c5caab8172a4892048", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766263, "uuid": "d3a218a0-1bb5-434e-b008-4621e1ce5c63", "comment": "Malware payload (Mirai)", "value": "4777d59824cbaa9d1b1a8ce7b5969c4a7e558a36853ad55537ec703f73eddbae8994de6ab2baf62ae110f2a23b658d5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766263, "uuid": "64c2e995-b4ed-44f9-87b6-fc8f4f63ee4f", "value": "E6C3E792BC81A62AC6D313BAF9BF558D332127E9D3DE31168C210B247AD981F1C67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766263, "uuid": "0384ef63-e2f5-49dc-a06a-210c91d27d8a", "value": "3072:n+VNfOLBVIsa19LjPJ00iV8wW84CAnpOG:n6NfeAT19YV8SCnpOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766263, "uuid": "c9765e65-1275-410c-ad91-36c5a2e7233a", "value": 124852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766263, "uuid": "d1038db0-cabd-4b6d-899d-825322ca0afe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766263, "uuid": "f19c832a-409a-4c9d-aba7-4c1cbc116c9c", "value": "8310c639f3938f3bc80ed167a605419c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e165d1-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623736386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736386, "uuid": "47f2f67a-e678-4db9-8fb3-70830926cb1a", "comment": "Malware payload", "value": "4c1323801f43b0795bc37ace4c354c07", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736386, "uuid": "a7cf2e05-3c24-4987-bfa0-cfd0b7b0c6b3", "comment": "Malware payload", "value": "884e801b0de8f3093b955809af492d76ae2f0fd4ba27edbecb6cde72d3e465a8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736386, "uuid": "97c0e525-4535-4249-805b-65ff281d7a7b", "comment": "Malware payload", "value": "967edd9a612441ba887ee84709d029a7e69d7d0d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736386, "uuid": "ea397e79-3644-42ec-a9fd-561e67c4d28b", "comment": "Malware payload", "value": "7b3bafb485a81df15046c067c393b196e8676b40bd2ef3b34674eef0419a3cee64740f9404f4817a8fcdaf466bb9f9fd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736386, "uuid": "5d470c42-7521-4b58-82f4-ce9833ca919c", "value": "A691B65697251C53CE1298F7E5B9FE5304E1F35A88CB2F95721DF9F00B13312263A092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736386, "uuid": "8b4a9c18-b923-4436-b2c9-94d610f02b01", "value": "96:THHpsDiZ5zOkFscLXmTuxuISLZl0OWzvggM+o5rQfF2ph7:rp9dHj1432vZM35rQfspB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736386, "uuid": "eb15cf37-7ea5-4ad0-9864-939f7952b220", "value": 4584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736386, "uuid": "f2cea4dd-c481-4985-a0ac-5b1f5ea02d55", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736386, "uuid": "97836348-161e-4262-ba4e-27852d7d3d8b", "value": "Payment Form.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d3cb26-cdcb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623756032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756032, "uuid": "e365e641-7d0f-44cd-b369-377cab957660", "comment": "Malware payload", "value": "87b6aa9999f339367e81cece5164cc61", "object_relation": "md5", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756032, "uuid": "0bf456e7-ab79-4ccb-8885-095643bd7692", "comment": "Malware payload", "value": "88d9141e63c5e2d05294b43d85ffc2604c3eda3b2cac69149743e3990b547212", "object_relation": "sha256", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756032, "uuid": "d7deabae-518f-453c-b170-cbfeb0de8c56", "comment": "Malware payload", "value": "0f0cc9bae58961ceec44d77c09f7670b6e6dcd32", "object_relation": "sha1", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756032, "uuid": "c3d27b7f-5c58-41b0-bb9f-68b7704c6f54", "comment": "Malware payload", "value": "6ba3c5f9408911c387cc371a54b7616beb320244731a0acfd6788d8682e56d2e011226ec8491e0e5cd5a9083870a0c94", "object_relation": "sha3-384", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756032, "uuid": "003a549e-f160-45c3-a251-d12a7c892e04", "value": "9F658E21F6439036F9E300B686FF477E992CBA22031454D7E3C46D6A9A709E27A37717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756032, "uuid": "ccbc7531-7170-4d71-81fb-b8beb55546fb", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756032, "uuid": "e38d3202-9f60-41ac-91ec-2a47f06beaa3", "value": "24576:3m41pME1MkEW13A0u7lYRH0lKFhruS8YyB/Vze22q6pJr4Dt19pqQUuyt3XW4:W41pM2EG3u7mRUlKINzuvpu39pqNuytW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623756032, "uuid": "7448c7a6-b9dc-4424-98e2-7fca43f11f37", "value": 1449472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623756032, "uuid": "6a2fa0ce-59ef-4774-a410-32d946c94d8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756032, "uuid": "1c458ba5-7926-4576-8721-92bdb48a5cd9", "value": "Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6994ece7-cdb5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623746460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746460, "uuid": "b79adedd-e4ac-449f-90fb-498259da3fca", "comment": "Malware payload (RedLineStealer)", "value": "1ab31ece35611ca7542d62d23d5bbdb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746460, "uuid": "4e91468b-d2da-41d6-80f2-177a9a458849", "comment": "Malware payload (RedLineStealer)", "value": "8a8f2fcbf0fa6b25c104baffe243b23a0b7ee7dd984669584c0118e54d92e39d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746460, "uuid": "d01c94b2-295c-4629-8fae-be3baa637724", "comment": "Malware payload (RedLineStealer)", "value": "bf0c8f3a7bfca005c3fa9ba9d31d4c3dc923d60a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746460, "uuid": "97fd1335-9730-445e-a85d-2e4cd505b5c5", "comment": "Malware payload (RedLineStealer)", "value": "88e6e20d4e5964053f8fd3d09f2374c1cec736428cfc26dc4fc189ccf1a01e73ac77f9f971af3fd698514d6007c29c58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746460, "uuid": "05e56aff-50af-485c-b509-86766af122b2", "value": "5274BE10A791C038F5F722F84A7593F9A93E7AB06B3490CB52D52AEA57346E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746460, "uuid": "6674fd90-f91d-4274-987a-9ab70d37cdd4", "value": "9a87733f396baca7ee1c81e5d149213d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746460, "uuid": "99680218-47ac-4929-b07b-e80819c83359", "value": "6144:EWrvxA4U0M7fu69WnZNKNaXpT1hy7WMRld7pBt:EWrvxK0Mbb9kVnXUHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623746460, "uuid": "de768ade-5c25-476b-8157-27747488d1f4", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623746460, "uuid": "47e9f45f-0c2d-4117-ab2b-37daeb372ad1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746460, "uuid": "7896af7b-bfbf-454c-9288-15745802503f", "value": "8a8f2fcbf0fa6b25c104baffe243b23a0b7ee7dd98466.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b9890e-ce15-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623787605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787605, "uuid": "65ba586a-cf0d-4253-9d15-ed575c57724b", "comment": "Malware payload (Mirai)", "value": "d671e40940205f6c8e3e4da77b24090a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787605, "uuid": "7f88cb22-dbdb-4d68-a59d-e2818f75979a", "comment": "Malware payload (Mirai)", "value": "8ab810263cb79ff3067e58475cd5593b15a7c731e29be123f90f1ad53a94fc05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787605, "uuid": "7f242024-6248-4323-9a80-c3c9f4450486", "comment": "Malware payload (Mirai)", "value": "ec3ae5dc16cf377480cab9d4988f05d3a7a92c5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787605, "uuid": "12f18836-9c60-4e49-963f-5eb83a7f6ee2", "comment": "Malware payload (Mirai)", "value": "dd28d9d0475fa1509a952455ad5c1bd971dfa85aa4fa41e3c322b0e788b4ea58fa41694ab0ba9811e042e295f87f87a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787605, "uuid": "4b2a6f49-63ff-432f-a004-2a025103cec1", "value": "82B2E18596FB1BC3C2A2C336E0BC9A5DE1761AC10746440A5109729EA3E764E47FB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787605, "uuid": "6b0cb645-0021-4ee7-be63-ef5a47540fec", "value": "384:MvDKKQOcRpmYLdn6RBOFRFt5rUFX1DiSIlCo3AnupCFNqnrrd1NEZgO8UXWozPLs:i/QOC0Yhn6ROHWFlAcwNEFCnNBxc3cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623787605, "uuid": "bcc1da6b-62e0-4459-ba90-54f0c0c53bb6", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623787605, "uuid": "c6191846-95fb-46b2-ba58-d59cd7083957", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787605, "uuid": "01674d5c-eee6-47d7-b16d-4f699cf6e689", "value": "d671e40940205f6c8e3e4da77b24090a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01ea891-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623769315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769315, "uuid": "84dcab5e-6ca9-413d-a602-d8c1a3a39e86", "comment": "Malware payload", "value": "9b8b7ce6d9562eb4854adb96e36ecfa2", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769315, "uuid": "b892509a-44b5-4564-9473-8a171e786059", "comment": "Malware payload", "value": "8af61dfb9649fdb93a72cf3f234b90fd9c980f5041afa058fdbd921eb49a44bc", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769315, "uuid": "a4175c5e-6d48-433c-a2b0-fa2e793f69cf", "comment": "Malware payload", "value": "ccc448103ff8bdf30f86b5d62a967b189307e94e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769315, "uuid": "15bfe132-b946-4999-8215-12f59ca947ab", "comment": "Malware payload", "value": "611ca5eefb46946f8bfd213fad2fb94782c2792dae9403fa17c6828b645b680f99a04c275f61100c62ca4184c8074e05", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769315, "uuid": "ffb29208-4ff7-40c0-82b3-76d58de93cc6", "value": "69D4234F85D536462F346AAD13A3D2E5D03FFE5F5D9B418CCAF0AEA4D472A2D026130A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769315, "uuid": "5eb2bc83-9e38-49d8-b38b-0848af3e30d1", "value": "12288:+L0+f6SFyGhENwbnya9MaJB9EMcfYJRhS9+31tFI1z4hrDzsa34+bn49OD4LG2:yRAenyNaJzENwJK+zKshQc4+LsO062", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769315, "uuid": "1cca9651-8259-477a-8057-58340594219b", "value": 627208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769315, "uuid": "ec1ab202-0922-4e45-926a-91973fbe6cfe", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769315, "uuid": "60711dfa-dd55-4a90-83bf-0200ba13959a", "value": "Minutes of Meeting.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c450d11-cd7f-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623723111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623723111, "uuid": "a2c2bf9f-6060-4676-98b4-5b665ac57da9", "comment": "Malware payload (AZORult)", "value": "2dc27aa273465694ebff1ebde4cc590c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623723111, "uuid": "71296eb3-29bb-46e4-89c2-c2df722a03b8", "comment": "Malware payload (AZORult)", "value": "8bd841e2044e10c3e9d8a071f7b3b281e54f97d056d80b6f40506a2f3af444d3", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623723111, "uuid": "06b8ace4-a43b-4a37-ae9a-af97fa65e05a", "comment": "Malware payload (AZORult)", "value": "4d3629f6ac4a29deec27947f367ed09a691faaff", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623723111, "uuid": "8b93692b-5951-4bec-a99b-9b2dbbb775d6", "comment": "Malware payload (AZORult)", "value": "116df0f7383815becfd4e37cf56c9c524969c6e33d9a674303c81581025263ef3b77c4e41b6010561de7189e42241bda", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623723111, "uuid": "bdd4ca53-c3c3-44ff-bf0c-9d34c0d87cd0", "value": "0F74DF957A98C86ADBD571304F1AD1F887757D0C2EA252976BF07FAF38FD6834920202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623723111, "uuid": "6397dd80-cb68-4cad-bf11-3da3daf33847", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623723111, "uuid": "74d9a78b-589d-4ec7-8c8d-604090d05543", "value": "6144:ZQqzeFLzHRXl8XCHdsP/pLeN3dt1JHgFU8qKat:yzHRRsnpSN3jLT8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623723111, "uuid": "b8b36292-bbc0-48da-bc25-2ac7bc12e19c", "value": 342949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623723111, "uuid": "bee26759-989f-4c0d-8709-d123f6d36f7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623723111, "uuid": "4de4f199-942b-48e9-bdf8-9297d2bd8f01", "value": "ZiraatBankasi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d541cc1-cde0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623764962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623764962, "uuid": "5fe40386-66e9-46f1-b66a-1ef6c9c360b3", "comment": "Malware payload", "value": "92cafcc529ec3b0d6640f7d6569102da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623764962, "uuid": "d7b2d50c-4091-4f03-9ea3-924e70103768", "comment": "Malware payload", "value": "8bf0629c5fa2fc821172ac5131d559debbffd89ed9cdcaa2e3963dbb67d2f734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623764962, "uuid": "19a1b0bb-6dcd-4663-bc49-4c9075d6143a", "comment": "Malware payload", "value": "e8b7d673ac67a98adae788f817dec31eb356b4f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623764962, "uuid": "8182686c-e9c4-411f-a042-35fbc62c8a4f", "comment": "Malware payload", "value": "e8b3c316dbd37b4261f5e4e9f60ac173a1f326f96cb6aae4d6114e5252557b019211850d77da4e35ee95658cbf36559c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623764962, "uuid": "fa22dddc-2cf2-4e5a-b1b2-1f8025a3bda0", "value": "CF05CE522EA46A99F4F95B317DF0431203FB7D127B2BE7DD6E8471CD2867E808662312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623764962, "uuid": "903de959-7b6d-4c8c-afc5-7e5d0a41c21c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623764962, "uuid": "2a5747e6-7559-497c-9a5d-02b5510716cc", "value": "12288:DcPc9EuzXvFmWJfkN++Ay+7BqWMSycfpFoZxrDR4Iy6fbyJJ1P494Xj6pH7R3QRJ:DT5MioZxrDVy2I6kV+quPHpXa62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623764962, "uuid": "33ffe490-a567-42cc-a4dc-3388500efb84", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623764962, "uuid": "9c60dbb8-bd9f-422f-b846-fae6b7bc24c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623764962, "uuid": "60c189c5-85cb-47eb-b902-ab6130d77976", "value": "Ghanim Trading LLC-RFQ78009000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10656e1-cdc0-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623751358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751358, "uuid": "7adf3673-d3b4-40a1-9ee4-915482a28199", "comment": "Malware payload (SnakeKeylogger)", "value": "08080ca2b487e9ee3a7ed98e2449745f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751358, "uuid": "9ae06621-ee44-4bd9-9e89-4c84a1d545cd", "comment": "Malware payload (SnakeKeylogger)", "value": "8cdbdc48eeff6dbd8b3cf2bcbf91b4c58c5479e8c3779f36debdd3856f17b185", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751358, "uuid": "ee3d2ec1-2a32-4f29-8972-8f88961978cd", "comment": "Malware payload (SnakeKeylogger)", "value": "4835253aab109db08fdf02108d8f09b2342cb644", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751358, "uuid": "6ab80714-59ea-40e4-b236-2ad373c24b7c", "comment": "Malware payload (SnakeKeylogger)", "value": "0d70ea6a12591a62895a092f6b6d6ccfecdb0e229c73ecfc1f60eefe057bc21bc275673a5e371af8a8017d276b0b5b56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751358, "uuid": "2547e01f-47db-4711-95f8-6b82787cde05", "value": "23A4134101B0876ADD8646B6D0EAC8700BFBDE7ADE54965FB751BD80187338D2FD40AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751358, "uuid": "618fcadb-b029-445a-a1d3-76e715d0210b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751358, "uuid": "31dfacba-c84d-4b8d-9005-17e2b6d42399", "value": "12288:Ny+9K3+IeOPjV8Sth2AaIy/fRXqOYLN/u5IRu/U1:Nyth2lZ61Y5Iw81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623751358, "uuid": "1d231210-072f-4179-930c-eca92de5cd37", "value": 452080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623751358, "uuid": "5923273c-1fbe-4ed4-8c52-7820878cf0ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751358, "uuid": "919f0be0-1c93-49ea-bd4e-55d307c0f9e0", "value": "08080ca2b487e9ee3a7ed98e2449745f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a15124e-cdf2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623772634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623772634, "uuid": "c89f11ff-8c35-4936-b52f-67810567106a", "comment": "Malware payload", "value": "6272467a49ad2e4de00757fcfd0366fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623772634, "uuid": "d1148f5c-7131-42df-91d5-1f539cf53eb7", "comment": "Malware payload", "value": "8cf4d9a55d80942fbdf18648f7fa01768efc4783b439503d39d9ef98a85fb193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623772634, "uuid": "b1ab04cb-9ad6-4eed-b993-612a8ae51b93", "comment": "Malware payload", "value": "fade44464e8bbed3033d51f252de58d38ef3b010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623772634, "uuid": "8f58fab6-79fb-4c84-8bf8-e6b1fee88205", "comment": "Malware payload", "value": "749ce35041745b5e16461df2570242ab2f1ff6de06be29aa872657031c5c0d4be6c1a987e1b4430544d19e3de8b50aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623772634, "uuid": "c521145e-54bc-4c4e-9279-9abffc20c8c7", "value": "0255F0522EA86B89F4F94B34BDE0831203F73D127B22D3DD5E8471DD6967E808B66346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623772634, "uuid": "f76db780-17bd-4d9d-8e03-68f6b2d9b191", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623772634, "uuid": "4f40748e-dede-46da-ac09-ad7704e678e3", "value": "24576:Lh3JCx9aYK+lKi6jQ4mgEZFtOB+V0GudJisHvCyREAGquPHpNaxz:LhZoaYjlQjrI3V0fd7H4/Rax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623772634, "uuid": "15da923d-be4e-44b8-b823-fcd32ba4e54b", "value": 1363968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623772634, "uuid": "404961e0-d2b2-4e2d-a7e2-dc5d8875edab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623772634, "uuid": "405e0340-1430-4b33-a63e-6768b76f3117", "value": "serv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860ab51b-cde5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623767124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767124, "uuid": "874183d0-f616-4054-8240-80f2329d3005", "comment": "Malware payload", "value": "d952d9855378d75c3fa00cc4d233de34", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767124, "uuid": "e0ddd7c0-6813-4e94-9e34-717b43df0d8c", "comment": "Malware payload", "value": "8dadcfa6f2fac387316286a07abc3ad6ffb40a19c3d2136447880a81837de976", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767124, "uuid": "66b44dd0-e08b-4c98-a96b-ae813402922b", "comment": "Malware payload", "value": "f45056d309a1b84893df34521263cd73db56b8e2", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767124, "uuid": "8420fb4c-8ebc-427c-be84-f00be3bb8b9f", "comment": "Malware payload", "value": "6fe0380b6b789432fcb61a651e409166586fb9ee5c7b84bc585fb2540f6b36f7a2e85b3e0a790086babf2d1c47e0a178", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767124, "uuid": "21ac0ebd-2a8f-4210-85a8-f13462c0787a", "value": "54D42350072B94E0D2D3853A29B0C28E7617F8748FE99D0578F8197EF1EABC3E95458E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767124, "uuid": "b386d648-8364-42c9-8b95-38214e74904c", "value": "12288:QaRwVs/B+GIjgKh/YIIv5h1lYl1kSUUZ8XN2yiCtJhbOfS9C1dLgV4OCeZW7J22p:QaKm/NIn7gh13NUZ8EyiCtvp98dLgfCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623767124, "uuid": "c4491bf8-0c9d-4265-a56c-0302e5d3ed2a", "value": 621834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623767124, "uuid": "d55b951a-456c-4d7d-bbd7-98af1788f3f4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767124, "uuid": "3c302e3f-e3a2-43c8-9737-e62eda9c7ea5", "value": "specification and data sheet.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31329856-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736917, "uuid": "4cd68d3c-5250-4361-8c1b-0d6b7d99f3a4", "comment": "Malware payload (IcedID)", "value": "c8dc7b9ba8b7722f0d089075c7a3c831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736917, "uuid": "e89d6be5-3940-49bd-9fe4-191c3812ccd6", "comment": "Malware payload (IcedID)", "value": "8e8c84912166a66dd3a4459edf3469d11b8234085efa887489a8de7dafaeef14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736917, "uuid": "1a731c1f-424c-40b1-8656-0b1a2b15fb5b", "comment": "Malware payload (IcedID)", "value": "448de2818f53922bf480810bd23e29fd84d451e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736917, "uuid": "df558fd7-e564-4488-97f2-5a77bf367cb5", "comment": "Malware payload (IcedID)", "value": "9de550af58e465186744dbce3d3bb37dbac4db6997ea4a5486866248060b5d956ec4420a3b3701ef0a21bc35c0ee3c2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736917, "uuid": "97c0ad7d-6616-45b7-a299-146fce57163e", "value": "3FB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736917, "uuid": "532fb57c-bdc1-44b8-b3b8-097bbb954804", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736917, "uuid": "ffccef76-5062-488f-be2e-9b5f6934dad6", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8h:t082TLrbNGoVMjPR5DxDRoF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736917, "uuid": "2194a33d-eb65-4929-ae9f-179c2df430c8", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736917, "uuid": "9ebbef15-fd6e-448e-bd0a-68f96d14feef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736917, "uuid": "c30c670c-e8e8-42f1-8b19-f4489bff0402", "value": "8e8c84912166a66dd3a4459edf3469d11b8234085efa887489a8de7dafaeef14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3307a09-cdc4-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623753053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753053, "uuid": "2b4387b3-39da-4ef8-9c5e-1d64820fb01c", "comment": "Malware payload (RedLineStealer)", "value": "53fd8fee25e57a37593a9df135063581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753053, "uuid": "ce624a1b-4ca1-4ab0-aeaf-c04ac6f3f1aa", "comment": "Malware payload (RedLineStealer)", "value": "8e9364a6a886ed1a6f9f41ee6dc6c6a704d042a64b0fc7137a57502390a7df32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753053, "uuid": "1db21735-487b-4104-9ea3-ea8741be61db", "comment": "Malware payload (RedLineStealer)", "value": "c6cce0552343ab166483d1cf0a4033b841639e35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753053, "uuid": "184b8203-2c4d-4dbb-90ce-323dbc60192e", "comment": "Malware payload (RedLineStealer)", "value": "88f579b93b120bb6089c9cbfd61a7878fdae352ca68a54413bad75e4aab33f7358ee9c104522ff5827c2c6da9f4754e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753053, "uuid": "bed397dd-3a01-44d7-be44-a249cb3b653b", "value": "6674AE10B7A0C038F5B612F84A7593B9A63D79B16B7890CF52D526EE5738AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753053, "uuid": "8a306cd8-03b2-4325-b202-0e8b96ea6c77", "value": "f8b8681fdae7ff6c00298505c40cf976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753053, "uuid": "5ccf51f0-3924-4025-8913-05c3a9d3374f", "value": "6144:pvemRZHTGrV6lYsB2gvJZdjjcJ7cu8SY5uD7mlxLO8:pvemRlGrVi40ZdjjafXIuDy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623753053, "uuid": "38f86dde-d080-4e46-aeee-724b676450c8", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623753053, "uuid": "9325c20f-2922-4005-9fc3-f40913c34171", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753053, "uuid": "a5b4fe81-154d-40e4-9744-e464b4f46c60", "value": "53fd8fee25e57a37593a9df135063581.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d250539c-cda1-11eb-875b-42010a9c0053", "comment": "Malware payload (ZLoader)", "timestamp": 1623738046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738046, "uuid": "f8063b16-0126-4d90-b70b-96a49332b0b3", "comment": "Malware payload (ZLoader)", "value": "993ac46f574f979e7c4353a710dad8a9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738046, "uuid": "401efbe2-c25e-4ffa-a5fe-96d3ef335eaa", "comment": "Malware payload (ZLoader)", "value": "8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738046, "uuid": "be3f2e6b-e34a-4e82-93c0-27577ce3bae6", "comment": "Malware payload (ZLoader)", "value": "9ea1f0d5f56155d71a6e39208ea2b8bb67dbcf6d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738046, "uuid": "2a6cc26d-f4e2-407e-a00f-84dea5974e58", "comment": "Malware payload (ZLoader)", "value": "1bb520f06d3651ebad4b5737c316e98eead073742b8c2a96ccf6a3c5383ecfd4febe327f7115eede17f3d9a6b4367abf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738046, "uuid": "38d55c78-3e65-4653-ba75-688438040a21", "value": "A464F2015B1FD099D37E29B8C8F6C3C584D9CE0A29404C5CB3983BF5E67A5C8BAB651E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738046, "uuid": "6c8e1386-6d22-416b-8fb8-193afdf8bd0f", "value": "302dc27ee8fb51d51fd455c5c954a121", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738046, "uuid": "db6e16da-2e61-46a4-a8e5-cda84a432fcb", "value": "3072:IW3jihpPN6334j29ujis6fyMhzEeSOTDAUnDAVnNrRV+BwrLcqfQD4YGqUS5LW2:H3j8pPN6n4j7Ws61E+ABnF/cl0qUuW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738046, "uuid": "5bd8ccf8-146c-4ba3-bf68-f86a30151cee", "value": 313688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738046, "uuid": "09b76af9-fdaa-45d2-85f3-c4c63ceb2a8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738046, "uuid": "9de1cc2e-90c5-4a6e-9996-58a81e30b42d", "value": "8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97f5678-cddc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623763399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763399, "uuid": "c55859f8-40ba-4a50-a0db-a59c38ed6bec", "comment": "Malware payload (AgentTesla)", "value": "73c306767d36dca8953b29b9ed771c67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763399, "uuid": "4fcebc2c-9e70-4004-a5d4-5fb09649996d", "comment": "Malware payload (AgentTesla)", "value": "8eee1f8b7655d3d380d4e6ab08f039aa8c16982f75d5600616f3999a83fe1ed3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763399, "uuid": "3471b2dc-01be-45b2-bad3-c3ad19c1a116", "comment": "Malware payload (AgentTesla)", "value": "e19ee8159e1cd6d6d141e81db5105ac5d89f102f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763399, "uuid": "6e14ad49-7a81-4165-b7fd-2a2d4416dd24", "comment": "Malware payload (AgentTesla)", "value": "4ba39911c7f51daf91078b9d1275985272f78a0bf13a44daee42a7dd74c0e6c3225c40114fee18517795522cf91cf50e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763399, "uuid": "33c09ade-d751-41ef-99ce-878e647466e0", "value": "69841223BB14D649D0990273C487BFF402B1AE1AC445AF172A957ECD3FB3345A65E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763399, "uuid": "a9ab3b5b-a15a-43e3-a385-c22d791f2c47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763399, "uuid": "4fcc765f-1f09-488f-8cfd-ccfede0c4472", "value": "6144:kFOTHycX3MebKS4uWn1eUKvh69NbVh8eDUcaasNOh1gONygtn5h:kmycDrW1VcWxhhUcaC1zxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623763399, "uuid": "37164d35-7fd4-4bfa-ac88-42ef83bb8409", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623763399, "uuid": "b1b8c141-63cb-4e3f-8ef0-3c7d0f9afba1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763399, "uuid": "c64534d0-3d49-4349-92d4-84140c43f834", "value": "rfq_PO_INV_15062021-00000000000.pdf (211KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bfe3db-cdab-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623742379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742379, "uuid": "399253dd-bc7d-4ed8-bdc4-dd455357f92c", "comment": "Malware payload (Formbook)", "value": "20d6b3f4a0238d0f0763a04f452cc6af", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742379, "uuid": "79a66de0-a267-4f3d-beaa-bec922c8d32d", "comment": "Malware payload (Formbook)", "value": "8f6da30cc1224387f453d33ae7b9e20ff81334387b135cb977eaf5064473225e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742379, "uuid": "85586255-f0a2-4e2c-9a83-0a91431ed639", "comment": "Malware payload (Formbook)", "value": "430b2e046f230172526a9675ca17480f226f5fbb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742379, "uuid": "06979054-b179-4e18-9c96-0f4d8f7f9ea5", "comment": "Malware payload (Formbook)", "value": "276208bd33d527f5f7be4705ac0b8412ff4aa4ed7ca75c6553dfc9e13452c43997c178a86a6ee4d73c5ea88f7a396595", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742379, "uuid": "d8a52b7f-8e3b-4b89-9a3f-37b4dcfa82ca", "value": "AA741242B2A4F617D91BA235488BDBC23366ED4A3B4A834FA1047F5D7BB6F110942B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742379, "uuid": "6fdc3b81-dfb1-4768-ae3d-46ccfd1c1ab6", "value": "6144:jlhk5CDUJUMEUEl+8myYXxKiKz0jpQ+Wb4+2qREMmIEM1cNbeomCsJK:jlhcQMEUElwvXxKDe2YqREMm1vRm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623742379, "uuid": "3193501f-0a4d-4980-bd59-3333c9818264", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623742379, "uuid": "789fe182-d7ac-4d4d-bc84-df77105c42b8", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742379, "uuid": "3673d7a2-1ca5-4b9c-8319-189f69e3420f", "value": "DOC080621-08062021084648.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84871666-cd7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623721595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721595, "uuid": "ba1360c9-41f4-49ed-bd61-20c962d08352", "comment": "Malware payload (Formbook)", "value": "695235475d7ed252bb38729e4330bc5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721595, "uuid": "ad506344-6d71-4c95-9af9-af702b2feef5", "comment": "Malware payload (Formbook)", "value": "922222cecc2ecb241d9a59afc5e652e242f1205f75ac5ea25e4af0d192827602", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721595, "uuid": "b72a3fca-c09c-4dfd-8263-7aae8240bdc7", "comment": "Malware payload (Formbook)", "value": "576a860551ca43eb08fc4b0baec9ebf402f796fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721595, "uuid": "11850059-aaf3-4c17-802e-4873ced1554a", "comment": "Malware payload (Formbook)", "value": "77ca554c92d59f4c06d72a4ed4499da483f989c9505d553542d38a8b8dd9fb09df1c61f9f9cbea8e8b33ffe87426de70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721595, "uuid": "df1d2207-d5f3-4b79-806a-9fee17035c72", "value": "3D159C9C5559CF65F43B1B340054C210E26BEDAF9532DA0EABA2FB7F2A373C38519261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721595, "uuid": "944039b1-121d-42ef-8d86-2e6c3fe9ef8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721595, "uuid": "53234464-9858-4891-9758-b498bb6a9ae5", "value": "24576:L7EwoLWehTGVQlxCMJIshuP9Cix6I8WX:cDnJIdFCiMI8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623721595, "uuid": "4d1cd834-e21d-4d20-b4a6-324ba34b794b", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623721595, "uuid": "eea024f0-27c6-49af-b31a-4053c009b58a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721595, "uuid": "ce812732-81d6-4592-8b29-8ecabbfc3441", "value": "SecuriteInfo.com.Trojan.YakbeexMSIL.ZZ4.3296.25563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efea08a6-ce04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623780616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780616, "uuid": "8ce30785-26a1-4ddf-8586-3a7ba5fcecec", "comment": "Malware payload (Mirai)", "value": "801d5fbb14d7e350e6bd81dd18a56dea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780616, "uuid": "4c1f08aa-f477-4c2b-aaba-6f227a769bf3", "comment": "Malware payload (Mirai)", "value": "928a1b0bc0b657cf1482c901a96a843cfed235b9b2b4fc856e5705d3ce57a7a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780616, "uuid": "0f221eb2-c665-41f5-b23a-e9c5bb17f9da", "comment": "Malware payload (Mirai)", "value": "0a0fce9258b6d177d88167000140e6d874912acc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780616, "uuid": "e05cdd0f-1cfe-4049-acdc-cebf5555b27e", "comment": "Malware payload (Mirai)", "value": "e11c09436c3fbbcbd26b8fad2e99958397b02496d3c13c6c632dda21503b69eae709cfedc3e692aec9f941dee12d811f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780616, "uuid": "1a40fd6b-ec9f-49f6-a370-2539388151c1", "value": "1ED2E160A3769CF0D9F15C308E3BDF0A23D000BCD6EF71665AA015B8B568682D7B53A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780616, "uuid": "191811d9-d8be-40a0-b2dd-c53c6c7da85c", "value": "768:BsUBacyByf/2KXyaeeDpV6JxKTQLo7zs3UozR:BsA/20yalvr6o7ezR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623780616, "uuid": "b79bc994-9c52-40bc-a870-58c1b5552051", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623780616, "uuid": "28c06f8f-52ee-499b-af2e-7c29da7bf76f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780616, "uuid": "3521d89d-6af2-4902-900d-cde59d5ea545", "value": "801d5fbb14d7e350e6bd81dd18a56dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ff4370-cdd3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623759411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759411, "uuid": "bb8dbe50-0809-42c8-9d01-fd176dacea00", "comment": "Malware payload (AgentTesla)", "value": "fef22e21b625751676fac325b7db5bab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759411, "uuid": "db83c778-d799-4877-8800-768841a7ca68", "comment": "Malware payload (AgentTesla)", "value": "92f825a8a6a755a0b0ff41e3b9267aacaa14d95e1c9ed735526515f1491b4936", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759411, "uuid": "311a9773-74be-4d69-9b15-997c5148e090", "comment": "Malware payload (AgentTesla)", "value": "b132cb3b9b0fc1e716850bf17e1bfb0a8617d99e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759411, "uuid": "ae9be31f-32e7-4754-a9be-578859c62473", "comment": "Malware payload (AgentTesla)", "value": "bfea172313858fe27b50cc0a2358756808933e04583a8a899a987ff48ee7807da60107bfefd2dea031c6372a0a48b878", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759411, "uuid": "46bd6530-a4a4-4a39-8221-8dc19a5a5d81", "value": "3115AF565ECE57AFC5658CB69B30AC52C2311CBA2649A3123DC230BDD93F1EEDD9E012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759411, "uuid": "6d34660c-7a19-489b-a46e-befab51e842f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759411, "uuid": "83637f5b-4616-46d6-bc73-299bc3468750", "value": "12288:oWjoJk8PSMPQipP5ybqZxLI8gF0JACM1y9MxH/lxE+OakFBELsQauA8b:BKk8Sipxv/gUAz1y9MxH/bE+OLQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623759411, "uuid": "ab881686-6979-49c9-af88-f18690a5279c", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623759411, "uuid": "7e14ba46-3189-478a-9466-0c7d1c48e05f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759411, "uuid": "205c1310-ee23-4b80-a898-4538080258b7", "value": "P.O. No. M-002-20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0da0e56-cdbf-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623750875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750875, "uuid": "fc2709f3-1188-4144-bb77-1911914efc94", "comment": "Malware payload (Formbook)", "value": "a16db782cfe5e230ebf096ca3ff78037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750875, "uuid": "bddcdacc-f7ff-41f6-bcf8-6a2d7a4dc7e6", "comment": "Malware payload (Formbook)", "value": "94827e12d128626a8d64286432a73293f76cb45c1f523ff0ad7e67b90802a123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750875, "uuid": "b5197942-9f33-4639-83c5-224b619b6d5e", "comment": "Malware payload (Formbook)", "value": "b834e7da1d4c98e7de86798b2e95cee538a9828e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750875, "uuid": "30bcafa6-038d-49cc-934c-931bb25aed7e", "comment": "Malware payload (Formbook)", "value": "1df007bf4502697688dbd933b932ecd1f9fe8be1b98fac25d92698ad8aed2ea40eb6b0da95f9589c5005cae99881d959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750875, "uuid": "c6f9bfd7-fdd0-4a40-92a6-4eed6130fbc3", "value": "26355A8C7655EF9EF4778B3185549C20E553ACAF9217820BA313B67F6A3E3C38E141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750875, "uuid": "3dfea281-17b9-4b9c-887f-e6bf55932179", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750875, "uuid": "7ce01668-19b0-46cc-bec8-3c9d13e72c4d", "value": "12288:pUseaZobjA+9VCZ6vRagWkT6wRndIupvIP4LEYvYykMyBESTNaoYWut31Zl0/H+g:kwobjAOE+1zbpvdPIqSw+ublJIFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623750875, "uuid": "824ae23c-2c9d-45ba-98a2-e9e240a45150", "value": 1079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623750875, "uuid": "b1612e92-63ed-419a-b695-c9c141d1ee72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750875, "uuid": "ebc7bc02-b891-43a2-9ffe-bc924f14b6fe", "value": "a16db782cfe5e230ebf096ca3ff78037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd5be8d-cdd9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623761879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761879, "uuid": "ff4bac52-6dc5-4393-aad7-54346ebf8b80", "comment": "Malware payload", "value": "ee62f7b45e935e99c6c26e4c3eead4f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761879, "uuid": "56d76456-65af-45ee-b2e6-57dc396a6e83", "comment": "Malware payload", "value": "949b68beab7b82f9c18962df03d52a02a963263103606c758f668476868a1381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761879, "uuid": "2187b114-c567-4614-8347-06337a8f1ca0", "comment": "Malware payload", "value": "4092357b2c76653fc77c0c8d963f9f50c8f07f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761879, "uuid": "d1cecc28-0034-43ed-8e08-68e6f82f6625", "comment": "Malware payload", "value": "ad422a2e254c83f273ec68850fa36a570bba689e35052ac63d3b860f40bc9597ebd4a46e3bb1d3ddc4a0a131d127321d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761879, "uuid": "c3cfe1f3-6f32-4d25-a616-fbfe549d5cd5", "value": "9C25CE262E947B25F4FC0A76FCE49311927BBC027B22C7DDA8D8354E65B3F95851230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761879, "uuid": "ed8f1435-396a-44be-ba83-b509bacbd6e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761879, "uuid": "966df0f3-6492-48d3-9682-505d26b0af0e", "value": "12288:3U/7cb5Lqbp24e70EAeF5cKU12ElWv0yegNSf8XX9Z6dvquwaHplvVBu3Iafh:9bglgB5cJ3vZNKXjEquPHplvlafh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761879, "uuid": "b6bd1595-45d4-425c-9db4-d895e844d23e", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761879, "uuid": "1bccf237-ac51-42e7-833a-9fec90f8565d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761879, "uuid": "6a27b768-c147-44d1-860e-8f45a43cfae3", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436204aa-ce23-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623793641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623793641, "uuid": "ea23f193-6bb2-4e8c-9c52-0f72e19a7235", "comment": "Malware payload", "value": "038c0b651879dddb0fc393e43d4daf8b", "object_relation": "md5", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623793641, "uuid": "6c9ec532-e972-4fa7-9277-dc02b93ba0f0", "comment": "Malware payload", "value": "94ec2aceb11df4cbcf36d6103f9e539f778a0c7b252d16b3311c4c66ac882572", "object_relation": "sha256", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623793641, "uuid": "4919df7e-8a7b-4645-9c81-19f1d06e41b5", "comment": "Malware payload", "value": "f92d919e588417b8d3dda21839f547f9dc824bc3", "object_relation": "sha1", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623793641, "uuid": "09979ea7-399d-48c2-9ee6-01448fbd87ea", "comment": "Malware payload", "value": "73cfda94efd19c6ac0b6b97dccf38d328fd05866f4077c4ed7a13d4ee93e408579809a36dcac90486b460cde83e00816", "object_relation": "sha3-384", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false } ] }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623793641, "uuid": "8e863b6f-c335-4092-9e6c-5e69b21f182e", "value": "3:4WQHn:1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623793641, "uuid": "cf9de4c6-75c8-4e53-8b13-5c23696647a2", "value": 10, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623793641, "uuid": "c60bdb98-1379-4817-816e-e46419a7fd8b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623793641, "uuid": "42308f8b-0f7e-4b20-8dbb-9119a7aa5857", "value": "malbot.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c27cc62-cdcb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623755994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755994, "uuid": "8548cb51-a7d5-4c23-a8de-4f3a612d519f", "comment": "Malware payload", "value": "710ed49d2ea4c31614ec7167fc2dd67c", "object_relation": "md5", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755994, "uuid": "c5778634-4841-43e3-ad20-7c8d148da2e3", "comment": "Malware payload", "value": "956afc0c6d10b544f71fee126a4fd36f91fb64c2ed86b73ea1b44dc57a7e2082", "object_relation": "sha256", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755994, "uuid": "cce7ffe9-5bd4-406a-809f-5a01055d9c1b", "comment": "Malware payload", "value": "f5b961ce09e158c3c1d9531767ace98f3d173550", "object_relation": "sha1", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755994, "uuid": "5d776cfd-acd2-4e81-9b15-4a0a3f26a333", "comment": "Malware payload", "value": "2aaae0f64be6ad47a95edf17ad56cef877297899bf50d4774e459fe32a974608fd3617779cef76e85ea2ded46888be4a", "object_relation": "sha3-384", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755994, "uuid": "eef69198-7b9d-40f0-b3b3-89b130e02f48", "value": "9415E102BBC085B2D46A413484AB9F66A775FE005F6187CF2798732E1F723C0AF39695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755994, "uuid": "4a46ef18-5f17-4e12-87a4-bddb1b81d4d1", "value": "dabd35e6380e4e172d5ef74c7c6e54aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755994, "uuid": "b7b9673c-de06-4b6f-b69d-56972e9bdce4", "value": "12288:t0A36mKEm14uoyrT4NOYoF902Lttt5SFMEVfGG0eAyWv2xQcu61tGd8AKFUx4sX:d3R0JdUGF90GS5p0eApNdNKFtsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755994, "uuid": "d389bfcb-d86a-436e-b17a-7dbbe9edd1a1", "value": 897781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755994, "uuid": "e417e91e-3bea-4e7d-a279-0852bfeba81e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755994, "uuid": "d9650cc5-4dce-4426-9cc2-5a89acb055bd", "value": "Folder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6bc34c-cdc3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623752664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752664, "uuid": "45f5a890-aec6-49b9-8e3e-f68c29385043", "comment": "Malware payload (Formbook)", "value": "4d7a435c6bf8b2ee0085275e74a88309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752664, "uuid": "192be2dc-ebfc-4c5e-a68a-3fa365d69db4", "comment": "Malware payload (Formbook)", "value": "9624205b61e073bf50cf19e4c5412bf620218a2637315701c5fa78de627a5944", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752664, "uuid": "d7bd0670-3d89-44e9-a297-cc0ef501a5db", "comment": "Malware payload (Formbook)", "value": "15e641b1dcb86317a3fb2af16f87d5f3b1cdbade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752664, "uuid": "b176f98b-f368-44f8-aa71-17a4e7fbe718", "comment": "Malware payload (Formbook)", "value": "2aee4690543ca3d62a2fb2320620627968d118c742eda327557ee915edb32a27eb73abd670574b5bdeb3f98c732ed6fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752664, "uuid": "8ad847f1-4ffa-44fc-be34-8d9f65d57574", "value": "1434121275E49CF3FEA74BF410F3E325FBF3D301168129A763554E5ABA3228789242A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752664, "uuid": "de381ff1-5490-4ad5-ba65-e47bb1a0dd3e", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752664, "uuid": "f3412282-909a-42a8-84a4-513a13e4fc34", "value": "3072:DQIURTXJ+MCXS/Pfpb8CO0U5GX1SU7efpwFq20a+p4PIsd8N/HvHqgaro6sJLDp:Ds9WS/ZQUAGneGz0aWQovvHqJFsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752664, "uuid": "6891c190-e3aa-4a4e-b06d-b369ea2120bb", "value": 245607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752664, "uuid": "f778d26e-6ddb-4d68-8e54-f76577c883a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752664, "uuid": "0a382611-537e-4dff-a4a0-5fea81a8d9ab", "value": "9624205b61e073bf50cf19e4c5412bf620218a2637315701c5fa78de627a5944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb386db-cda0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623737686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737686, "uuid": "5907ad26-9be9-4188-951c-951745d1621a", "comment": "Malware payload (AgentTesla)", "value": "5e22471e549b29bd24260acef692cc7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737686, "uuid": "3debe2df-df0b-41ba-b719-869e3d708641", "comment": "Malware payload (AgentTesla)", "value": "97176022ddfb3e4bf47b232755c82139220328a52e6e825ed783cdbdf3549757", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737686, "uuid": "a4ec5300-39d0-4d5b-a805-33828f13cfcc", "comment": "Malware payload (AgentTesla)", "value": "30135f32271512277a95fcb9162e652f655145dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737686, "uuid": "3e0bbfba-27ec-4503-9c88-583be8d2a602", "comment": "Malware payload (AgentTesla)", "value": "ef3303c4b484ba30eec527765353bfdbe6758c9e0356cdc0ee9bfc67f22076f85d98573396adab3c519f2b2ad5e0a8bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737686, "uuid": "62fc70a0-5605-42a5-ae96-749c844429c4", "value": "D35412AD92E4459BE41A09712557AF3AE43AE3692BC3630F97521F7E2B004C3CE523F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737686, "uuid": "98ae293e-d1b1-4b20-8da5-284ea721ae53", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737686, "uuid": "1fcdb593-6442-4b84-838d-8a7127685d8e", "value": "6144:cQqJ+LeRXqpzjAGZB6t7ODDUVa5Qje2udbMUtCUOAxat:E+yRXKM7YQq2bUMUTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737686, "uuid": "d0189198-202a-48e9-8965-fcdba4881143", "value": 279869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737686, "uuid": "42bdb669-eddb-4887-8d74-b027727784a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737686, "uuid": "865d67ab-829b-4602-ad04-1a72ba3428c3", "value": "PAYMENT6.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59c1710-cdc3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623752628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752628, "uuid": "41133b96-1527-4808-bdd1-418fef0ac289", "comment": "Malware payload (AgentTesla)", "value": "08536f84f5d667336f2084bb70e11aaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752628, "uuid": "2259183c-7eca-4a17-9c58-99548844c3f1", "comment": "Malware payload (AgentTesla)", "value": "977a402af323f95205b3742cd16f912e31bce51f9f08ce85e8745c4ebaca65ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752628, "uuid": "2f9f135f-5442-46bd-b4b6-7bda008ae6f7", "comment": "Malware payload (AgentTesla)", "value": "d90aa8e785fe30b30efce05e563f7e536d18c2b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752628, "uuid": "ce187741-a416-480c-823f-befd5e438b6d", "comment": "Malware payload (AgentTesla)", "value": "e12b40a4874036ac4b5519a0f3f33172113e5e9cb97c2893f546bdf7e07fc65f5dbe2bded565cd7b6da6585a764af432", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752628, "uuid": "f8354a23-23f5-4add-a3b9-2c2ba176dd65", "value": "C4F42344A8328B019711593EF205B319D3E77DB9C0B6A655D00172DCA9ED3E84F3EBA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752628, "uuid": "79257079-e2b1-46ba-ac1e-7c7e016de338", "value": "12288:x1K41qucrAhKDLE443vTy6U2D20rN9ow2uJeu7J7PVOjcRCMMmBHQsbWfmty6j+I:xv1quV/TyfafrN9o/uJeud7P7FjBpWfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752628, "uuid": "a47c42a2-a0c5-4ad0-8a62-76928fac721c", "value": 767219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752628, "uuid": "19c2321a-3db5-46f1-befc-011c5f7cbd18", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752628, "uuid": "6029bff1-673d-4b0a-b728-7fac191f5d3d", "value": "977a402af323f95205b3742cd16f912e31bce51f9f08ce85e8745c4ebaca65ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4390ea68-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736948, "uuid": "ad6b1892-2387-4c5f-b678-fe27a5d72c65", "comment": "Malware payload (IcedID)", "value": "90904b0c611bb1760c99c11b68555343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736948, "uuid": "937bc744-1045-4b26-a21d-51fe54fff903", "comment": "Malware payload (IcedID)", "value": "97b295039f55ad1085af858dd0906100809a8556fc75b1701b630dc56fdc1743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736948, "uuid": "6c53d2c5-aba9-4256-adea-66720fc8de31", "comment": "Malware payload (IcedID)", "value": "43a9ea7ca2d9643beb419c83d32f0b0197109e07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736948, "uuid": "2ad0fe6e-4784-4126-b693-89028f6f41cd", "comment": "Malware payload (IcedID)", "value": "c9bad075ef14b71f5db88fc9ae41f5dcac4142bd7071aea60f185b036b0d1d568190f96d0a02ff8b4a7c5c559f54c75e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736948, "uuid": "4bbcf79b-06d3-48ab-8c91-d086114c564e", "value": "4BB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736948, "uuid": "90a0432c-151a-4c06-9df7-576eb3b5d94b", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736948, "uuid": "f669b359-609b-47f3-bea1-0be06dacf8bc", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8Q:t082TLrbNGoVMjPR5DxDRoFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736948, "uuid": "97a42324-0165-43b4-bf42-0121764d6954", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736948, "uuid": "2300c314-a3ad-4d81-9d78-c3eaf0d1bbf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736948, "uuid": "313be0ae-e772-4eb6-a540-f56c92180245", "value": "97b295039f55ad1085af858dd0906100809a8556fc75b1701b630dc56fdc1743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a6dedc-cdd8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623761647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761647, "uuid": "2f3c6bd9-2715-462f-80fe-f66bfbad7a2d", "comment": "Malware payload (AgentTesla)", "value": "295d92d6d157425c2dce1cedb828ab2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761647, "uuid": "655bf595-e39a-42a1-9019-06abac57e3e6", "comment": "Malware payload (AgentTesla)", "value": "97e48bf9423403b5e23e00741ff95324219736650822fc74525f0a78a286af85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761647, "uuid": "6c5669fa-5187-44c6-b448-2f3b3714f27f", "comment": "Malware payload (AgentTesla)", "value": "e22247462a9f0ae0ab3112ac5a338109d2ea2566", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761647, "uuid": "964aaba0-2c5c-4272-bd1f-e92311889e7d", "comment": "Malware payload (AgentTesla)", "value": "d2ed659b850056ed587b91d9ea86b98d2f5c51c7c34fc70150e9f29bb6d4e345d804569c43dc3f02ddd24c91587081d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761647, "uuid": "2af5f279-ccf5-4e50-9b37-d8f968e62e85", "value": "4005F0F823948A6BEB6D1971C111528043F68627710EFF9D3DA968DC17C370263E9B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761647, "uuid": "8737c232-33b7-4b5e-b4fb-5274a5cc2882", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761647, "uuid": "e1de1614-0c53-40a0-94f5-9b9408424de8", "value": "24576:tW/STLM+HjGlM1foQomAcdUazwYEqHA7CnKKh8:fLLTOmXdUprenKc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761647, "uuid": "ba8184b1-b008-4952-9f50-dc98765fa314", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761647, "uuid": "9a283528-eae4-4320-b963-a2187d123f5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761647, "uuid": "b22212c8-4473-444c-b031-5785b183657a", "value": "SWIFT Msg of USD 78,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e86249-cdd9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623761755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761755, "uuid": "552dda02-9dbe-4c15-8c14-c08dc8224de0", "comment": "Malware payload (AgentTesla)", "value": "8d3ff1cd869c299a5d6ce4e6c56c727a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761755, "uuid": "c32e6bf8-6eb6-4972-bcd1-222582870dfe", "comment": "Malware payload (AgentTesla)", "value": "9a04777899da2509413e9627255b0dbd173151f2ba4999c8840e3e10f141e8ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761755, "uuid": "96e3215d-92f4-414e-ae93-d021fd340330", "comment": "Malware payload (AgentTesla)", "value": "f7ca84790784632c22b8109f31743749f0b27fc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761755, "uuid": "e2674172-21d0-4593-954a-560389ebf2dd", "comment": "Malware payload (AgentTesla)", "value": "7b0c44647af9cf6b282ef90061a08baf6ce81c63e9eb6664a94a5e766caa5a601485af3537fbdb063a8d54b97465947a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761755, "uuid": "dd7f1987-2c89-489e-9d36-fb43bdda3cd5", "value": "5115AD9C5959DFA4F47B1B384050C210A267ECAF9531DA0EABA5FB7F2B333C38519261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761755, "uuid": "93fa8d52-c0aa-45be-918d-3ac2770d9087", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761755, "uuid": "fed18361-e7f9-4503-a759-aca7638c47f5", "value": "12288:TtdUB9VCZ6vwTAepnFBxVjwxcr+I7Bk7eigafrski1Y3VSIXoWW+PPPPPPPPPPPl:Ttd6wTAeZFBxVj9+8B6KafQknFSITW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761755, "uuid": "9fdb585b-be72-49c8-bcc7-3dcf71f22a57", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761755, "uuid": "db854106-5db4-4bb8-aca7-31320da0c6d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761755, "uuid": "19db2ade-b350-4550-8ccd-416d63af6add", "value": "a4jYOP9fDJgkWLR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832e3c96-cda3-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623738772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738772, "uuid": "e31efe29-4234-4789-ba23-968c8a22d355", "comment": "Malware payload (DanaBot)", "value": "650c7f3d80b1727d98ecdddfb80a4325", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738772, "uuid": "ea764d28-3d7f-4215-9c04-5dc2a3d52ab9", "comment": "Malware payload (DanaBot)", "value": "9a474c4103304066f985404de874352eb3ad3bd4a313494373a3c296b088ae88", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738772, "uuid": "7abcfdd5-aea5-4e95-9664-435ea9e23ac9", "comment": "Malware payload (DanaBot)", "value": "287a83aefe7a0f9df55490934d9ee90f9255f09f", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738772, "uuid": "40095808-5ba7-4199-9ca1-0162c47941e2", "comment": "Malware payload (DanaBot)", "value": "86910bdb11a4dc0d6cdf9d8ed1b4f40ddba18270c07c3ac2deec6e013c06ede2a176f17a3f2004b73f4d3df3893e0e3a", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738772, "uuid": "fdaa5611-3b13-41da-b0bc-06f6ea2b8d91", "value": "32563321E721C0F5F4B211BCE8779B6695EEFDE0A72494C792C826EE99604E0DC30767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738772, "uuid": "ba3b9349-57c8-4e2e-ba2e-33555a478646", "value": "65cee1cc96d935afa5d7eb55e18fefb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738772, "uuid": "f99045b4-31a4-4089-8fcc-d9d78dd65c06", "value": "98304:sBDQlx2TdP3yUGkNwbWPsQFte9TV66VlVlxJKD7DNMH5B7pzD+tIM9:sD8x2dP9GOwbWPsYe9R3xlyaNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738772, "uuid": "553df518-40ce-4645-8053-270dd47731b0", "value": 6352384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738772, "uuid": "a55af440-4db7-475f-8059-e46cc4bb6fcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738772, "uuid": "b3792ca1-bf89-4b7b-a717-5e15ad58d563", "value": "650c7f3d80b1727d98ecdddfb80a4325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf8ca3e-cda0-11eb-875b-42010a9c0053", "comment": "Malware payload (ZLoader)", "timestamp": 1623737661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737661, "uuid": "0504c7cc-4734-4022-9101-84c571589115", "comment": "Malware payload (ZLoader)", "value": "64fcff8a2ff203b88fc722dbd8b5cc97", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NALA LIMITED", "colour": "#14E3BC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737661, "uuid": "57a3a257-f6bc-46f8-8c4f-f3d18b2b0e73", "comment": "Malware payload (ZLoader)", "value": "9afda0de1b54bc55060751b6da6b6f047603214f9de8bf05f79a91c8d00ed4c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NALA LIMITED", "colour": "#14E3BC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737661, "uuid": "e807dfb4-bda4-4e07-a6cd-31945fdce6c1", "comment": "Malware payload (ZLoader)", "value": "e15c8b910562fea492d5302d2a951acdc239018b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NALA LIMITED", "colour": "#14E3BC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737661, "uuid": "95bd32ba-e2dd-421d-9abf-1259b3fc9064", "comment": "Malware payload (ZLoader)", "value": "e8419611ebeef39b9d757833647b6e612115f65440f652595b15a93c95548a5824fd834a09f59917e1418535eeacda8e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NALA LIMITED", "colour": "#14E3BC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737661, "uuid": "3accf30d-b24e-40c0-843d-d24acb33baf2", "value": "9174E1E0F7056687D49C2EB4B0F1CA2FF228EE118214597B71D96A37E546AC1B20367F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737661, "uuid": "d559f03e-1d7b-4443-8e84-6f6cfe14d8e2", "value": "e290bdeb69880586a940d12c2e4d8841", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737661, "uuid": "e54eaaab-5e14-476c-bfaf-ffe7dcd4a8cb", "value": "3072:Su+DLJv0ysCW1oh6BUzUHInj8He+vniZNUn8+Hrh+BgxQ6/MH:Su+D1v9sz1Xgtj6PR8qFpUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737661, "uuid": "c3bb6df7-99f7-4045-8aec-aa8e27182caa", "value": 344048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737661, "uuid": "3bdf03da-bd84-4baa-8a5c-fcbfe7895829", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737661, "uuid": "8b809239-2a60-41e5-9168-6ccd6c90fd48", "value": "NALA LIMITED", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01a2428-cdcf-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623757799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757799, "uuid": "46b7b972-5ebe-4b5d-9a88-e6c22d92fafe", "comment": "Malware payload (AsyncRAT)", "value": "7f525769373471b982bdecd51a719681", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757799, "uuid": "0c478a16-13b4-4d18-b2b1-42c42658bd27", "comment": "Malware payload (AsyncRAT)", "value": "9c8d663a84c8dff4985caa5cc816a1951ef7873387d41ce8aed67e7e00a4cb7a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757799, "uuid": "829b707c-50c6-4219-8c7d-807ee9fc7a46", "comment": "Malware payload (AsyncRAT)", "value": "b69b834e37e5ad4b1c70be99451f9190cc7568f8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757799, "uuid": "1fd7cf24-7bd0-4fd5-af96-961a646a0957", "comment": "Malware payload (AsyncRAT)", "value": "1d3697447c2ffd6826d43413881bc28cbd7afd8c07c47d5a4203bd9e555a3f1a65cda047edc83e961c725ffc819a1e12", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757799, "uuid": "5531c1e5-d333-439b-925a-b85ea97e0ccf", "value": "4AF49D575ECE56AFC5658CB69B30AC56C2311CBA2609A3132DC234BDD93F1EECD9E012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757799, "uuid": "d7bf085b-0246-4a91-b5b3-7e693c8a8ee5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757799, "uuid": "9c2302fe-40ab-431c-a02d-92a456389160", "value": "12288:USlwCaSMPQipP5QqwzVUzl0JJeBZsLw1/RFewkZD1:wCFipiqyu50JqsEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623757799, "uuid": "fc180e45-6ea2-4cde-ae27-b18dd6ea8af1", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623757799, "uuid": "114e6572-f70f-496b-ae71-5740c88bbf2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757799, "uuid": "fba88d69-1a95-47ea-a677-b5cf0f50f942", "value": "7f525769373471b982bdecd51a719681.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e861ed-cdb5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623746558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746558, "uuid": "6142edae-faba-4175-b941-81a78648acb9", "comment": "Malware payload (Formbook)", "value": "67c8ecd6af15b24d8ada9142aa3bec6e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746558, "uuid": "5c1bc479-7191-4ae1-8a81-6fbac8904143", "comment": "Malware payload (Formbook)", "value": "9c9c3a88a1aed30e34abbae91f84f82d1777bcf303f8dabbbdc8330d2090febc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746558, "uuid": "3bd7114d-1d3a-497f-84b3-ebac5b382d0a", "comment": "Malware payload (Formbook)", "value": "f55c87f0da307e1049847b1f3cbfe90b541db063", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746558, "uuid": "8513db3c-6cbf-466c-adc4-c5fac8707056", "comment": "Malware payload (Formbook)", "value": "ba53f7aff95fbc3e2c1cad41ceaacebb9b40917373aa608cbc5e613979db1e9a0775a4d25d09295e793c774c2f85d604", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746558, "uuid": "0b273de2-d43e-4adb-90b3-6bd736755f86", "value": "0C227E2DD243B80AD11618BDD16857F4F7AD1266D532BC1B6046779C0BB12C38395EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746558, "uuid": "b24f6999-7e56-4cca-bdd0-ff2076cacb80", "value": "192:ScIMmtP6KQG/bqIyoOYdXcRyDxQ5hJg8371x:SPXiKHqIlOYFyMIvD7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623746558, "uuid": "45ad41e0-501f-49e7-85f4-d71e3e6db3f4", "value": 10346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623746558, "uuid": "663dfb81-029f-405d-9a81-e33fedf17fff", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746558, "uuid": "17e4d94d-a11d-4ef6-bdb2-11fff0fc871a", "value": "Order Specification.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8905d0-cda2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623738384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738384, "uuid": "770fa6d3-bf35-42ab-a536-84c3e763295b", "comment": "Malware payload (RedLineStealer)", "value": "ab1087b320a09a5f46e84083e43ad36e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738384, "uuid": "8db59f11-f94f-47ec-94f4-3ff9526dc2b4", "comment": "Malware payload (RedLineStealer)", "value": "9da961eb9f86dbcb44c49ba409926f8a7e8da8f53dd88a2f2ca68b58d4a58742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738384, "uuid": "1ab0438e-474c-4695-81ec-644d1cf894da", "comment": "Malware payload (RedLineStealer)", "value": "d9d79c8892e12826278732ae0da33b83d8a0fdbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738384, "uuid": "1cb7d293-3317-4c05-9096-5b594cd29c68", "comment": "Malware payload (RedLineStealer)", "value": "6aac8a7a270bed2d6822c5e0d58fedfe1518bd5e2bd9df8aa3b4d144bfb87da81a5053e40f242676009c3bc1118d2fad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738384, "uuid": "72a40bb4-7ac5-4743-abfa-3118abc16ff7", "value": "74456C0937D585C2E3162031E074E73B1E663DBA3864F39A39F83C1F3B79A10699659E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738384, "uuid": "9dbd86e7-1f1e-4058-afa4-0075286309f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738384, "uuid": "513dac2d-9734-4b5e-93a9-2149490a62a9", "value": "12288:OBR+4ItiRlIlXo/VlLj4l7UHtJymnKzPXngx4wbuQJKrbf6m4cDM3DynGoDPJipI:TF10L0tUNJyoOw9bY+HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738384, "uuid": "c328f754-238d-4517-a819-f3f15583ea65", "value": 1236256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738384, "uuid": "6231cfdb-b72b-4827-859d-f33ac1967b14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738384, "uuid": "f837e211-16e3-4b0e-8427-cccc70561da1", "value": "ab1087b320a09a5f46e84083e43ad36e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933d3050-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623769294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769294, "uuid": "77d6b1e9-edc6-4884-9f55-4ae1212c84aa", "comment": "Malware payload (CryptBot)", "value": "80709afce1c9460fabfa07372ec853d8", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769294, "uuid": "115fff20-e8cc-4773-9315-14eabad5bba6", "comment": "Malware payload (CryptBot)", "value": "9e7dfceb92306a6a5f8317840bd2614130973d14c04a88e4bf5a755b583e4ccb", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769294, "uuid": "1947ef2b-303f-4748-8271-788db9f9c398", "comment": "Malware payload (CryptBot)", "value": "fbf281824117cbf2ad096ae422a37aee2f4bbfec", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769294, "uuid": "14376c76-c3ac-4826-83c5-651a2a97183e", "comment": "Malware payload (CryptBot)", "value": "bfe377628a2563739583af2ab5fee5606497d6ffa8ffc95dbb7339fb4f600b5eefb2cb751214c54f28753f83b8f9ed20", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769294, "uuid": "789efac7-245c-4455-bd7a-deb6628be31f", "value": "2675128625A48ABDF6F301F9C8C36A2159F0BB6C461C890227645B395E337FC993716F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769294, "uuid": "46805f6f-48f7-4f1d-a9b5-e0beb67fa79f", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769294, "uuid": "583455e1-c39c-413f-abd9-edc9dc0dd802", "value": "49152:niqBXQ1NZB08zPcR1/CCmCI9oGCkZj6mNF:nBRQDZW8zk7/+CIpCE6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769294, "uuid": "1bbcf658-baa5-45d1-9067-8b7d078c1c9f", "value": 1691446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769294, "uuid": "43947169-24f1-4ab3-9644-0513622c3cc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769294, "uuid": "cc73f93b-815c-4148-a8e4-325838f8e1c4", "value": "80709afce1c9460fabfa07372ec853d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd262919-cdaa-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623741930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623741930, "uuid": "899f3cb6-f194-4ea6-9e52-1ad5379e4b73", "comment": "Malware payload (SnakeKeylogger)", "value": "60567906a34b744f9668023ce49fa659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623741930, "uuid": "21ac5fb1-fb80-408d-b58f-2eaf2d61dde3", "comment": "Malware payload (SnakeKeylogger)", "value": "9ed1922cf8342d70294eed8b7a917cf8ca359f41a27edf0e11709199a50d51d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623741930, "uuid": "296e67d2-75cc-4078-9e4e-557196a05a9b", "comment": "Malware payload (SnakeKeylogger)", "value": "d6f1e15f92692f1c3a269259090ec9fa2cf5dae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623741930, "uuid": "4d7e3b77-9bbc-493e-b59f-b095296ba38a", "comment": "Malware payload (SnakeKeylogger)", "value": "e064f3bfea703011edda0f5e8928f7ad67cfa3c25a079563a9045a50db105d2ca92e8ca36f9ca89a3facf8bbf8c8bdb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623741930, "uuid": "a79bafd2-4908-405a-82dd-bb59992e3f75", "value": "7EA423076BD1987BC18621B029F9C776DBFF320C093A03DB7B985B2BB85725254E52D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623741930, "uuid": "d78ac2c4-0a4e-4e67-8636-42bc8460e89c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623741930, "uuid": "c5df6d5d-3929-4f7f-bde9-00eee9ca8ad4", "value": "12288:mZPeEdWJcLEAPbWEe5O+PPP3h7OFIVPC37OhO2:mZPzWJBAPbWEe5Ou2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623741930, "uuid": "791d106f-58c7-4a42-a773-0a9fa1a30ca8", "value": 464328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623741930, "uuid": "ec813bcf-410d-46a9-bce7-34f37ecb2c03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623741930, "uuid": "85b89dd9-33c1-49da-a4ae-4271e0f22001", "value": "payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2674b0a6-cdd9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623761810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761810, "uuid": "c0efea48-02af-4849-a44e-eb9732dec53b", "comment": "Malware payload (AgentTesla)", "value": "de46e16c9e4125141ea0e8a384372118", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761810, "uuid": "6db3dcde-5af1-4de2-9018-62167630a339", "comment": "Malware payload (AgentTesla)", "value": "a016990a2bb73dc10711541c87881711fa164e25d475e3a0de134ffe79b29edc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761810, "uuid": "235a275a-efd5-48bb-9726-341a60a40715", "comment": "Malware payload (AgentTesla)", "value": "eaa891e7c4d67f7074c4e52206dd7eb9f2d8eaa0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761810, "uuid": "ed469fe5-dfdf-4028-92fb-2f293b8d97fd", "comment": "Malware payload (AgentTesla)", "value": "38eaf911345f9d522480a1a75dc94d6bb3dd94e41225f6fbe27166ce9263024cd0d06cce0c676cb026c4735f183ad0ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761810, "uuid": "912e3c20-06d3-4919-a8c4-b520db71ef1e", "value": "B7458D5836B0B59EC457CAF389E45C10EA61AC6A571FD207B03336AD9D3E1879E053F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761810, "uuid": "104aa455-0349-40d7-874a-d833918b331a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761810, "uuid": "d9365d6b-69ee-480a-882d-c92d01645a03", "value": "12288:UTz4jN9VCZ6vjabk+0DVSIYFskb0w7b1/6//P7Ai1QQskctm5A4VS69C9FgIxdWf:UQjdjaYpDoIvk4wn1/wXZ1QQrctm0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761810, "uuid": "85b79228-71ce-4635-867c-2c6ab3bada9f", "value": 1260544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761810, "uuid": "f46b4508-5f5b-46c3-9a22-ae12194dedde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761810, "uuid": "d7fba628-aa7a-4783-adbc-55b8876bda8b", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987e7874-cdc1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623751693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751693, "uuid": "caae974e-d495-4958-a36b-201e74370f48", "comment": "Malware payload (AgentTesla)", "value": "a19292c93b4cca6ea264f6a951ca75a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751693, "uuid": "8efbcefa-c70e-448f-a471-b50ecf290397", "comment": "Malware payload (AgentTesla)", "value": "a0fc7a3730fb9125bd92aa5f06e1942ae159a2030e228bc718fefac556a81a5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751693, "uuid": "84eea037-5ea1-4c87-84b3-d8b65ee115af", "comment": "Malware payload (AgentTesla)", "value": "16bab4a9841408d21ea88854587da21678e8ae89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751693, "uuid": "722bb0eb-87e9-4099-b1ca-aebefce40fe6", "comment": "Malware payload (AgentTesla)", "value": "fc6e1384cf87ac91bf04886e7cb914a37ccd635fd654e2c1d59eb2fbf41f6d94c9afb28187068b7bd06178d1b137abd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751693, "uuid": "0243ad3b-cc93-4aee-b16e-0862689f9cf1", "value": "E705AC9C5549CFA5F47B1B350054D210A227ECAF9532DA1EABA6FB7F2B373C38418261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751693, "uuid": "c7e951e1-c47a-4a6c-a189-b3f71f01eef2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751693, "uuid": "eeadf034-8cb3-4d22-9630-a8eb6aea6330", "value": "24576:VP8TdjTOhPxPFqx3cdkUKaV+WtTxIcWu:4EPkQkLaV+Wt9Icp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623751693, "uuid": "80b6cfaa-4a1d-47a9-b5f5-224c70f4b884", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623751693, "uuid": "0ced1f9b-19fe-46be-882e-9f3cee18ae65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751693, "uuid": "083cb96c-7a8c-4b0a-8bff-7f25e45ae9b6", "value": "invoice-21-05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec6d47e-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736993, "uuid": "9b6608d2-b871-43a7-b92b-cb62a6ce6e9e", "comment": "Malware payload (IcedID)", "value": "d510c8a80ed9f46985a0b811ead31c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736993, "uuid": "26b27a53-6624-4370-acec-ebf9d9cf95b5", "comment": "Malware payload (IcedID)", "value": "a11e47cc595c49e46231e724f448c2ee21e96e98c01ffd79f4ebdc8f8e4faf5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736993, "uuid": "ad398c5b-6400-49d6-873a-f5818bdbfe98", "comment": "Malware payload (IcedID)", "value": "61858226c195758e74c2c94da9ba70e3b100d7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736993, "uuid": "786e6a00-2eef-489e-b037-3233d15547a3", "comment": "Malware payload (IcedID)", "value": "7694d24cc1e297018a2c0e08dc531b763b83f2bbd554cd9edc8c47d3aa7d05e42c504dd446debbb091101927c6c65585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736993, "uuid": "65a3ef00-f230-47e5-be39-c7d7c58b4c8d", "value": "E1B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736993, "uuid": "53bed17c-4516-4a6f-a798-888af0e03956", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736993, "uuid": "bbb52e7a-2c30-4bb1-9ce0-8d25241c155a", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8C:t082TLrbNGoVMjPR5DxDRoFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736993, "uuid": "8d3e9972-ea4a-434e-af93-cf475d696f58", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736993, "uuid": "38d0e556-0877-4d2b-97e7-4238a80ad731", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736993, "uuid": "6da5ed91-795c-4db0-8be9-1ce3db83477f", "value": "a11e47cc595c49e46231e724f448c2ee21e96e98c01ffd79f4ebdc8f8e4faf5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592ae633-ce02-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623779504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779504, "uuid": "29727f84-982b-49a0-9159-ad6d5d72990a", "comment": "Malware payload", "value": "c4f8b9f37c5f2fbf529fab2e07368d80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779504, "uuid": "9667d1b8-1771-4b8d-896a-16da8879bee8", "comment": "Malware payload", "value": "a1319671df15cc2721b89ceb6db7f62a716f6836c191697391f4ac12ca44f567", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779504, "uuid": "0146a244-16d9-4b0c-b0bb-17dde54d6a7f", "comment": "Malware payload", "value": "9569544511da1fbf444ab6efc31cdac4277a321e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779504, "uuid": "88333f57-571c-48ec-acea-945207942e01", "comment": "Malware payload", "value": "d3d731855fcbe92f673a465cd358e59e2cc2e9c614f0ba98f5d4506d5c4aa0bd641d6f0159bca2eeedfcc7a93a39d1b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779504, "uuid": "cb059523-6744-4a08-b3c0-d3d52fbde514", "value": "8FC48E01BB90C02AF5FA00B9CAB9DBACA9197D719B2840CFB3D06ADF16395E55C31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779504, "uuid": "8981710f-4ec0-4c2b-a845-511f26cd885a", "value": "98842be3b2902122755cb4e299c5bfd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779504, "uuid": "5b9a52d3-b8bf-41ec-83d9-59c686ce5fbd", "value": "12288:GbDnQp+OwPgw7N4rPzcLz67y+er/PA6yUvrWc0NJlB:G3nQoq+N4rg/NATUvrWBnlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623779504, "uuid": "36385a6d-dca0-4f75-a424-aff3c4ef02c8", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623779504, "uuid": "efbafcef-8f89-4361-ae24-c84ebc521ff3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779504, "uuid": "079341ec-0338-454e-98ef-876383ccfd30", "value": "omsh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d845be27-cda5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623739774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739774, "uuid": "70ec965b-703c-44fb-9f85-45ba53fee324", "comment": "Malware payload (AgentTesla)", "value": "ee47019fe6370b168ab07db60efcddf2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739774, "uuid": "9416a9dd-9e8e-4bde-85e4-b49f34096e71", "comment": "Malware payload (AgentTesla)", "value": "a1e1d855bbba6e62c8c19f3311a41e0c18cb556ce694e360757d3ad964bb600e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739774, "uuid": "733a1aa5-69bc-4614-bc0c-6a5fd6d7ab85", "comment": "Malware payload (AgentTesla)", "value": "278e1ea03e963ebb2e45d76b793f7b41a0c53035", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739774, "uuid": "ee3bf19e-6de0-441b-b62e-567b1830e72f", "comment": "Malware payload (AgentTesla)", "value": "351fe9fb7e5015f30085c70dcbac215a0a39a58c500daa63728522a68c751d9b4bd3ddaafb5ca0799345cb8182d1f35f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739774, "uuid": "80408eac-4e0c-4e72-925f-fe88f2b86011", "value": "5A256C8C7655FA9EE4378B3185548C20E613ACAF4727920F9213B27F5A3E2D7CE185B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739774, "uuid": "84918eff-b423-4550-882d-13d6c955a7aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739774, "uuid": "7f2df810-7c5f-4b5c-bc5b-702b5312ecd4", "value": "12288:Qa1xdo29VCZ6v24/C1JcuLlsAgeUzXbg0G7gU6z5ppzYOtjrANx4/coNXOQBwwEm:x6229JPsAiG7d6zbpjxcNxgcoe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739774, "uuid": "c9922046-24e2-474b-9ed8-77cb546bfdbc", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739774, "uuid": "e19a6ec1-8f17-466e-bfc1-12b70b9b3611", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739774, "uuid": "13230148-faf5-4e4f-9d9a-e31f2778a278", "value": "SecuriteInfo.com.Trojan.YakbeexMSIL.ZZ4.7168.32733", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2797e39-cd6c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623715310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623715310, "uuid": "1a2a35f1-bdd1-4ace-b37d-403c11e02dd8", "comment": "Malware payload (Mirai)", "value": "d5a960c44c40677e8abf93032ecebbe2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623715310, "uuid": "90355a17-24d3-496d-b1cd-b8e42e95767f", "comment": "Malware payload (Mirai)", "value": "a308245f3a2e352485a93924d4aeb18367a46729be553bff39552cb6ae4a994a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623715310, "uuid": "8adc89cc-7f1d-4a6f-91e9-d614e2f28217", "comment": "Malware payload (Mirai)", "value": "dcbeda18a7efa5f69e7e69a2e589f49d22a49e24", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623715310, "uuid": "7bd677fa-8285-4bbd-8c78-dc24925d347b", "comment": "Malware payload (Mirai)", "value": "5ec99525b9ed9df9e127d7e744193f62c85bba2deafcb6bd85c138861fa8735ed9664070d195bbe63a823d12abd64a8e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623715310, "uuid": "b04b3bff-0aa1-4d87-a71b-3890987fbfc3", "value": "1B332A91BD81AA03C6D5527BFA1F42897B26639CE2EE3303DE159F2137C791B0E6B111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623715310, "uuid": "bdca1250-976b-429a-a55a-0015b557fe06", "value": "768:m8gSM16zWhg4deQEOuXeYzPIeagm7TxpqBRWeMmJNNrSpRAV5zOr19ywGI:0R16ShL4pXTmSgmlqWV5irix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623715310, "uuid": "6a74cfe2-2221-49c0-b72e-7c2f8e203783", "value": 50332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623715310, "uuid": "5b101a0d-8ef7-4beb-9d27-0ed7c1d9dbfc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623715310, "uuid": "2c579ba2-b671-44ee-877a-e74514c3551d", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1916a9aa-cd97-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623733440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733440, "uuid": "6f6f33d0-315f-4feb-bc32-63b992a4f98b", "comment": "Malware payload (Formbook)", "value": "cca627a3f639d8da7564dd54648876c1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733440, "uuid": "fd3906b3-1c5c-4357-afc4-329045511a3f", "comment": "Malware payload (Formbook)", "value": "a320463a59c98c454a6f9c6d7cfd20cd9cf6225bd702d67e9a81dc20a321b0ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733440, "uuid": "2d5f65df-bdc8-41b9-b057-9aa5f5f43c8b", "comment": "Malware payload (Formbook)", "value": "9f8388a12f48d4b60854c5fb4ec1b847fd5fc185", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733440, "uuid": "916238e6-b2c9-4034-9f49-62bc83966ba2", "comment": "Malware payload (Formbook)", "value": "82ccca26354db262fd655d0c14f3ef55155ee8480898843c192f5c3deb9b672c956d828fb7d952d31ad5bb747fef0fa3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733440, "uuid": "db584b0d-dde1-4f7e-be37-34fb6d7edc03", "value": "7EF4239DCFCD26D03FF36E8274D34886A38DA659F88C85D871DC7EA18E1C7A5181A990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733440, "uuid": "8d233a02-0243-4937-94d6-5970fceb7dff", "value": "12288:wFimd/nL+PQADOfzjVn67zsoSV596kv4/yah5eM/G729vnNhqHw:w/ni4Nfzj9WsBrA/3XeRC9vn3qHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623733440, "uuid": "037f024f-0fb7-4d52-a4b3-815c76d0b347", "value": 740147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623733440, "uuid": "8fdabad9-2a8e-42be-9a78-2477ec718d68", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733440, "uuid": "deff57d7-0a6b-4791-8e2d-4810ca36c741", "value": "Quotation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612892be-cdd6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623760620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760620, "uuid": "5e73563f-8657-4d7b-b82d-113765c45464", "comment": "Malware payload (AgentTesla)", "value": "406914688fb6658ef9939b305bc9d5e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760620, "uuid": "97af4aa7-2601-4332-95ef-29df9e57ada9", "comment": "Malware payload (AgentTesla)", "value": "a353e30831fba78c7d08215500b4dadcdd20e5b147af66d6610012209e515aea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760620, "uuid": "1936f0d5-74ad-4b0c-b9ed-6f92ef670748", "comment": "Malware payload (AgentTesla)", "value": "c96792790fa0bc99c26a3affdd35f6ff2bee6064", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760620, "uuid": "35ae347d-bdfa-48e8-bbf5-cd485974876e", "comment": "Malware payload (AgentTesla)", "value": "3fa3ee60ade2c9fe99af6a01006eb60069d4ad121e15423da91fe0fd4966cdca2127fc70f73c38562ddbd266c7062f59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760620, "uuid": "fcaa3686-e2ba-40fa-b068-23435261937c", "value": "4435BE534ECF826AD2640EB56771EC4B82BA4EB9294422213EC0717DDA371EED4DF532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760620, "uuid": "2d85cd0d-e8ef-4188-8756-9499be864441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760620, "uuid": "124a3ab1-e75a-4242-b630-902f5a8cd5ce", "value": "24576:JipYZbPCG0J0j45Dn7ooQKTy4XMvmDtc8:hFPi/5Ioxy4XhDu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623760620, "uuid": "dc48d500-f73a-4794-b3f9-d6d64c297752", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623760620, "uuid": "63f706a4-ba5b-43f0-9034-160d6dcea90f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760620, "uuid": "a562bfb1-e43e-4f20-9591-f2b65a578ba0", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b747331e-cdd5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623760335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760335, "uuid": "ef527d1e-42d1-47f0-9fac-d6c7845631a5", "comment": "Malware payload (AgentTesla)", "value": "12eb5fab9d27ae2afd8c8a45c9022d4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760335, "uuid": "28518dcc-7839-4443-a918-43e4ea8d15bf", "comment": "Malware payload (AgentTesla)", "value": "a47963fdbc15c52927ee5fe99d79ab636b6787bd3146d79c9934c94d549c5901", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760335, "uuid": "d0197b40-3904-4997-9dc4-4f3082339bb1", "comment": "Malware payload (AgentTesla)", "value": "dcb7d55ace91f4b333083037246f4b320b11d943", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760335, "uuid": "38413487-ddd7-4175-80a4-b4f90117b184", "comment": "Malware payload (AgentTesla)", "value": "c22e2c2978bc6d453732b4ab0670a12741ee0417017d151f84ed60d42de4389daf282a1c29efc32034ce2835f4654602", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760335, "uuid": "5ac24434-a123-4412-956c-dca13868d647", "value": "FA15AE575ECE53AFC5658CB69B30AC5682311CBA2609A3123DC234BDD93F1EFC99E412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760335, "uuid": "4309f9c1-dfd0-4224-b61a-844e80c60aa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760335, "uuid": "701df407-2cda-4c01-a806-cf79c1d6c30d", "value": "12288:YfVLMSMPQipP594AGDkXihAi17f1J6G2cbzKD/b/wi/JFKpv1Hus0aIHEeSYOt:Y9PipcAG0YZ6lcbmDb/Z/J6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623760335, "uuid": "5cc78f56-4c34-41cd-bd7b-26eeb347cf3f", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623760335, "uuid": "a53b0bfb-bf03-4f3c-b5f2-fc403ad458eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760335, "uuid": "7b249945-3a8a-469b-99f4-62e8ee0c667e", "value": "MT 103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6263c66f-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623736999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736999, "uuid": "82107385-1658-48f1-890a-ab98511ec02e", "comment": "Malware payload (IcedID)", "value": "61f6adbbaa184787d4d68b65baf349a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736999, "uuid": "0a840c29-fc4d-4c6c-b282-356c371c5c38", "comment": "Malware payload (IcedID)", "value": "a71cc84ee5ed4352e93d16190b6b234b83ce39d28ce560900abc39ae7e8cae1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736999, "uuid": "4045a0e9-4596-42b3-aad4-f3f67247484b", "comment": "Malware payload (IcedID)", "value": "cfd4e4d05f412ac659fc2e3d35195ded9a04a3ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736999, "uuid": "de10f070-32e3-4ae6-9235-c1a027beffaf", "comment": "Malware payload (IcedID)", "value": "80eff7bab5555d4bf1393e0edd0eb150c6e1221866a80b711a6e3f133ab9b6672e64c08cee325aec3a21f825c9b22d5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736999, "uuid": "fdad8f78-58cf-4b89-b61d-a66b9730600a", "value": "A8B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736999, "uuid": "d9f62029-2e3c-4485-ab11-e6cd04350de4", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736999, "uuid": "66361fda-94c8-4951-b39c-2cada3f189fc", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8G:t082TLrbNGoVMjPR5DxDRoFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736999, "uuid": "f133e269-44b7-41f5-b319-a5ba99e0e7c7", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736999, "uuid": "b7f34cf6-6c4c-498a-9bd6-e02b8bb495ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736999, "uuid": "50ad2d46-7e9e-42f7-addb-260f35094b65", "value": "a71cc84ee5ed4352e93d16190b6b234b83ce39d28ce560900abc39ae7e8cae1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2343d7c4-cdca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623755362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755362, "uuid": "90eeeddc-a10e-443e-9e0b-6d8b31c7953d", "comment": "Malware payload", "value": "9fd7f1f507817297b9e74accedbcdef9", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755362, "uuid": "42a6f493-cc2b-4bf3-b2e3-187c2b6414e8", "comment": "Malware payload", "value": "a7207807ae02df0fc11f04e2e7f4322985fb8fb86306c4bb056658554c9728f1", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755362, "uuid": "5568564b-ca40-41e5-8969-892d414613f9", "comment": "Malware payload", "value": "244d58d768da97a9b7ff7b9ba06018991daabd51", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755362, "uuid": "6cdd5554-d6d4-4427-af15-9469a98460fb", "comment": "Malware payload", "value": "8e2e6bb08f6eb537298b233d9f7b4facafe4f81c5e92a582c34046b4cc3edcb46d57bd3d89ce584ce8ead182f25ee66c", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755362, "uuid": "985c0383-8901-4828-9d35-4d1698038230", "value": "39F19D7ACA3A695AC63EAD3E8731A0ACB1F106542E13624F2641E55C49C8BAF4297402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755362, "uuid": "0defeddf-00e4-4d5d-99de-43f9cb05700d", "value": "192:ZIL90J/N5dZ1dCahECsB0vdheufTBPexDQid5shwDYZ3Xz7L:mZ4hCwESdhHfTBPexkij24qD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755362, "uuid": "9eb1459d-0edf-42cc-a261-0cd0f810c863", "value": 7488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755362, "uuid": "fc8a8a20-a17d-4ffb-8ee2-e601f28e3af6", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755362, "uuid": "df1aab84-1d7e-4bc3-b82c-be44f2bf4e95", "value": "SWIFT 308815.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7fb156-cdbf-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623750869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750869, "uuid": "33e5e3e4-eafc-40ea-8904-8d0a291f7fe9", "comment": "Malware payload (Formbook)", "value": "8449615a04b7ea85bc73fbede0cf0d95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750869, "uuid": "df678296-10a6-4fe1-8f8e-86ac534ed116", "comment": "Malware payload (Formbook)", "value": "a7d608238504263bc730a5744ff6808c78d3003c658db1eec8a30ffd5152f257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750869, "uuid": "480f2e55-1819-44a4-aa61-28e0ec3c6a67", "comment": "Malware payload (Formbook)", "value": "0d07eb7a1fa144e4fdf29417ef1dcef4715f270d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623750869, "uuid": "8c10ec44-a3c1-41b8-8b82-357c012cde9e", "comment": "Malware payload (Formbook)", "value": "8a1b28c6a795da0747a78626d9118f41467c25bf46d2e7d171b3c7ee1b230a4236674988bd7910e09918d0ebe2ac7ea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750869, "uuid": "8a0e918b-52c8-4afa-965a-39b0679601d2", "value": "BC34129222D215F7D8675F742AF35B88E7FDE3112690650747290FAE24341C31A2FEEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750869, "uuid": "4eaaba5e-ff36-4567-b352-4ae53c9f8476", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750869, "uuid": "94998b13-a181-45c8-8532-3feca18324d2", "value": "6144:cQqHAFkcWbIwQJaZMw9B/YNhCSCmpyocwpjlYX8c1iRlK7RFt:mKzWd2QohCSCmpyozppZIimtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623750869, "uuid": "24b6232a-1f4f-44f5-8560-2baf9b0b9fa3", "value": 240979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623750869, "uuid": "70be67cd-3602-4c7b-bd03-59375acd89c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623750869, "uuid": "2a097166-3e09-4bfd-a0ed-63800d2e4221", "value": "8449615a04b7ea85bc73fbede0cf0d95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829b5352-ce0d-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623784298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623784298, "uuid": "838356d8-c2aa-481b-ba03-7b8f87b89e3e", "comment": "Malware payload (DCRat)", "value": "62137247f4c2e5f4f60543a318a4c092", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623784298, "uuid": "f38defa4-8ca3-4814-95c3-00bffbf83d4a", "comment": "Malware payload (DCRat)", "value": "aa2356a089dea9b1884085a9c12401c149f47533851b05e284196d42695c76cb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623784298, "uuid": "97f16be6-6b69-4983-bf6d-189effcdf934", "comment": "Malware payload (DCRat)", "value": "2372a8c8638272f9508f5d1a8cb4a1688b9e5fa3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623784298, "uuid": "f85f6a07-4211-4c52-a63a-0a607cfddc20", "comment": "Malware payload (DCRat)", "value": "56b067a86d3b34385dc76d2e53820fb35a2d709d87195609556eb7b9de4dd3aa211a498ae6b929a676748d5bb03a2590", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623784298, "uuid": "46fe79ce-ba4d-4dc5-9a7b-17eae52b1f7f", "value": "52D409223658CE01C17D2636CADF891C47F8ED41BA62CB1B3E5E72AC64513AB4D0E5DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623784298, "uuid": "fb0f3376-2793-46fe-8f13-ae2c65041cf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623784298, "uuid": "ae57ce8b-e443-4712-8d0b-28134d7080ce", "value": "12288:dEQjYU0exx0Cakn13duExJOThbMk2udqn:dd90zCakruEjihbMo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623784298, "uuid": "56a36b09-d827-4dbf-b0e8-80b895dc7516", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623784298, "uuid": "ca842b11-88f0-4995-9fee-21122f0bc7e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623784298, "uuid": "29f25069-d241-48ec-b3c7-d80318573c48", "value": "AA2356A089DEA9B1884085A9C12401C149F47533851B0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28114119-cdc9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623754940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754940, "uuid": "a68f7208-bbef-4aa5-a28f-5a6bec3ebe1b", "comment": "Malware payload (Formbook)", "value": "0bbbde480a3c5bfb43634ec0a9afb7de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754940, "uuid": "0ab44ccb-a6e7-4f73-88c1-ed25d06a5b48", "comment": "Malware payload (Formbook)", "value": "aaa2dcb2a94844c7059c483090f4d28c0efc2993438ddfc22c6d4c0ec93c0562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754940, "uuid": "9e9059bf-4b54-4fc9-8e80-688d88d185e2", "comment": "Malware payload (Formbook)", "value": "fb47907f37c495afac0e7f783f67595eff3934f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754940, "uuid": "47bb644b-d3e2-478c-9e56-0ac366acb6a4", "comment": "Malware payload (Formbook)", "value": "b9513281269a87b09579f5461843f309fc294789ea94910f2fae889ea0e3b86c8b63fb1ce730ce4afce0b89b127363cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754940, "uuid": "043e0841-e878-4075-8dbf-342516f89f62", "value": "CE24129542C8E837C1025EB636BB8B65C7FFDB065F56078B9BA02F3E261A0D7C958143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754940, "uuid": "ae8c0f5b-7071-41f3-a11f-e2021640fcfa", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754940, "uuid": "5f877b4e-e7a1-4b5b-862d-4e51b7170fe7", "value": "6144:Ds9sfA7vo5w0SCmKP9EvUxEyDzV78B7NeBc+8fP:y8kvo7XPTbEec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623754940, "uuid": "eaa1e287-d868-4696-ac4e-96e9f0142bfc", "value": 227567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623754940, "uuid": "c7446269-76ee-46ea-b704-4941351e8da6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754940, "uuid": "f3fc81c3-6787-4823-b13c-6fcbb3cea3fa", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b83ab33-cd86-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623726116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623726116, "uuid": "df3987bb-2af2-415d-b0a4-4aceb8e6bd44", "comment": "Malware payload (RemcosRAT)", "value": "ca7e038044d7107b1c0c04f14fac12af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623726116, "uuid": "6d04960f-4fb0-409c-9a9b-89825a651164", "comment": "Malware payload (RemcosRAT)", "value": "aafe9e6368558fe7cf16b19ba3579678cb4fbed684f7ef62fa63f61cbff3b896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623726116, "uuid": "ced7f453-2399-4120-adfc-c5243fa980aa", "comment": "Malware payload (RemcosRAT)", "value": "4079d470499d35f20dd68a73ac212e3e67eab30d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623726116, "uuid": "e9621493-5275-4b1c-b426-f6ad3212dd99", "comment": "Malware payload (RemcosRAT)", "value": "86d428f2aedcab1fe60682eeddcd5bdd8645b0e9944330938e843ef130eceb1d659866ca9a3e546ea719f5b6a40e735a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623726116, "uuid": "7f50e8b3-867f-407f-b2e4-6e9764e3e216", "value": "3D826CD58AB45E21D899E37A9CF4C4043B323B4AF8A2DB7B4549404AD68374017BAF3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623726116, "uuid": "b4e04664-85b6-440b-b904-1d982907770a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623726116, "uuid": "4d06112c-6f0f-4785-bab0-ed924071b5c8", "value": "384:3d6YzaeQrxLB4lfLqC4roBp8IYUiqhhgEXHT7hg:3UeQpOlfOHYOqhhgEnhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623726116, "uuid": "7521074e-790d-42ea-a90d-a4b7e6cdb7c6", "value": 18928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623726116, "uuid": "cd3a9c0f-7576-4c8c-aecc-86c92e0055c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623726116, "uuid": "abe78570-74b5-49c3-9a2e-df2ac6c3ceaf", "value": "EXTRACTOSERFINANZA951519390158745693478909849.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3978df60-cde1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623765278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765278, "uuid": "8a09bfa3-b239-4884-8ed8-61b826913405", "comment": "Malware payload", "value": "b3462b93a126346282699ed60ac928d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765278, "uuid": "1d5ceb98-044f-4fd3-9b13-f2e763e11769", "comment": "Malware payload", "value": "ab03dbff727e907334942f8b7a8d42d080a65be1b7ff405dee3398f32d920d12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765278, "uuid": "b6242cb8-6f0c-40b4-be7c-f87e00c407ba", "comment": "Malware payload", "value": "a8b997112dd27a49049b8a2bc3b8f165d9d412d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765278, "uuid": "de2404db-6e9b-4f4f-b80b-63f2989e345b", "comment": "Malware payload", "value": "7b23b474d5c61a50209fefc1980d7a666b5e178715d2f314d5cd1046db91b33fdeab0d4865a84fab7747923ffede4387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765278, "uuid": "876696d7-7497-4660-9a5f-d076cbbca0ea", "value": "E405BEA21E546BDBE2F50838BCC4534622FBAE127722E3C76DC071F99887F81AB51355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765278, "uuid": "d83dd355-11f6-4fa7-a616-2e34211887b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765278, "uuid": "4a0a95af-9b04-44b6-988b-5f861924eac8", "value": "12288:HIponm/DBLiIely3AikgoAfiOSYGgfilo6UJr+QQfiQ6JvquwaHpsavH:H41LrJFDGPeJrpgzGquPHpsavH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623765278, "uuid": "66746b09-b737-4eef-ab26-3904be98f395", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623765278, "uuid": "b202ff66-54f1-4b74-8ef6-134f59c2485c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765278, "uuid": "5974295d-0c7d-4ec1-a2d4-092c99cd5045", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9072cdf-cda2-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1623738433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738433, "uuid": "4df03594-c91a-4073-b7f2-b7df2e8e2b7d", "comment": "Malware payload (AveMariaRAT)", "value": "9ac8fb8a689ca6f593f39d6af98febd7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738433, "uuid": "d086a2dd-180b-4244-9c20-264835d28a3c", "comment": "Malware payload (AveMariaRAT)", "value": "ab06559179332ca586e15a9eb1563c2a10071511d9af052105cf3621c9a3c8c9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738433, "uuid": "eb1ebfbe-509f-46ce-8e55-6238e9c192d8", "comment": "Malware payload (AveMariaRAT)", "value": "7af632c7408de5db97cf001d98b2c867fdbe152e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738433, "uuid": "8061ebd1-b1c0-431f-a944-850181063009", "comment": "Malware payload (AveMariaRAT)", "value": "2e32a3f3112313776cc835958c9f6e04d5d10c217e43730d3c67cb72d0157efa09ad06b2007c1683a8d7c1d4b9a73b45", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738433, "uuid": "e050f9c8-8385-40c2-911b-df6a6d367a07", "value": "09B39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738433, "uuid": "50df1323-05e7-4e09-99e6-4e0f45e53b8b", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738433, "uuid": "7f7f84ca-2a63-4ac1-8522-f83778b82b23", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01k:K1VmhaH8EFvW+0OVE0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738433, "uuid": "6e8cf44e-9461-484e-a50f-58961fa91cd6", "value": 112149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738433, "uuid": "6183081e-277a-4862-8e53-69c8100b9b81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738433, "uuid": "5c06d6e5-4c97-4e28-be04-d9e3f6133c86", "value": "9ac8fb8a689ca6f593f39d6af98febd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2633933f-cdc4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623752790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752790, "uuid": "62c8e4d1-b605-4fbd-ad81-8378d6efe0a0", "comment": "Malware payload (Formbook)", "value": "967a07223984f7400a7e9273a54d4c23", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752790, "uuid": "1f340de4-75e1-4bac-b1b5-32bb42d8a1cc", "comment": "Malware payload (Formbook)", "value": "ac0328ebcf290dac29439cbaa58305043dc41b77e39b3bacdbab06cc5270a6e8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752790, "uuid": "4a12b1a0-4403-4401-89b2-f1c7f9627c7c", "comment": "Malware payload (Formbook)", "value": "f0d52c5c5b67c0703cc617c2dd46eac0e14fac18", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752790, "uuid": "0e9243fa-84dd-4798-9b69-cc89e46a3073", "comment": "Malware payload (Formbook)", "value": "4179495105dc8144c7bafbf25845c4a14c1082a3acfdf0535888c3178b916c2bcafcb0d92005649fe904b22aa456c99b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752790, "uuid": "e712bbe2-2d40-4ef7-bdbf-22f40c7d179a", "value": "AF3412F74CBF7B9B3864BF510BF591BAFC84001A433471564B0EA6AB2D2279A46D2D13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752790, "uuid": "e40dadfb-c7d0-44f0-a13c-39139092d85c", "value": "6144:Y7ZFO0vCTL1vsUjUrABe+XQIEptxhQJyI6:6TPg10UjUr+nQIpyI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752790, "uuid": "17cd6b7d-7b50-4cc2-b38b-1cbf796f34e4", "value": 232970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752790, "uuid": "3343f3b4-688b-4f6c-91a4-dd98f601e82e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752790, "uuid": "096ab4bb-84d8-4fe0-9e68-85b151f58284", "value": "ac0328ebcf290dac29439cbaa58305043dc41b77e39b3bacdbab06cc5270a6e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9a9199-cde1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623765528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765528, "uuid": "f8cf2221-e9ef-4e74-8e8d-468369909da4", "comment": "Malware payload (Mirai)", "value": "a8ae86c9982f6f20be584e10a9a5001d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765528, "uuid": "9513c8aa-d527-4197-9489-d4f4f5f7ecfa", "comment": "Malware payload (Mirai)", "value": "ac17470575682191539008ec80d4e9bc9a089a5db5463b867d4465e163757088", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765528, "uuid": "7d848a9b-f512-4c7f-937e-e33114ff9908", "comment": "Malware payload (Mirai)", "value": "b2538ca2d42477c507ac88cf9f5ad5b12f2450ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765528, "uuid": "c29eca99-2ecb-4803-8e76-0ab9a7cda907", "comment": "Malware payload (Mirai)", "value": "99f68c39f127282df3b6e90f8dc57ae1994e3498f89f4c580c02250615c99f93321f01ae7f1771bda9e038353d712aeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765528, "uuid": "fae44883-ec70-4216-af7b-b1c7ad9e8602", "value": "E2D31985B8818A25C5C713BBF96E00CE331167E9E3DEB122DD111F6077CB91B0D67A9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765528, "uuid": "85dcf27f-ef6f-4b72-91a8-ec0a8e7a0fc8", "value": "3072:a9gzyl1whLi2NVENBz1/NJsItUZJWO9Mam7MqdXyCWWr0Sm8:M3l1whLi2NVENBz1FJsIGZJr9MnXVP0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623765528, "uuid": "a1eb8687-5026-483f-8e5f-345142d98bc0", "value": 140676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623765528, "uuid": "86b87a9b-98ba-4dd6-b63d-904749aa424d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765528, "uuid": "3b1a60c2-af61-4655-b973-1e2f4e931480", "value": "a8ae86c9982f6f20be584e10a9a5001d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c0d311-cde1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623765432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765432, "uuid": "5271b855-448f-4e69-82d5-3df55c314c0b", "comment": "Malware payload", "value": "1b571531b0942e6e008cb5126f3c8d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765432, "uuid": "713113bd-a45d-40db-8408-7d0ec2d16965", "comment": "Malware payload", "value": "acc92fd3a929ed4c52b41547b60563cd68b73701998071c3653424df8f51a474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765432, "uuid": "235dc0dc-0aaa-4536-af00-740c3df34865", "comment": "Malware payload", "value": "5cf31cd0c330ff5a99dcf5a13c5462c4f605ff31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765432, "uuid": "dc053495-ec7c-4556-8c10-d2e9d0e80f8f", "comment": "Malware payload", "value": "299c2e7d894263d2036a391876dc7b4da9ca85a9f997eefff430a6d8c26f0a5e68d50a82c58f2e96e91888792106b674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765432, "uuid": "d726d8fe-3f3e-4e40-b512-ff32b2b2cdb4", "value": "EB15BE522EA8AB99F4F95B70BDF0831603FB7D127B23D7D95E8471C92867E808765302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765432, "uuid": "56007d7a-405f-4619-8d22-ef7e7b8f8aa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765432, "uuid": "a08d003b-a395-404a-afe5-22e7ff63eff4", "value": "12288:fpPc90u7XvFmW9fkN++Ni7BuEY75TlXmzMeX9ty+osmMjDxTxLh256pvquwaHpYi:fYo58zMHsmSDxTxhk2quPHpYaac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623765432, "uuid": "43ab7856-1696-4a17-80e8-173d9343e696", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623765432, "uuid": "6b392972-acd8-4076-af46-e9542ea77560", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765432, "uuid": "dbf2510c-9948-4391-b816-e692ae9db2aa", "value": "HSBC payment advice EGHKEB0C01725410-T15.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f72b4c-cdd6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623760631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760631, "uuid": "8c31d81d-dad2-4cc0-a5c0-46d258708326", "comment": "Malware payload", "value": "7d0b55e67b717c017ce11540012013bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760631, "uuid": "cf7953c9-c6ed-42e1-a4ae-1527636ca9f8", "comment": "Malware payload", "value": "ae35fb339d7bd5f4050f9a9a6548089d3ab3ec6ce2048b6d07c12271da96c568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760631, "uuid": "e0a3ff7c-1607-4769-b5e5-452002933449", "comment": "Malware payload", "value": "f34ad86e1b99365cd9c021858e3fb466e47da76d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760631, "uuid": "aeaf8eec-d6cf-4f8d-8087-b069b14cc55c", "comment": "Malware payload", "value": "f5afd4610d443d3a716c843d1a9fe09cb367233d7b576ad2beb348cddbd5d942fd0b64826fa2bb85d5a84f40c93ddcfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760631, "uuid": "36dd7a42-1d5a-4bd9-975a-caa4f74190c3", "value": "EBE4AEE4D298FDEAC129003D84B5A021136BD72FB466DA3B2D9A702D657B34360B7D4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760631, "uuid": "632809f4-fc57-4735-8cbe-0e9734623000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760631, "uuid": "bef8e2ea-deee-4783-868d-a1879f4b84cd", "value": "12288:qdwEtHAXL9VCZ6vSIsi/YF7OX0fXJjqPPOE1W9oPRZfz4eCe6317n3qm/yPPPPPc:jSIs3ZOkfR1LARC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623760631, "uuid": "a90cb79f-e167-4cc9-9639-a88aef898287", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623760631, "uuid": "7fb23d45-fea4-4717-ad24-c4eee46f329c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760631, "uuid": "caba4074-d016-4a38-b13d-12f090cb68eb", "value": "BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c853ebe7-cda2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623738459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738459, "uuid": "ae5c2355-e04d-4541-a26c-c19e31fa03e9", "comment": "Malware payload", "value": "e99fa8dfd754d396d7a55cd287827f51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738459, "uuid": "0103b12c-2511-435d-841a-ddad6412abb5", "comment": "Malware payload", "value": "aee541b0f2bfc27b28e779c7ddbe8a251867157844a5581295e3d9018a30a678", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738459, "uuid": "126869f7-0ff8-45b4-ae80-376f24634c4f", "comment": "Malware payload", "value": "3e69a6428921966fe6709156f3b2ce34638ee62a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738459, "uuid": "8f1bfb0c-6561-4584-9eba-02f56cf4bfa4", "comment": "Malware payload", "value": "c6d8b007c668e44463f74700aa000d0318e926b28aa3513e30e8b0d6a158b27700a4c533717b24fe61cca5d095cd5e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738459, "uuid": "cd4a3b57-4c4e-45ac-a5df-5370ea476147", "value": "A335F0CD6B8CB2B6C5DD39F0447027630965AF2D1FE2CD87768CFB06DE6E181A528285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738459, "uuid": "6b8a0ee1-2d32-40e3-b376-aae45cfb47c2", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738459, "uuid": "134f0943-d44d-46ca-88ee-d721b1934ecf", "value": "24576:q9btxEOV0ZHeOq2F7Sygl3i8A9hCeaN5DmQagb+ak8MQWa1TunrrWHl2f:qNNjm4l3i8JNN5Dmi6B8MQDmrWof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738459, "uuid": "b45a438b-198e-4d30-8b00-79918230a085", "value": 1108526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738459, "uuid": "825efac4-fc05-44a3-b1a9-3d24b6b6a6a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738459, "uuid": "2a4fba56-5706-4198-bc14-8686f38c48be", "value": "e99fa8dfd754d396d7a55cd287827f51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676039d0-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737008, "uuid": "56c70983-2a56-41a2-8190-e5810c16cd6f", "comment": "Malware payload (IcedID)", "value": "4c08e978c1744e7b04ad9e777db73813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737008, "uuid": "70272e7f-233d-4270-93eb-9bfbf61705c8", "comment": "Malware payload (IcedID)", "value": "b00837aa57c598c406ee4ea845c2f039abdb98d6165111bc6a678c275ad17a85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737008, "uuid": "4bdf9b79-5e6d-4219-a5df-1e95171d9fd5", "comment": "Malware payload (IcedID)", "value": "c0b3f0d97485ab6faa9f572550836264990786b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737008, "uuid": "7963ed35-5c7c-440b-9737-6a62b3795b32", "comment": "Malware payload (IcedID)", "value": "9f1c413326846cda08d6db3a5328d474328b5e9ddcfc49889f068f23da47920e1fe8c7f7cc08d4384916351ef8b9fb98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737008, "uuid": "65c256c3-1fd7-4483-975e-58ed6bd74a05", "value": "13B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737008, "uuid": "01b6abe9-77c0-4b8d-97c6-84c6d1555009", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737008, "uuid": "e6c4ae96-b0e4-4d4d-98c8-7bf7d2738e8a", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8H:t082TLrbNGoVMjPR5DxDRoFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737008, "uuid": "68851f7f-19f2-47aa-8ac5-1380e41e26fb", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737008, "uuid": "60a1f6f3-d189-4762-9c14-a49c9df32cfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737008, "uuid": "c3026f5f-fb23-430e-b734-f108b0fdf1e3", "value": "b00837aa57c598c406ee4ea845c2f039abdb98d6165111bc6a678c275ad17a85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0780682-ce07-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623781879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623781879, "uuid": "76bdaa34-4bed-47ba-bd5e-91bb388ea478", "comment": "Malware payload", "value": "414f74c40194aa1ae27bf6c918c7c101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623781879, "uuid": "f0a7b0c9-7bbd-4a77-8727-c8f71aa7e24a", "comment": "Malware payload", "value": "b00f8e5d295b4d74c00373742dc3e601b91a9af1f693bee69bb64886acfabd70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623781879, "uuid": "5fc9ea28-bd7b-4704-a2e1-bc692ee4f5df", "comment": "Malware payload", "value": "398f97339193851b5558b8cfeba6035c3287b579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623781879, "uuid": "6ce3bf19-a7e6-4376-9678-dd4928113a83", "comment": "Malware payload", "value": "26a6026233946c84fb9355168cdcd0f77ca250061276ff5ac2d9220e603e9f2882eb3a4aed9e4a93e1790a2c605bb7e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623781879, "uuid": "4053c914-9d31-4e2b-911d-c17275799a89", "value": "C83549883D6031DED8EBC535BEA81D28EA677C26771B8347901731AD994FD87DF102A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623781879, "uuid": "d13ad2a4-3e47-4c4a-be1b-56f778c02a01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623781879, "uuid": "8eeacb28-7267-43bd-b8c4-176da47a0430", "value": "12288:bLWx4F1Tq0PpdVKiYy2E4523frcB+9V6ZvquwaHpKZTjHEzrKT9FH8boEB/Hirs+:/WyvzPAiSEdAqV+quPHpKZNavA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623781879, "uuid": "d2b51c98-7de5-41e4-992a-7fe916b84f21", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623781879, "uuid": "6cd35228-c104-4168-bcda-dbd4b5e010c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623781879, "uuid": "c13f438b-50bc-4f4d-ade8-352ef836ffe0", "value": "invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be17b4e-ce03-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623779831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779831, "uuid": "ce3f639a-2e49-436e-bc60-1d6a8ad1c5ee", "comment": "Malware payload", "value": "f29a28c7539ea6d801f56269108c94ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779831, "uuid": "646a44e8-95f5-487a-a5e3-36f886d19ac7", "comment": "Malware payload", "value": "b05f0ad3230eb982fc5000d9ed23f9c8257934699fc0952c165a4cdbe14f6cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779831, "uuid": "94de44db-e2a0-4a4c-abbe-03e1818996bd", "comment": "Malware payload", "value": "f75111bf19f7585ddc953aebce25cb938a1a05c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779831, "uuid": "045c605c-f03f-476c-bfcc-d1a4fac3e492", "comment": "Malware payload", "value": "3f097e5824d3ad110529ed4a4cb4f951522bb439c36d8b5648205607ec791709e03e84d43a828cb05c522a8c3f0d9af0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779831, "uuid": "1bc0d8f7-6787-4c1b-bcc6-cd6abdbe8b41", "value": "2515CF212EA42F99F4F84B7ABCE0831203FB7D127B27D3D95D9470C92DA7E808665716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779831, "uuid": "dc88da2c-6f26-4c55-bb28-f4f83c7de458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779831, "uuid": "2d716aa2-2c43-4411-8a26-be54572bf16e", "value": "12288:jC6o0CZesm1jc9wvo8/TBAH3L7MmP17nJrFJuTKxaYCD72Qq/wht6pvquwaHp1a/:D6wQ8/wRByDq47+quPHp1a6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623779831, "uuid": "5e1c1d5b-46c6-4242-9d43-d1c5a68c6ccb", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623779831, "uuid": "34216978-63f4-40a6-82b3-d603036b9394", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779831, "uuid": "67ec6632-88bc-48ce-9a65-8b5382637d47", "value": "#RFQ Price List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61813730-ce04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623780377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780377, "uuid": "0e2edc6d-a966-4e48-baad-317de5609e95", "comment": "Malware payload (Mirai)", "value": "20cb6187c53976df00ac956c2c5f219d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780377, "uuid": "c2791165-8957-4862-9e4a-17c85676dd35", "comment": "Malware payload (Mirai)", "value": "b094c97b8b56815dcc72a0072ae9c955ae5d9f93190f87a77b5132fbb0ab36e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780377, "uuid": "6935bc76-a721-4ede-9e6f-413615db52b5", "comment": "Malware payload (Mirai)", "value": "1d3d12c6386936ce8febe5e3bfc2d0c4b25b1cb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780377, "uuid": "26f03faa-4eab-474a-bd7b-26d17e5d1b53", "comment": "Malware payload (Mirai)", "value": "4babd64944da0fb3a126da543a9ceefe5cc42cc4d93e4b964ea97c99dda964d6971a32b41a50b65645d88681c3e44d60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780377, "uuid": "1de733ba-0dde-4288-97d6-85bdc82370b6", "value": "57D2D021FE512CD5FB8F1E305E8193D2B7B00FE7A3ADEEA3625067421213A224214EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780377, "uuid": "0239ca23-21ad-461b-bd5c-1764331d131f", "value": "768:X3wxfq6vaB0puSVWZHJK3pCFkQSEGHYr4uVcqgw09f:nwD40pvQK3pCFfS1A4u+qgw09f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623780377, "uuid": "a154ef01-9386-4e6e-80e9-3640cccd7e18", "value": 28296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623780377, "uuid": "65fa27d4-9881-4615-bc84-355cab8578e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780377, "uuid": "90a390e9-a5f8-4b9b-8fb5-c50fd0603769", "value": "20cb6187c53976df00ac956c2c5f219d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1899afc2-cdc4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623752767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752767, "uuid": "7fa24a6a-d25c-4085-849a-2850c9a3ca96", "comment": "Malware payload (AgentTesla)", "value": "3f1860134d24215207ff1b8763e0c926", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752767, "uuid": "04bee2c4-3ab2-468f-b892-7f1ea3c5c707", "comment": "Malware payload (AgentTesla)", "value": "b333989ab1f65183873cfc898e5f74b584195e2c0cbf1d15ec57256801813316", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752767, "uuid": "50f8c8b7-81d7-425c-97d4-28b400599dcd", "comment": "Malware payload (AgentTesla)", "value": "83184a365a02f31b09ba82444016d9c11312e22a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752767, "uuid": "0552bca4-3aed-4d5e-9e7b-5879d016accf", "comment": "Malware payload (AgentTesla)", "value": "da081e30d4a29cbbddea01da0c4303335bcc81f9ad681d412904a432fac4bc8d16a06e2e1701a943a78ecb386abb18e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752767, "uuid": "cf595369-52fa-4275-b83d-dfc5ea0c15a7", "value": "ABF43352BE0492F914103D2857DB1F139387A43B29B41C23B9BB709BF5ED17A9264BEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752767, "uuid": "6ad0b3d8-56fc-46fe-ac56-6eff5c2d944b", "value": "12288:S1Kc2+mNFtiTgqg2j90ivwJK1fnFPKerCWraaNTV8uSaNeV9RyiTuEFVIxBmVr1i:pR5Ft09065FPDukHL8dogRyCuiImV5wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752767, "uuid": "c342dbde-5578-429f-a0c7-a36db0ec6692", "value": 766699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752767, "uuid": "5dbb9bf6-c7f3-4bab-9ef7-571fe06b877d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752767, "uuid": "91d855d2-b054-43b1-98bb-92fe59e7a3f1", "value": "b333989ab1f65183873cfc898e5f74b584195e2c0cbf1d15ec57256801813316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d404f4-cdb9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623748392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623748392, "uuid": "1e60e547-0c37-4eb0-8678-bac7301bfd3c", "comment": "Malware payload", "value": "d2b54af257798501949a8bf965a00c81", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623748392, "uuid": "63f71488-bb19-4deb-9a89-f9b205c30db8", "comment": "Malware payload", "value": "b46c4eb48cd15d5ffe37369737da1f596f59b0c975bb1a889261578a7410805a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623748392, "uuid": "d8d7c12a-4b54-4f36-92f2-141846bacda0", "comment": "Malware payload", "value": "8b019ab2b728cc8969e83a756f48f08911bd985d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623748392, "uuid": "c7c2ba11-9145-4400-864c-a7511447ee3f", "comment": "Malware payload", "value": "8d48c99182f1bf345cb445ab49df523d774857b8383e0ca77363eb8b74e7459e96c9bdac7e87975840fc00a518ed7234", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623748392, "uuid": "e441128f-3abd-42fa-b655-5ec3cbce2b0e", "value": "0B963366BDB8883B923627F0FE14F502737EA372473A56CFDC629E0716818A4C175396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623748392, "uuid": "41e1d45c-fb5e-44fe-8cca-322420e4eddc", "value": "196608:p/abd9NWqpkguxe/lXX/GU6i7sP9eiG+dsGoSRPRvMlq89vfEOSRHJ3g8329:p/aBWqpkgiSXPGUV7sW+ds1iRv8q8irG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623748392, "uuid": "3a325a52-0423-45cf-899b-ada4c09d08ed", "value": 8847886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623748392, "uuid": "46c98bc1-6e0c-4987-aa04-6c17eaf20d27", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623748392, "uuid": "f53322ff-ec82-4bf3-a5ce-e4d7755953a3", "value": "d2b54af257798501949a8bf965a00c81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca7005d-ce26-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623794891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623794891, "uuid": "291ebff4-4daf-44d2-b0eb-3d9478fee7fa", "comment": "Malware payload", "value": "2b4cfdf76deb4460999a4ef2b8f6ca7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623794891, "uuid": "263bc161-445c-4835-b9f2-88154229a4fa", "comment": "Malware payload", "value": "b531243b41e28ecd2f739311693af48618ac1b431b21c702b8f60f57ed836fcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623794891, "uuid": "b3218fdf-d704-4860-b8dc-0877cb17e6b0", "comment": "Malware payload", "value": "127272fe7e3c06fd3b401c9b9e3918894ff8442b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623794891, "uuid": "0960c86a-4036-43d9-b603-d86554b08c03", "comment": "Malware payload", "value": "25986b0f510e6c034300fa890ed95558934e90b394c189fb7c4098b104f8072a0c6306ca66e5e5b545bb7a6dd62d4baf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623794891, "uuid": "0c6d21b2-6f31-4895-8f46-8c7dce2e3bfd", "value": "B9263300E6F1C071E6B352BC7935D292D02D79616BB81ADB23C20FE5E6749E0AD713A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623794891, "uuid": "3892467a-478b-4457-8fe1-7ab59a0b196b", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623794891, "uuid": "ab34449b-1d99-4994-b8bc-707e469da9ca", "value": "98304:jeFAPNaCjxvjlGM682qWzS/Wo8ZCyR8c5KchqHtf1HY:jpaixv5GKyY8ZCFsBhqNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623794891, "uuid": "4aeb96f5-3d0c-4230-ba36-3d60f6f450ab", "value": 4706344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623794891, "uuid": "9f81344c-df4f-4768-a610-fd3a9eecbad1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623794891, "uuid": "4a63ce6e-0712-4c38-addb-ef56a22f78b5", "value": "2b4cfdf76deb4460999a4ef2b8f6ca7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1f3918-cd76-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623719648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719648, "uuid": "5f450480-8283-485b-a64b-9f4ae8e2f97b", "comment": "Malware payload (Mirai)", "value": "b79ee1c7cfd886df8935fafc62579604", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719648, "uuid": "c00ac1be-6b54-43fd-93d1-f5bd3ef2f670", "comment": "Malware payload (Mirai)", "value": "b719a36bf6de6916c63dccd7362409b9ca9ce9c7df5ada0465e42a37c6c3f43d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719648, "uuid": "93d2540d-59c2-4967-9dd3-208003f6f2af", "comment": "Malware payload (Mirai)", "value": "ae90357b53590d51f376cb98c91e189b3a277a9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719648, "uuid": "8655bb0c-e127-41c6-809c-941036e4618e", "comment": "Malware payload (Mirai)", "value": "66f9d2b8f07b9ded9f10ad9b752a5a0ed1188b702b2a3eb5293b85cc93cd4e178789a2b52d9159a5ed168025422ef21f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719648, "uuid": "931b0460-87d4-4a76-82d9-f8d54dd19308", "value": "C3631881BC819912C6D423BAFA6E01CE371623E9D2EE321BCD116F5177CA92F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719648, "uuid": "e5429a9e-a193-4475-aa4c-05e928a3584d", "value": "1536:4hXaNZuYopTvIj1vM8qh2fWSrP6Wg+VOyZHu+F:4hXcuYgTvIjYAg+ZPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623719648, "uuid": "89ea677e-5d58-4395-bc3f-32d5517f5679", "value": 71536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623719648, "uuid": "e7cf79ac-30b1-4fe1-8cff-6eb56cc43517", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719648, "uuid": "eb34a2db-cf01-470e-ad7a-46665070cf0a", "value": "b79ee1c7cfd886df8935fafc62579604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d699edac-cda1-11eb-875b-42010a9c0053", "comment": "Malware payload (ZLoader)", "timestamp": 1623738053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738053, "uuid": "d8a35876-ee66-43b4-810c-646c4d65fb49", "comment": "Malware payload (ZLoader)", "value": "4f134d35f7d1afe6c91085f38e27640d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738053, "uuid": "c1df6730-110c-4b47-a064-22fb87394830", "comment": "Malware payload (ZLoader)", "value": "b73bae190d2c8d18cbf00584c496e4f570da582507dbdbacdc8893053e5996ae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738053, "uuid": "d0c0cfaa-e405-4699-b67c-d21e6f6cf34f", "comment": "Malware payload (ZLoader)", "value": "0102f545e6b8acefaff628159cd06697d9c520b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738053, "uuid": "da8366ec-9053-473d-900c-623602de8d14", "comment": "Malware payload (ZLoader)", "value": "6ee96020a06d61b7a29d3d905feb196687646c010ba4e0c5623591751559b21ef0d40a89f3bc7d393a617f6f7daf1404", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738053, "uuid": "9648589c-6477-4b36-9a66-0a5c18b24ff5", "value": "EC64E201971FE099D37E29B8C8F6C3C584D9CE0A29404C5CB3983BF5E67A5C87AB251E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738053, "uuid": "e0e85a52-a024-4966-b9ce-604b17dc792a", "value": "302dc27ee8fb51d51fd455c5c954a121", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738053, "uuid": "ffb341f9-66f9-469e-9f0a-8e3c27eb231e", "value": "3072:FW3jihpPN6334j29ujis6fyMhzEeSOTDAUnDAVnNrRV+BwrLcqfQD4YGpw/pCn:Y3j8pPN6n4j7Ws61E+ABnF/cl0pwwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738053, "uuid": "728a6e80-228e-4ecd-adef-2363bcc45d3e", "value": 313688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738053, "uuid": "45b7f03d-d9fe-4f9b-92d8-7110fd8aee99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738053, "uuid": "f0b4f7e1-ed1c-4223-b493-bc278b10222e", "value": "b73bae190d2c8d18cbf00584c496e4f570da582507dbdbacdc8893053e5996ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cacacb-ce15-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623787634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787634, "uuid": "300b3cf1-6565-4bba-bf91-31489716e3bf", "comment": "Malware payload (Mirai)", "value": "cd6f45c2e3f881f755f58d6e28ffed4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787634, "uuid": "658c8090-6c34-4538-be92-df5de1b55e16", "comment": "Malware payload (Mirai)", "value": "b8007e37160026688b6074a174badee139cd7077e90bd09006cb7c693fd99b2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787634, "uuid": "741dd8c3-f06c-478f-9d07-b93b66b405d9", "comment": "Malware payload (Mirai)", "value": "bc5573dc3f02e2849379de8f2219c64f3bee00ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787634, "uuid": "55ca57a9-741e-4a89-8dc5-e46d4f29097a", "comment": "Malware payload (Mirai)", "value": "13da375239872303b72313441668cc6d0753793934d91ba8ea7008a24b9238ac0b74eb2a1fe294b306b6238b9915faef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787634, "uuid": "e83f9a06-be6a-4ff5-87ef-05ed19dc8e2f", "value": "38B2D0B27015B8B7C7A50077A9D9CB43BB801EF8D0E873295465099DEAD5842BBF1247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787634, "uuid": "8fccaff8-23a1-40e7-beee-9ce394315ff0", "value": "768:5X9nxn8o9wnBoWzEQf2EjKb3pZcs3Uozk:5tn+o9wjfBAZrzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623787634, "uuid": "c4f17f16-87e6-491b-ac62-6d1704a89d99", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623787634, "uuid": "ad7a39c0-9901-4f44-9bb7-42fe7d2603e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787634, "uuid": "49bfddd1-7c9f-46ed-9a0b-4e319575f886", "value": "cd6f45c2e3f881f755f58d6e28ffed4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d526e1c7-ce1b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623790450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623790450, "uuid": "1b3f0422-c7e3-4984-ac65-781cee20a69a", "comment": "Malware payload (Mirai)", "value": "9de9ae0b623dc4093ddf5cb495d692ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623790450, "uuid": "32a258c5-cc71-4d8f-b3c7-5d8024a38fac", "comment": "Malware payload (Mirai)", "value": "b82055b8251a317cbd894ced589b38aaf3137715fb967413a846ba6da24beb29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623790450, "uuid": "f901a9c5-07d5-4a10-b2aa-7e4af9ee0cbf", "comment": "Malware payload (Mirai)", "value": "0def1c2fcfffcc11687501190b0f76e18b14f37e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623790450, "uuid": "a9d54864-4449-4a28-82a6-3cc597cc77c6", "comment": "Malware payload (Mirai)", "value": "301c5cc0fad79c8ecf4e6f86d2d4e7cb32d6e72e8f55a199b272443a1e7759b23a01d4f97aaa885ad3f2616eae5f2da0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623790450, "uuid": "a14cafe1-308c-43eb-93f8-31d191bb173c", "value": "B8E23CA97D808B16C5D1627BFA2E428D37151398E2DF3303DE136F61768B81F0E6BA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623790450, "uuid": "4791a841-9e63-4761-b37d-bdae8f142cf5", "value": "768:3/h5f9YxAZGDTruS4wkDyPyU2KXKGgaEzMLBrA90tSe2P1:7f9bSTruS1k+Z2axrBqaSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623790450, "uuid": "88641648-a566-45f1-be76-9e49960b81a8", "value": 33940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623790450, "uuid": "3e9ed401-7bf9-4f07-a52f-3fa6758f57dd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623790450, "uuid": "4e62efe3-615c-4e7d-95eb-22e995fb6751", "value": "9de9ae0b623dc4093ddf5cb495d692ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a28122-cdd8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623761350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761350, "uuid": "c1806ece-ee33-4c4d-a662-1deca2c24160", "comment": "Malware payload (AgentTesla)", "value": "e329a710a8f4158e645786e437abb5a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761350, "uuid": "b7d70ee1-59f7-4088-96ee-18cbbc33e3e1", "comment": "Malware payload (AgentTesla)", "value": "b8c5e6876af13865c8c3698ced08acd5b3696c00e3217dc479d8b4d5c88356a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761350, "uuid": "d9d94915-ced3-4215-8b91-6000a1d3526c", "comment": "Malware payload (AgentTesla)", "value": "df427a106e822213a401334b1f2b8951d07e0020", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761350, "uuid": "50bfd522-c387-478a-ab14-d791712ff3ec", "comment": "Malware payload (AgentTesla)", "value": "1876a9496012faf6751291d2cf11ae016b6d4b06d497b065bfbb7ddaa54e37be39705e6519e756d113a245856200c31f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761350, "uuid": "1d06d288-ae54-47ed-82e4-41e9314d871d", "value": "EB356A8C7555EF9EF4778B3184549C10E217ACAF9227820BA313B67F6A7E3D38E141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761350, "uuid": "0c177e37-5e58-4248-928e-f8cefcc9da11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761350, "uuid": "fc807a63-5233-4d83-bb6a-fee7cc331e34", "value": "12288:203RnxU9VCZ6vKc9Ux+yDIFlYkmL3DAZhAE7YeNSH/ObhHcpsuPMdHLyoSQVSP/8:nBnxYKc96dEY/rD+ZYe8/4EIFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761350, "uuid": "486e2cd7-6a62-438d-8e0b-0dc31f6b5faf", "value": 1079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761350, "uuid": "e73d6d18-81a4-4206-8a3b-c2642467ebad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761350, "uuid": "276b1a4b-c984-4ff8-8e92-0f4d4c988e93", "value": "ITEMS NEEDED URGENTLY pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cbe352-cdfc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623777088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777088, "uuid": "8d8b0cb5-3d4d-4e84-9294-ac7005bad28d", "comment": "Malware payload", "value": "f3852fcff10b37f639e2c63bd70ba32f", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777088, "uuid": "0057057e-4a2f-4cd0-83da-6a2761731035", "comment": "Malware payload", "value": "b8e74adf71b07d71b9139f5868d2450db293ae79ab226ed87095b366bd0ee02e", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777088, "uuid": "98703581-163d-4daf-a755-0fe8b9b04f02", "comment": "Malware payload", "value": "8adfd7471d95891a96e3aa018fd4918fb72a09d4", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777088, "uuid": "11d9abe9-9ebc-4c1e-9794-76e1d2ea5709", "comment": "Malware payload", "value": "6ef04b7432864299e3c1b5c2a418645fd24264f16db10ec54b9f58b8acf8529080a4fb7ae673f6ef8d84c3eafe00df1d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777088, "uuid": "6e6f3696-d2d8-4723-81da-41a6f52222cf", "value": "6634CF44A8A719EBC01179F19775098A4FC8ADF5A394890B0F0993D8E192B3FD763F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777088, "uuid": "3685dccd-bab3-4c20-8d8c-93de368b18a6", "value": "6144:D13iV3Vrdps8XdcQ64vqQHuHHuBfAclbZjX9c:5EQQ64o21tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623777088, "uuid": "d8ab16b4-7a32-4252-9e71-e8e715baab18", "value": 232186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623777088, "uuid": "1bd92b9c-01be-42f7-a9d7-b8d17bdc6e49", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777088, "uuid": "b6955597-7419-4af8-b247-8dfb10672124", "value": "file_55743.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f965fab-cda6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623739894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739894, "uuid": "a6df5de4-b052-4f18-af4f-e680f3c16d16", "comment": "Malware payload (Formbook)", "value": "2cb81b073019a04a475626ad28126660", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739894, "uuid": "d8bd3c72-25f6-4aa1-a26d-8013577c4e0a", "comment": "Malware payload (Formbook)", "value": "b8ede92590d43efb1edb31a19e4c28dc4fe4ecaf52be4bdd4ceae0a6caf26368", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739894, "uuid": "e6be8584-ca2d-4997-990a-cbc6fb0f115b", "comment": "Malware payload (Formbook)", "value": "de57413e7b4c0cae15131fa74b5575e1d9ba7e59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739894, "uuid": "9df40854-7b10-4d23-bbcd-23e533b9678a", "comment": "Malware payload (Formbook)", "value": "83a5a10f6cf9378690f0d1052cd36ec98a5e26cee358ae7a17b52f66c6560fbea1a0f820e25819ec87eafd5c813d65f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739894, "uuid": "f69bc5e2-f262-4d74-8367-3f3085f67055", "value": "F115AD9C9159DFA4F07B1B380554C214A26BDCAF9531DA0EABA1FB7F2B373C38119261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739894, "uuid": "7e4759b7-00ad-4996-967f-b67ca37ee6da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739894, "uuid": "7bb1a997-42a0-4cff-a0db-55c42ebb2269", "value": "24576:Bu5kG1mj63drfp4fRAmiisnGKBqZzvj8bITWy:K1mj6tj6AlRBqlMIT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739894, "uuid": "e3c76fbe-d5a7-4c53-8e61-d6971a89cb2f", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739894, "uuid": "d6b840fa-4894-41c9-a389-1135fa683a9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739894, "uuid": "b108ab4b-ca02-4455-b0b3-21b23a69191a", "value": "2cb81b073019a04a475626ad28126660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adaf0cf8-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623736267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736267, "uuid": "53f05a8d-a98e-4559-b65e-69e40eb97e86", "comment": "Malware payload (SnakeKeylogger)", "value": "2d4f29803efa9c5ded4b030fa60700d7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736267, "uuid": "1da98cb1-91bf-4b92-89d1-217b716633bf", "comment": "Malware payload (SnakeKeylogger)", "value": "b966dd660d1ccd9e444efaf911368a8da44058869bdf60bbb96ae758b9867030", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736267, "uuid": "c7868bb3-353c-4768-991f-615f0e009db1", "comment": "Malware payload (SnakeKeylogger)", "value": "20bd68cc3ae5ba929ab857a165c5d41eb52bf7c5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736267, "uuid": "603c04b0-89a6-45c5-bab3-85319e470a9a", "comment": "Malware payload (SnakeKeylogger)", "value": "9e83e3d92e84a7f9d43cf4da28d443b41eab055e2a9095470c722407ae29f88d5f78ac3f0aa214e22ff185c4d36d101c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736267, "uuid": "cd95b5ca-5dbc-4a19-9c5f-97e8dc769c70", "value": "12741242B2A0FA17D95BA235488BDBC23367ED463B4A834FA1047F5D7FB6F110942B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736267, "uuid": "704683b2-fb24-43ab-a411-e6e23e870c3b", "value": "6144:6lhk5CDUJUMEUEl+8myYXxKiKz0jpQ+Wb4+2qREMmIEM1cNbeomCsJqP:6lhcQMEUElwvXxKDe2YqREMm1vRm3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736267, "uuid": "44a0891b-2097-4b15-ab52-4cc92cce310c", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736267, "uuid": "d9347f01-bd20-4340-a8ab-2a0327277dc9", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736267, "uuid": "12817af5-73a4-49c8-af96-f76227634b29", "value": "IMG_077010168.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f1b17b-ce05-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623780676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780676, "uuid": "386ef178-2995-40e3-8914-b5e7ba8c7e91", "comment": "Malware payload (RedLineStealer)", "value": "93104c5a4e4bf91b898e874e461262f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780676, "uuid": "45d5321b-65df-465e-bf5e-91512ab4ca28", "comment": "Malware payload (RedLineStealer)", "value": "b968ab7d248818d7b487f45bb33982861f83f667c0ad165c9a906e330b33b027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780676, "uuid": "3db00557-ba82-48af-a29c-7579811d6600", "comment": "Malware payload (RedLineStealer)", "value": "8bd00218858c03035781191222ec0e80c53e4689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780676, "uuid": "3c205a1c-797f-4a88-ba06-f79f5ac75f60", "comment": "Malware payload (RedLineStealer)", "value": "dc011107a1711142c6e211b24d78e66a86ff012ff6c5670b724f5f8d3fe00d0f6fd0b4e45a6956cf330676f0fd95abb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780676, "uuid": "82cfb458-e67c-4317-afce-ebf32fdfa1e3", "value": "1DA533E3EB5647C2FDF9983A7213C81B29066E5F5212A2C5A20C70BF6F3764B140D697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780676, "uuid": "caf6e565-58de-4d86-9f22-cc02a39459ff", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780676, "uuid": "bb32d534-d9b0-4f0c-b4e7-471b68c0f2ef", "value": "49152:xk2skLIhdmCSEK1fSsXPJBD2ylSsMmDkKQ+XBMe5Cl8:CM9TEK1as1MmDJZ17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623780676, "uuid": "64ea0586-0e9e-4471-adeb-4ae5ccec8d17", "value": 2146176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623780676, "uuid": "9763b8ae-253f-480f-92cd-1a2830b869ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780676, "uuid": "fee36648-59f3-4883-a506-5ce49a74e9d7", "value": "93104C5A4E4BF91B898E874E461262F8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6fe38f-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737013, "uuid": "9a9bc1d1-e58f-4d14-bf05-017879e3f1e1", "comment": "Malware payload (IcedID)", "value": "50fa02db05ce77b4eab257f07bd2f41f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737013, "uuid": "14f7ce06-1053-4f58-bd12-d1d94408a485", "comment": "Malware payload (IcedID)", "value": "b988676bb4e18d5c135b11751fe3b41f0efc045483d1ed3e6f9c4e41e5202b17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737013, "uuid": "c9251876-0079-4acb-b233-9a2f02d88d22", "comment": "Malware payload (IcedID)", "value": "cd33a5bedeb3634807acefa2233da13833648771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737013, "uuid": "7a1438d7-bc26-49b6-b300-5acc7b974e2e", "comment": "Malware payload (IcedID)", "value": "1e4bd0676704f7a27e80b9b0553ae9269be57777c19f424d4286580d71446f10b0c4fc624b8244f52f25144a136cab35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737013, "uuid": "3b0bc3c7-e79a-45bd-aef0-f9422bb5e62f", "value": "A1B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737013, "uuid": "b47eb40b-9582-477d-9f02-d0f41aba4912", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737013, "uuid": "d2d968c2-a31a-4251-b0aa-1db0081835a6", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8H:t082TLrbNGoVMjPR5DxDRoFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737013, "uuid": "11434958-3cbb-49ca-9c68-a18364459ece", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737013, "uuid": "ca02a77d-9757-4240-9437-142732c09875", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737013, "uuid": "a6cb8c4c-59e2-4dc1-aabe-18f4adbff07e", "value": "b988676bb4e18d5c135b11751fe3b41f0efc045483d1ed3e6f9c4e41e5202b17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6effea0c-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737021, "uuid": "66bbd7f9-68f7-4b73-a50d-a957c1df683d", "comment": "Malware payload (IcedID)", "value": "e6bea72a444de313e717995fe006e587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737021, "uuid": "582f0201-d2f4-4a4e-a85c-8f3d7e4add3b", "comment": "Malware payload (IcedID)", "value": "ba21ad2937e962a639d38274057173a86fae4809aa597a028e4c6cf090b5c519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737021, "uuid": "fb8ac7d1-46c2-4e9c-9f68-ee33a3bd04db", "comment": "Malware payload (IcedID)", "value": "99fb21060d11863b577192fc214307e954883c5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737021, "uuid": "f5a9939b-1e1b-412f-86b6-6b63a442ae5a", "comment": "Malware payload (IcedID)", "value": "f293748fa9fe8ab609f411944c8a3c67a57433e474265c8a6252f73b56746218848582680d9dd56d74c7974b6375e0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737021, "uuid": "67be8139-4853-4278-a9ba-93a436d6def0", "value": "86B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737021, "uuid": "489d6fa1-d710-4554-869e-016bbf9f5397", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737021, "uuid": "4186835b-4068-4242-a08d-fda46638e47f", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8v:t082TLrbNGoVMjPR5DxDRoFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737021, "uuid": "fb2a7c92-c943-4442-b965-7ed9dd6bc65d", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737021, "uuid": "8fa30f9a-93c0-4046-b664-abda935af187", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737021, "uuid": "27a9ce3b-5dc7-457c-a709-b7bce41314c0", "value": "ba21ad2937e962a639d38274057173a86fae4809aa597a028e4c6cf090b5c519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe96744-ce15-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623787595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787595, "uuid": "b4ce423d-dbf9-4799-a847-fbba643af328", "comment": "Malware payload (Mirai)", "value": "6f15cdc9d2feda4f29b706ebd47b2336", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787595, "uuid": "d25b86a9-1c81-40cf-b6d4-fad0a278bc8a", "comment": "Malware payload (Mirai)", "value": "bb3c220672d680e82993f3d702103826c1c69dcc0beaf3520f0204f420055667", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787595, "uuid": "3e1cc2a2-4c3b-4f08-bdde-aa040543db00", "comment": "Malware payload (Mirai)", "value": "bca51980607ef8381b18d0ab4a01e378b0934674", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787595, "uuid": "8c72cbc3-6377-4302-9def-044be7ef5763", "comment": "Malware payload (Mirai)", "value": "3f2c8d8c17ca871776e97011154df3ccbf345ed7821625bbc26470a2c874f675af1d281423aef9402d35191c0d0f1df2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787595, "uuid": "7218f4d9-cedb-4d96-a5c0-7aa4742b55fd", "value": "39C2E198174919E9D2F9C17D47B80B6D1CB40BAAF809DC8578F8F7629D8E4B43023ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787595, "uuid": "96f3df71-e9e8-481a-8dfb-d4cd282c53bb", "value": "768:f2G214DFyosXqgvV9o1ndB08RfJgGlzDpbuR1Ju:f2GdDgosaaO1ndDdVJuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623787595, "uuid": "73f0dc14-f1c0-47a9-9fa1-ffe7e96939fb", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623787595, "uuid": "cc5849ce-1799-422b-8ae5-349019581e17", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787595, "uuid": "b48ed5a2-0034-4a4f-8292-a37d90e1a149", "value": "6f15cdc9d2feda4f29b706ebd47b2336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de8a353-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623769097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769097, "uuid": "3d0c60ef-5787-4436-813a-481fd2abaf76", "comment": "Malware payload (AgentTesla)", "value": "278a00d2f6e2ead4a4c08c2e8a378cd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769097, "uuid": "3599c5f4-4d51-44be-85f1-125109cb18aa", "comment": "Malware payload (AgentTesla)", "value": "bb58158f786508fb0336f338b4c9a50a44831a8806ae14fa934a9277397e7c4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769097, "uuid": "d422a8d4-1806-4d11-bd8b-dc8bb1c592ca", "comment": "Malware payload (AgentTesla)", "value": "a8bda32621e409b72525632f5671b96e4986b7f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769097, "uuid": "a5117d72-d463-43f0-b9b3-ad80e7d06303", "comment": "Malware payload (AgentTesla)", "value": "ea25318f88498878c00eb92f2520f721702f9ec4fd2da9d4e0d8aa9b589d68fe6babb9dbaa61cfc9fa8ef20a92b63bc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769097, "uuid": "4eeef794-4817-469d-bee5-cea341e0f71b", "value": "D9D4235BDC496167F33C6A1D746592E16F24B0CAC108DB7E98F10BB62BA36ED3C0B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769097, "uuid": "895d0a33-b657-4ea4-8370-fa5193a307ea", "value": "12288:Ugvy61UL9hQmFfurHC88gDJJ+J+2HSNp/OBzyj8+o46pMfyKZW1f3+kXg:UN61UL9hQMfgprJJ+J+2H6OBzyjIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769097, "uuid": "01374858-9e2b-4ff6-945c-553e9c339ae0", "value": 647278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769097, "uuid": "aacf36fc-5a9a-4671-9ef8-d40f806d5204", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769097, "uuid": "9e17b889-10aa-4008-a79c-dacbdefe10c2", "value": "AWB # 176-25046976.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3629e30-cd98-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623734183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623734183, "uuid": "887ad106-c5ea-412a-9117-3879da223ef9", "comment": "Malware payload (Loki)", "value": "ac18a8b023813bcf6b9c3f8f932d60d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623734183, "uuid": "ebab14eb-9777-4c04-bea7-5f274052d08c", "comment": "Malware payload (Loki)", "value": "bc0e4d752580a45adc132bafa84fafea4c9e517b6af4450a57724c294a6f79bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623734183, "uuid": "dc2b05b5-6b5e-4908-a0cc-d220c6b67e3a", "comment": "Malware payload (Loki)", "value": "19ff602361d06a43d25ee69ee30530fd2ee2ef64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623734183, "uuid": "c6545bda-81e8-434f-b76d-129fd0ffc4f9", "comment": "Malware payload (Loki)", "value": "e7e5ee911c1f0af69bd9d036b8922cfa6f913b086e81081ae2260b0e33b9ab1d0b9cb423f9330c4d4edf12e037640dc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623734183, "uuid": "cf6c225d-6630-441e-a5b8-4611b48df981", "value": "7EF3029A31C044A7D6B30A315BA74BABD3BBEF616671026B13643FB92C312E755133D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623734183, "uuid": "e5251469-3bf3-4347-82c0-90d0b78b2560", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623734183, "uuid": "25b5aa12-3867-49b9-874f-f6efb4b158ab", "value": "3072:mLk395hYXJzBZM5MIjLXnoS9pbdc3NrteWPXBOvhzsliUdai3/kpGa/ONNgUwCkl:mQqx0WI3oS8NnJWholHR3zGOfgQXMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623734183, "uuid": "7bfe5af1-3c09-401b-b1ae-910452a3fd50", "value": 168665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623734183, "uuid": "ef38be23-93c0-45c0-ae0a-8069235a1050", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623734183, "uuid": "edc38d01-b4a4-4f61-a9f7-12f0f425a2fa", "value": "\u00c1raj\u00e1nlat k\u00e9r\u00e9se 15\u00b706\u00b72021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07ba8fa-cdd7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623761236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761236, "uuid": "76241b3a-58b4-42d1-b4de-7381f47bba5e", "comment": "Malware payload (SnakeKeylogger)", "value": "869d39027969ff70cb9c56362de9fd8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761236, "uuid": "f9818b45-2933-4ad0-b4fe-d199fe91341a", "comment": "Malware payload (SnakeKeylogger)", "value": "bdbba0c991f70ccddad27da903e5e689a6e762ac23ab78ffea10f389f55045c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761236, "uuid": "c6fdccae-838b-44ca-a774-7567a1eedde2", "comment": "Malware payload (SnakeKeylogger)", "value": "cebd9952ca78ca1db1bc4c193b5179d2100599f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761236, "uuid": "bf465e34-4a2a-4331-9151-25a17ec0fd09", "comment": "Malware payload (SnakeKeylogger)", "value": "da798e92507215416e2aefdef71ded63035c8d8b11a60f11fd139c226af4c0e522bc7f5485046594d54954b9606d16a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761236, "uuid": "b4956302-2f91-4c0b-90df-1e9dc990e9e0", "value": "67B4B03FADB4DC57DB15CAF11D320EE1A7AA242065663FC7B349C9491DDCDB022A8B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761236, "uuid": "d250ee0b-3d7e-427e-9465-bfa8ee6144e3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761236, "uuid": "87cee68f-8454-4d31-bd88-c22b21e34cdc", "value": "6144:fQqJVkkCiYo6Eg/0LL4ZHVYJtdTaWRV2RBpGGjI2FP2wcJyTtJkwpCGOc//tQjht:bp6EeFaV9D2RBEGk2kMJ9tOUFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761236, "uuid": "28b5b994-c850-416b-92a5-61a78c5cc2ed", "value": 494687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761236, "uuid": "66a04fe1-6ab1-42ab-a4ed-6ea9a6b2e83c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761236, "uuid": "eb31e405-ee38-4c37-ac48-3e7e349666ca", "value": "Swift copy for USD54394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2946586-cdfb-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623776755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623776755, "uuid": "bf8b6251-0df6-459a-9039-ce35dace6779", "comment": "Malware payload (RedLineStealer)", "value": "42623c770f85863d40794b36717c6f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623776755, "uuid": "57790e34-791a-4c7c-8cd8-0824b82fd0e6", "comment": "Malware payload (RedLineStealer)", "value": "bfd0e6229b78543c051d95681df359263ce2bac145ba2b8a9bff59acc701d311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623776755, "uuid": "7019e325-2faa-41bf-b724-b0d475acd3cb", "comment": "Malware payload (RedLineStealer)", "value": "e8eca8efefb4b775110aac951c3b6f13c9ef4308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623776755, "uuid": "32b29c7c-3bb9-438e-b096-c41d03497ae5", "comment": "Malware payload (RedLineStealer)", "value": "d0108987c52b8564ca40abd6132400ac3d8296caf2546ed01cf1fc8b145604f5173d0f39731bd756b9d900ac6703a8d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623776755, "uuid": "d66f3142-6e8b-4193-bd2a-6a7aa1b87778", "value": "2284AE11E790C038F5F322F45A7A92B9E92D3AB1673890CF52E527EA56346E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623776755, "uuid": "be706c0c-c6e9-4a60-9c2d-2e9e13db9e35", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623776755, "uuid": "fcf8861e-3318-4b44-87ef-dfd5a9b9b15a", "value": "6144:xQbkL3USjObKqXHjBqSxUIx1r2W8Aj+LZUWt/gD23siXp:xQbkL3DObZDBqKx1apQ+j/2msi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623776755, "uuid": "566e7d73-772d-4b2f-9610-8eed943a0473", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623776755, "uuid": "6316f538-61ad-45ed-927c-6ea5fde5e7e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623776755, "uuid": "61cdff3b-2da8-4f11-9823-ff24f0e24111", "value": "42623c770f85863d40794b36717c6f12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea38993-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737047, "uuid": "1b14f281-6b45-413e-b39b-916f79fc33e4", "comment": "Malware payload (IcedID)", "value": "583be8ffd85d7a5281d0a31d2ea2c6bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737047, "uuid": "56c3c0f0-3a13-49a2-9479-8e0e2275ef77", "comment": "Malware payload (IcedID)", "value": "c029db212be302dac92ef37f662f8ffcaaee9a8ba19addb87e42130f9c136eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737047, "uuid": "f1f7bb11-7d6f-4ea8-9983-673c429736eb", "comment": "Malware payload (IcedID)", "value": "5f26825fce553ba2df26b7cf0ede313af8811803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737047, "uuid": "edfb453b-0c9b-4cc1-86cc-a06a4b3ab193", "comment": "Malware payload (IcedID)", "value": "5ab7c73e72afef7b1b7c1eb66e982399a8ce9906372099338242be5d2fc52aa515a696675ed22eb9a64eb05f07c405b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737047, "uuid": "3af85671-5a29-481e-8968-fc24bf8be830", "value": "59B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737047, "uuid": "e2eb8a28-6f73-4317-9077-2c9086ba0f1d", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737047, "uuid": "9ed92e92-4549-4915-aa96-6e2d6896a609", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8v:t082TLrbNGoVMjPR5DxDRoFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737047, "uuid": "661fbe5b-3373-4520-b49d-8f1afc856d3a", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737047, "uuid": "e58851df-ad8f-452f-8b4d-b0013385ef17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737047, "uuid": "11efeff9-fa24-43ba-928e-30dfc220c0d8", "value": "c029db212be302dac92ef37f662f8ffcaaee9a8ba19addb87e42130f9c136eda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac4381b-cddc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623763213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763213, "uuid": "aeb6b13f-0f8b-42c9-88a0-bab3854e8ad3", "comment": "Malware payload (RedLineStealer)", "value": "daac3222c71040d82ce98085a090e090", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763213, "uuid": "b110336a-e73c-405b-b693-8b2da09d06ff", "comment": "Malware payload (RedLineStealer)", "value": "c063fe61f676c3dd4c1eb19928cd99da43f808b6d8fddc2dfce74250a4afea94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763213, "uuid": "013324ed-131e-4159-8dc8-7a6d9ba64fb8", "comment": "Malware payload (RedLineStealer)", "value": "b2e4d6d667fa12f31b733282e587f43ad8015636", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763213, "uuid": "53fca4ab-6c39-4d5f-8d8f-4d8d15227977", "comment": "Malware payload (RedLineStealer)", "value": "0daa75dcfcb08983d74158d8bab22ce3f8b93fb03cf4c40c9aafffe891285f636f5f7d71d772a2e4f1073a6c01aa2a49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763213, "uuid": "3f0ce3cb-33de-40b9-a261-e783ad560dab", "value": "D294D94A3AD5FE05C3AC667180DB062C8374EDC6A972F316BEB463B80B5337259752C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763213, "uuid": "51327836-0f7c-43ca-99ee-dddd9181d49a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763213, "uuid": "c576eb5c-e290-4d98-8396-67d1c8fed940", "value": "6144:sZhjKA6KcP2sda+Q+6/J7zjzM0nux6vi6b6lsldKUwuSJ:smndaF+S7zM0nux6vi6b6wd6uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623763213, "uuid": "04aebf17-4a8f-496e-a5af-ac0ca4820029", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623763213, "uuid": "69f336f1-3f5b-4aeb-ae29-47facd4d9772", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763213, "uuid": "b2011abd-f7b3-4a62-9aaf-539c8fff03a6", "value": "daac3222c71040d82ce98085a090e090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c184d3d-cd78-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623720131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720131, "uuid": "95b38834-5df5-49b0-98e0-339423e2a85b", "comment": "Malware payload (Mirai)", "value": "002a38b2260b0582ac3df5e8c793050b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720131, "uuid": "b75914fb-2427-44c3-adee-3b2363665b6f", "comment": "Malware payload (Mirai)", "value": "c1b61bd3cf3394d5d1eae8f41c02def479badfb2650436c535f11a66aa53ad13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720131, "uuid": "f3736811-4830-422a-953e-8414f3853095", "comment": "Malware payload (Mirai)", "value": "c2c492dd2249448910a7e4bc8ea99fd27fc1649a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623720131, "uuid": "dfd9f208-186d-4d77-a063-5fec24cf9948", "comment": "Malware payload (Mirai)", "value": "fd43f7ce01cd92df96301bb6e894ce3ab04b5558080bda8804f0aa4943f142f587f5f307575fbfe95bdff75ea99b5cfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720131, "uuid": "a1854dc3-a6c1-41c2-a420-b3a5393dcd37", "value": "E5635A21A8792F17D4E0A4BB21F78768F2F52B4E25A8C60D7E720E4EFF1195056076F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720131, "uuid": "85226af0-8a51-498c-99be-d49cb6c98c64", "value": "1536:JlDyDF/4sSgQ0yi7kWcxljiFjPftfq8DczuEdCb:W/4J2EWfqMcCEdCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623720131, "uuid": "c314e77b-187b-4740-ab39-3e502d977a09", "value": 72244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623720131, "uuid": "4c7f4c33-c259-4f46-b659-4d4ac26cee0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623720131, "uuid": "2a2fd205-96f7-42cf-99e2-a17166381ad2", "value": "002a38b2260b0582ac3df5e8c793050b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e0ae94-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737027, "uuid": "c8272854-58de-4bb2-86a2-999f05d2d24b", "comment": "Malware payload (IcedID)", "value": "0863ad88e87e8a9b0ba7a597cd5ce6ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737027, "uuid": "7dd7a8b1-671a-4c67-bdea-534547080051", "comment": "Malware payload (IcedID)", "value": "c2acd72531eb73b03466806817c694555d5da6e49ba5e5b5ed7c4ed90a9f43cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737027, "uuid": "1ec81750-ab05-4756-97d2-333f11c3876a", "comment": "Malware payload (IcedID)", "value": "fd4e477075c7251b9f1f403b59b7377080cb52b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737027, "uuid": "1a3da4a6-a1f7-47f1-b860-406d4a45112e", "comment": "Malware payload (IcedID)", "value": "232ca385392e5c18c0841f5b216523b94ff2b686b0e9e51b76bf578f493bbb4bfd596db3be6b0cd638f6cc9698b82fd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737027, "uuid": "22a7b641-e8f8-4972-a059-23588aa50bd4", "value": "A6B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737027, "uuid": "5255d16d-4465-422f-95cc-f71d32b5f2cd", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737027, "uuid": "7b1846ed-3575-49f3-9ed8-295871fa2694", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8h:t082TLrbNGoVMjPR5DxDRoFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737027, "uuid": "3a644e8f-8065-4502-b0f9-7369625c7cbd", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737027, "uuid": "c700fd17-f6f0-4fd2-8b06-ff41ea27aec1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737027, "uuid": "a6b4fa1a-3e8e-42ed-9dba-5ef9a126b6ab", "value": "c2acd72531eb73b03466806817c694555d5da6e49ba5e5b5ed7c4ed90a9f43cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d6722b-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737034, "uuid": "703f0d6f-a84f-41f8-8931-39b468944b1a", "comment": "Malware payload (IcedID)", "value": "2a84741f397eb3964ad1060e67ce6778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737034, "uuid": "d136bd72-a246-4f82-acef-61151ffb3785", "comment": "Malware payload (IcedID)", "value": "c2fafb365302b444cce95270a2adac57659df9168cea0f62021c55c58d355420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737034, "uuid": "705a4071-eec8-485b-b378-dd1707c19e65", "comment": "Malware payload (IcedID)", "value": "51bea4dd06275c9e93493ad7b918dc726ddb8f0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737034, "uuid": "a4a1eec5-470b-4119-9d40-e524cdccf2c1", "comment": "Malware payload (IcedID)", "value": "0d08aa29571c720b1026e2611e880fb8791dfbb4948252978b29a3fc86ef2bf047b0b120eaf04ec06c857944bf61fc24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737034, "uuid": "0879cd1a-0daf-438d-b7c1-f4095ca5b9e7", "value": "FCB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737034, "uuid": "f0a7bb15-f82d-4cef-a55b-8b6b6ecaad9b", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737034, "uuid": "12880a18-a7a7-4828-84ef-e7061ad8dd10", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8J:t082TLrbNGoVMjPR5DxDRoFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737034, "uuid": "f6ca9ec4-d06a-4927-9531-4257fbfd4d1e", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737034, "uuid": "9c17db23-00e3-4967-a658-c8107a26c45a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737034, "uuid": "497e8dce-c797-462a-8ccc-f5cf54494462", "value": "c2fafb365302b444cce95270a2adac57659df9168cea0f62021c55c58d355420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc5e87e-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623769422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769422, "uuid": "b11531ba-b92f-4233-a13d-4ffb0e57f00c", "comment": "Malware payload", "value": "a5c9364185cbe6b3e34656369c6a933c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769422, "uuid": "f2fe1803-5f90-4b5a-a0e1-8abd12e7d79e", "comment": "Malware payload", "value": "c37b2677e45176f9801e6e6a82cd1078211d2f002047f78ac17a273acd95405a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769422, "uuid": "1c33d04c-4078-4fa6-916d-62d2e78c5f9e", "comment": "Malware payload", "value": "8e5d000f84ca66ecb4adaf36edf5dae0271187c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769422, "uuid": "b1c2803f-8d87-40c9-bfb4-a71c6fecf0b0", "comment": "Malware payload", "value": "51669d2033e2bbde42a94feb11e91dd0af2602dac240cc53f0e9a280b573294a4aec2c4ab26dff12563f9aa79355940e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769422, "uuid": "708451f7-4c05-44f2-befd-23f4ba29d355", "value": "40C42315C1CDD1795275539727D6B80360C429CCBE483AB2AC87BE3987EE4E3AE60B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769422, "uuid": "ed5fc2f4-6964-4509-a8cc-f5bd1c01cbc1", "value": "6144:uXDUIAc0PFmPkun3Ojh1XnOXVj3gaAQJCNvYnAzU2PzWrVdS/chtpz0BvlM3VLuc:WS/FmWh13ON3lgNAnc4Vd1xECY1YURS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769422, "uuid": "24dea734-277e-46c5-8105-cae36d4057a6", "value": 545788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769422, "uuid": "08d41013-f93d-4d2f-b41c-3ce0e51230ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769422, "uuid": "c27a32f2-51b0-463b-9592-50c27ddf9932", "value": "P.O.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbacb65-cde5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623767164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767164, "uuid": "ddd0d0d9-4326-4cf2-8e6b-f0bfdffc440b", "comment": "Malware payload", "value": "ecaf94586cc2e0d242891be40ed01a6a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767164, "uuid": "007343ec-f214-479b-8b10-7606cb34b320", "comment": "Malware payload", "value": "c3cd06f1cd923b81f43c690507d9bd1e36b62ea74941008daf4d16526ff0b8a9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767164, "uuid": "1991d325-d37b-4aa7-ac20-342de1427c54", "comment": "Malware payload", "value": "e8322c3166e52462c9009f725326ec4cfa972ced", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623767164, "uuid": "6334a7b6-817b-4bb6-a996-0b87dd058e2e", "comment": "Malware payload", "value": "06996f1b0ee2147ddf9cbca35444149e2042fdf489e53470beec787f61f6e0a33393174500c903c4f2729461493f325a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767164, "uuid": "8b63e23e-aba7-44c2-a023-4a7f7df428d6", "value": "CE152384FED86E9ECB6A817C404BDE4EA45DFF8E8B82907F879574431239B3F8591148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767164, "uuid": "c6d1834a-31e7-4ad4-bb14-e2e7af80bc2f", "value": "24576:LalYZyC422YGnqL4Hh2Wlu6SWa0pzexZ6:fZKjFPT9pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623767164, "uuid": "2c2384a7-a5ea-43da-a9bd-acc85f89a716", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623767164, "uuid": "c3b85d0a-3928-4127-afc7-8bb1a84995df", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623767164, "uuid": "3b73b5a7-a82f-4865-860d-68511536124c", "value": "info.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24b3463-cdda-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623762581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762581, "uuid": "5cc37696-7022-4523-9792-9e0176d3d201", "comment": "Malware payload (Loki)", "value": "f3a586c36e48e9ed13b496837f2d848c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762581, "uuid": "e5ca6ba9-55d3-4a1f-8615-cf0c7e76c387", "comment": "Malware payload (Loki)", "value": "c6814de11de23dfe3c6ff1bd8bda596128e39b83a3c4692cfce7daed13ac5b65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762581, "uuid": "cfb3bd11-840e-424b-b0b3-5a66f5c43bda", "comment": "Malware payload (Loki)", "value": "0da732534d2d2cd90dbb2158ee270d253a48a11e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762581, "uuid": "08607254-c708-4bed-949d-8801c8fa590b", "comment": "Malware payload (Loki)", "value": "8c0a72728b6aece2650dfd2020f64672d608dffaf34b1681b1695f9635187467e89448e110ed46f33577403ecd766f89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762581, "uuid": "820fe1f1-b2ff-406f-beaf-defb0fdfac0c", "value": "B664F18836D8D4AAD4454F311F7AEA7A967B7F113E15852BB7D13F9F3A382C38801246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762581, "uuid": "da67e047-0770-4630-bd41-23f15cd281ac", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762581, "uuid": "af713e05-e877-40bd-b675-747aca97f237", "value": "6144:NQqxN5FGkjbFWMtqiEfNYZLvyhqGzXppy4t:17FbjxWsEYXappr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762581, "uuid": "4216abd7-376f-46d8-9856-20404e1d5d89", "value": 325772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762581, "uuid": "06250725-668f-4ff4-bcae-c06fc4f5f690", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762581, "uuid": "748bdf96-b8a6-4b58-a971-326918cbd672", "value": "takwqaytr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c90277-cda1-11eb-875b-42010a9c0053", "comment": "Malware payload (ZLoader)", "timestamp": 1623738059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738059, "uuid": "b5f06d15-060c-4d9b-a338-8a8aa8d95bc6", "comment": "Malware payload (ZLoader)", "value": "402cd29f7429abc1b4690c0c71770825", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738059, "uuid": "04704de3-e7ac-4134-bf6a-048f1a2901fb", "comment": "Malware payload (ZLoader)", "value": "c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738059, "uuid": "360bc369-3d91-41eb-a737-16cb7377fc7a", "comment": "Malware payload (ZLoader)", "value": "e826394c54c5827f1142b11adc5d550e335ec82e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738059, "uuid": "1da321f0-797c-425b-b610-8cc8ef1fa0ec", "comment": "Malware payload (ZLoader)", "value": "a936fbe0f001b4855f76c35f82ef292ba387b8631f381256310d02d5229bd404c4ecbb18eeeac7f972f4c47680169149", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "iqowijsdakm.com", "colour": "#6F8E74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738059, "uuid": "5403c570-2890-4ee0-86f0-5c66c14bdb38", "value": "D064F201571FE099D37E28B8C8F6C3C584D9CE0A29404C5CB3983BF5E67A5C8BAB655E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738059, "uuid": "11a2904d-c75b-400f-b87a-31cbd194e2c3", "value": "302dc27ee8fb51d51fd455c5c954a121", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738059, "uuid": "18700be8-a6e7-4f24-b9eb-4cc6cc84e41f", "value": "3072:XW3jihpPN6334j29ujis6fyMhzEeSOTDAUnDAVnNrRV+BwrLcqfQD4YGqU2Q7y:m3j8pPN6n4j7Ws61E+ABnF/cl0qUJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738059, "uuid": "1bac3c74-25a7-4dce-97b9-2659101c950b", "value": 313688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738059, "uuid": "4442b9d1-0637-4098-a8d1-6b10eba0261a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738059, "uuid": "20c6fb89-9c24-48d0-ac88-409dcf86d6bd", "value": "c68e80990502dc9b86fe4196af4a62985eb0a5ef56e06b9fa8bdf4ade2b9b668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83852e6-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623736365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736365, "uuid": "9f05e343-9f5f-48fc-9deb-96dc0b28112f", "comment": "Malware payload (GuLoader)", "value": "04a4ee0893001752c65cd252d0887e8d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736365, "uuid": "1a8d7c85-b8ff-495e-b2be-311730bdc3f0", "comment": "Malware payload (GuLoader)", "value": "c6f578a2a266fee9d1656730cb58e152549318981636b2c7b22028fda00bd0b5", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736365, "uuid": "5115d7e8-d4a6-4834-afc4-d9424938fa6e", "comment": "Malware payload (GuLoader)", "value": "b54d4c14ed3573d90fd0363be9d1a3b50746d87f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736365, "uuid": "adb95a68-bd83-4d22-91c7-76b5038dc9dc", "comment": "Malware payload (GuLoader)", "value": "49bbc138e0214c9fe2c8f71f6cb3f0aa60e8433f7e3c845e90a88bfb476a88eb502698dea78dffe11ba6130af9700c02", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736365, "uuid": "4ca6df9c-d3e4-4815-acff-da7785af6120", "value": "145533A5FDEB2F13D343B6366D27C43689B9CE44A066D0C7368C799A2173472538BE09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736365, "uuid": "5556158c-61c5-4eb9-b64a-5e4d0d0364b4", "value": "24576:eIta9Zqp2UpKgLbgRgQhziDgXdOfociqEA38nGkWm5Xqo3vC8IhhUj8qHQ8vPXEh:eItoCgRgQUcv3SMGkzqo/CIj8qHZvPEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736365, "uuid": "ddddcd26-8ecf-4051-91fc-d07098a7c856", "value": 1396224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736365, "uuid": "5fbb2422-17e6-4476-9141-96426fd18cf4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736365, "uuid": "6f1d9c81-0cb7-4103-b347-2be05506ca45", "value": "MTIR21407379_0062180102_20210614082119.PDF.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af49aad-cd9e-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1623736504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736504, "uuid": "ff77bc5f-7818-4ec8-9f8d-3efb83074568", "comment": "Malware payload (STRRAT)", "value": "ece53ca05266cc9709a9fd78dc451dbf", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736504, "uuid": "96f6cbdc-e747-45d5-bc6f-b0592bcf9660", "comment": "Malware payload (STRRAT)", "value": "c7199a8c4b3ef7cfc560d9f022b83aa193c6b9f983c6eb39b3c5224bd08f4a2c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736504, "uuid": "6e88e187-5b9f-4131-b098-9f51cdb0a77c", "comment": "Malware payload (STRRAT)", "value": "4aadc0a82323ee94e5a8e712bd7d5a025dcca4dc", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736504, "uuid": "4d09802d-231d-4a48-8519-06882c840496", "comment": "Malware payload (STRRAT)", "value": "ddd8f34ad730ee38037c70375b496eb1f21626baf81979f9fee6aa6e19f16465d2dddeb532308d78ad3012a180f4cfa5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736504, "uuid": "48236e97-61bd-4bcf-bf34-429c0db957f4", "value": "BEA3DF3F7D9EC0A4E10B45361068A23BEB0CEA94E156971F56FC192A5DB1D2C4B02BDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736504, "uuid": "bb9608dd-3138-499c-8351-a89912c9562b", "value": "3072:Y/NLrSHraaaDj+MXEbwFUHwHVLWgfoYFKKutC:NmTLFcwHxdzoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736504, "uuid": "91b05225-f0a0-46e7-b5f7-4cf0f72d33cf", "value": 105961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736504, "uuid": "cd063423-21b3-4e0e-b87b-17a0a719eac1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736504, "uuid": "6466bd2f-3111-4cc4-bfa2-6ea07c0b796d", "value": "Purchase Contract.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b550a28-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737041, "uuid": "4bd8f161-c8bd-49df-b49b-52d27dd85c8d", "comment": "Malware payload (IcedID)", "value": "d51bc605e909d33abfbc422fc16be3f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737041, "uuid": "388fa896-d116-4a5d-8ed7-dbb3f1530a62", "comment": "Malware payload (IcedID)", "value": "c7b07ae8eae95f2b5f3eebe1abaaf572cb858ed561bd8a7c01e7850c1fcc3649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737041, "uuid": "f8e293b6-2f75-469c-af66-1049c194938f", "comment": "Malware payload (IcedID)", "value": "6318125cd643ab6a61d40b16c5e2840c83b7b97e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737041, "uuid": "701e49e2-aecb-443e-8e11-ddb964f13747", "comment": "Malware payload (IcedID)", "value": "1cf328c485b069daf21a8018ee693c7d44e3daabdae2fefed41d4df0150b5dae715930fce64b64e26cfe7dfc9680045a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737041, "uuid": "0700825b-161b-41d7-9378-10534a4607d9", "value": "6EB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737041, "uuid": "77c7539c-39b7-4447-aee5-12ba1a4b9919", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737041, "uuid": "e77f008a-0daa-40e8-b12e-091e6d64b6e0", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8J:t082TLrbNGoVMjPR5DxDRoFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737041, "uuid": "7412b563-b45d-40cd-9687-dbe1192214c7", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737041, "uuid": "1d49a976-183e-4398-a839-120c101edb1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737041, "uuid": "2181acba-d701-4a52-90a3-fc6bd77baa67", "value": "c7b07ae8eae95f2b5f3eebe1abaaf572cb858ed561bd8a7c01e7850c1fcc3649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f98e3d0-cdb5-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623746417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746417, "uuid": "58f20a23-9169-4a04-8153-5e3d3379cd52", "comment": "Malware payload (CryptBot)", "value": "af94791370afdf086955666671dd2476", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746417, "uuid": "91622c93-0d07-4796-99af-40dd093c67cc", "comment": "Malware payload (CryptBot)", "value": "c7dac0da25d58206459be8af996568547c3df0f76149c741e607249af4c47a67", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746417, "uuid": "58a6ee33-2a85-44ef-9940-eb4829aaea5c", "comment": "Malware payload (CryptBot)", "value": "adcfffb7fdeaeb03fa609436d56b23f8b05e2147", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623746417, "uuid": "fbfbde00-fc7c-4b44-8b88-d13b2ba870da", "comment": "Malware payload (CryptBot)", "value": "fca561a41cf6812f0220226e987a2ae535bc628d8393e3e8ea303d7a23beeff314e5969ae2bcfaf358c479b628b6947c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746417, "uuid": "c9022358-b009-4622-b748-39ea24868ca1", "value": "9B163394801DB83BCE544BB73FCDB73BF99F8AED2071A9854720D64A4A075B41707E8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746417, "uuid": "7a722e6f-79ef-4516-912c-dc3aef22ceae", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746417, "uuid": "75dea30f-48e1-4eb5-8728-6359914748b8", "value": "98304:JC4GDH+SH8W0j0qMuRBnwviliCZPdjVJFJIZz1+oamiNbxpJCcI:JCFHTcWG0hufnCkiCZPdj4Zz1pnSJCcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623746417, "uuid": "7d66bc9c-42fd-47e3-b222-727102198d4b", "value": 4228295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623746417, "uuid": "69572e1b-5a75-42c8-ab63-ddd0db7ed152", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623746417, "uuid": "e79e36bf-4f7a-423e-82eb-1d94f9b9c21e", "value": "af94791370afdf086955666671dd2476.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b552d1b-cdc3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623752315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752315, "uuid": "807844a0-7516-405d-bf1b-110cdd9f17cb", "comment": "Malware payload (Formbook)", "value": "a03422c9949e66c4a7be3370229c2f49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752315, "uuid": "ce373641-9739-4549-aaef-6c5fddb15fd8", "comment": "Malware payload (Formbook)", "value": "c7f5e260a66f326d1a83d859c9b6e9ab88f54de7641a65c6534997581bdc188b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752315, "uuid": "776d366e-61a3-4892-a814-0335d461069b", "comment": "Malware payload (Formbook)", "value": "f2a05b071bf42840155e7d8624750a0448b3dcf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752315, "uuid": "08ba9ef3-11a1-4102-8016-ffe68534a2b5", "comment": "Malware payload (Formbook)", "value": "ef8e67a4f8e5d5369fd231553dda34d000bd7404cfe8a07a48c3d32669b2d5938370fb68fe8ba1981de9e42214d77504", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752315, "uuid": "29b4cc4a-7387-4db5-b13a-b07227bc5adb", "value": "5EE47D6EE6405472E83B2EFD8C4AAB94153E7E513E649C4D22B83E467E743C0762C19F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752315, "uuid": "4e9df4e5-ad6d-45bc-9386-8c198001db57", "value": "a66cda4dbc02db195dcaedc912db7cdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752315, "uuid": "fa49f9f9-e699-45f6-8d3b-ffdbc36d06b9", "value": "12288:D90ywyQxFTkWyDA0eOlzgnD34mGWqX0uNb+T0HXX+jBnnXLVgKR3/EI:DiPPTkbY/D30Wq/XQB/EI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752315, "uuid": "c82da2b4-3968-4f4b-b4fa-399b7903a717", "value": 657736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752315, "uuid": "c8d09a35-ef09-46f6-a410-a1cb3d9c52ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752315, "uuid": "5b70a691-a51e-4d00-8d1f-01503f52c7a7", "value": "IFS PO#268731 RFQ NEW IFS PO#268731.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849cc265-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737057, "uuid": "b8a16999-d0e5-4535-b4e2-2894f08ee9b4", "comment": "Malware payload (IcedID)", "value": "58654c7c9821b7bbe982e10f394229eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737057, "uuid": "651fbf0b-3673-4ad5-b0c0-ec4b5249aaec", "comment": "Malware payload (IcedID)", "value": "c97358d857656de26efc16d27185f66ba265d7499f9a11adcfd7157d88275da4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737057, "uuid": "c7ec33a0-eb97-4dfe-9001-f110074be09c", "comment": "Malware payload (IcedID)", "value": "e7895e354de5e72114b1a43e349ac87f62870c73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737057, "uuid": "1e18709e-7e8a-45ea-b14e-eea878279699", "comment": "Malware payload (IcedID)", "value": "67c5a3bf0deaf26afd2b0093348fd5d152ac02d1418b1ff45a892905fdd89a60e30abb396232de9057f705948781fd4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737057, "uuid": "1fee2f7c-5816-4a58-aea0-52de5be70c06", "value": "4EB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737057, "uuid": "12074ede-cca6-4f3d-ba29-9d5a65f95186", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737057, "uuid": "5f2fe1a0-8f70-43d1-8b23-5ac99f7f35be", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8R:t082TLrbNGoVMjPR5DxDRoFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737057, "uuid": "17d6a9a4-91fd-4ca2-8cff-6ce1b844404e", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737057, "uuid": "7104a439-8f02-4153-8377-4f4b2af61f18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737057, "uuid": "6056ce05-cabb-4aac-a0d2-bd6f69dd6b22", "value": "c97358d857656de26efc16d27185f66ba265d7499f9a11adcfd7157d88275da4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4849e5a-cdc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1623753995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753995, "uuid": "98a2bf3a-9634-436f-9997-528eafb82849", "comment": "Malware payload (Gozi)", "value": "c29c0275db7e51e9906aebcd2566a147", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753995, "uuid": "543d2ab7-7883-4054-8d2d-fbd75e9a18b1", "comment": "Malware payload (Gozi)", "value": "c9bf359a438aa4abb92e6521b9dd19b631a7818f64af85f6603dc6e7cbae86e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753995, "uuid": "aef43811-ced0-43b1-8771-053e07ebe171", "comment": "Malware payload (Gozi)", "value": "d35d671ae5e40aebba825a624c287cbc1c750ab7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753995, "uuid": "1fe1b60a-cd80-4adb-8a9f-5187b272068d", "comment": "Malware payload (Gozi)", "value": "6ebb024183aadba5b63a2e2a6105a64965fa7c7256fd710ae106109b9f44f560db757516d676dbe049aa6490b890e0c0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753995, "uuid": "7c22ea09-a097-449a-8d87-416b0bcf56f4", "value": "E003F123D22845D7CD83C73B03B9159EE36B85A0022B1FA967B18E7B64DD85D5CF6350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753995, "uuid": "65bea1e8-bd86-4ce6-b3cf-d646e29ef469", "value": "6645a948149623e814d378b0c62a0e68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753995, "uuid": "69a70d97-ad28-478c-a240-5af2faeedd96", "value": "768:+HCxLvZYmmTV6iX/Kkph8lxFE/JvlOIewW1w:+HCn1mIqfp4ExYeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623753995, "uuid": "a315f031-2e8d-4b7a-8f48-b0fa1dd498a0", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623753995, "uuid": "940fcf19-a382-4a08-be1f-4e3999fa7787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753995, "uuid": "aa24c7e5-6e70-403e-9aa4-44b08a44b6d5", "value": "689c0000.settingsync.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16cf236c-cdc8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623754482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754482, "uuid": "e1bf828f-9b9e-413c-9de4-07286877f787", "comment": "Malware payload (Loki)", "value": "1d0cfeae51547141fd3491bc4fa36b98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754482, "uuid": "8e160fa0-267b-404e-86ee-de27e29cc760", "comment": "Malware payload (Loki)", "value": "ca7ba4969de206f21d0ec848f0fd0fb56bc4f52bb8557f9a253baf48cbdc8a88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754482, "uuid": "211ce8e2-172c-4ca7-9875-de61a79d7ec5", "comment": "Malware payload (Loki)", "value": "2137370da81cf4d3f5e7f92b78338dd2a53d221c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754482, "uuid": "52e5169a-5ebe-46f3-a28a-fa0df82ce906", "comment": "Malware payload (Loki)", "value": "94d016b20f6aa4eedf7e43a34fa970edf53e82a444c7bb58c0fba17f5e3178c5fc73bb053852b364d0f0fb789285313e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754482, "uuid": "ac899650-a33c-479a-b722-8b35a6c2aeef", "value": "4E15BF534ECF866AD2644DB66731AC4782325DE92948B3223EC035BDD9372EDD8EF901", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754482, "uuid": "78890bd7-0881-4819-90fc-853ce851f74d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754482, "uuid": "f5452c4d-1644-4083-8a09-cf3134c6afd8", "value": "12288:IySMPQipP5PQSLWzcGZjeG/HhhGKtQ6uK4OB3uODj5+xsWnFV7b5X6ARciBpDy:INip6SLW5/dtuOBdcsWV53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623754482, "uuid": "132264fd-7f0b-484d-a64b-2cd25866db03", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623754482, "uuid": "5e0d7af1-1fdd-4a33-85de-9e8ac6a50772", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754482, "uuid": "d41158aa-1b4a-4d8d-8e6d-bb7a492da1ff", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae28944-cde7-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1623768018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768018, "uuid": "7f942b51-4c44-4535-ad60-2ac507bb4b9e", "comment": "Malware payload (Hancitor)", "value": "d473f4be583cc5d7016437f481790576", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768018, "uuid": "cd9e9e3e-2e91-4d09-a6ff-967da008175d", "comment": "Malware payload (Hancitor)", "value": "cb047618c8feedb2dd20f65611bf9e6dc13f6d3a14f009cc887ea2da580083e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768018, "uuid": "9b4c8d79-2c01-4b7f-beea-cd74407aa48c", "comment": "Malware payload (Hancitor)", "value": "1562b676b4a66d961130753836773a77a9be4cc6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768018, "uuid": "7dd32efc-3fa3-4e32-93b2-48d4aedc220d", "comment": "Malware payload (Hancitor)", "value": "d278b10e6a1ad83509af7f0405233bf05e6ba2ec92aec09c14c2aad4cd096c303e2f9acd77f6756b24e2a0f6437edeaf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768018, "uuid": "6a83d1c6-5146-46d3-acdd-40f253fc2c02", "value": "44C48E01BB90C02AF5FA00B9CAB9DBACA9197D719B2840CFB3D06ADF16395E55C31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768018, "uuid": "41e2e77f-863a-4706-96dc-a5d13938ecab", "value": "98842be3b2902122755cb4e299c5bfd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768018, "uuid": "676b4a33-600f-4d6f-ac9f-b572a4f33725", "value": "12288:GbDnQp+OwPgw7N4rPzcLz67y+er/PA6yUvrWc0NJlB:G3nQoq+N4rg/dATUvrWBnlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623768018, "uuid": "9aab3f9b-0d6b-43fe-b061-113f378b20e2", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623768018, "uuid": "1d758d15-d289-4bce-8f11-0681ced996a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768018, "uuid": "f06bfd36-3547-4a5c-8f41-aaba29bdfdbd", "value": "omh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2f39f0-ce2a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623796855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623796855, "uuid": "a2f74560-6c93-4b38-987f-92170bfd6474", "comment": "Malware payload (RedLineStealer)", "value": "7d2ad1394e288a542035e5af1f2cc3f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623796855, "uuid": "0f23ceeb-b556-492f-bfdb-5857bc611e67", "comment": "Malware payload (RedLineStealer)", "value": "cbba94a11f16e518cfebe5ab5ac573f336852eafce08bf122e374d6adb57b350", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623796855, "uuid": "b6a93f4e-80dd-4be3-8948-981a54271ca4", "comment": "Malware payload (RedLineStealer)", "value": "740159153e894c172b6eae8a76e2653f326214bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623796855, "uuid": "9d8462c4-6291-4230-a3c2-3238607df4e0", "comment": "Malware payload (RedLineStealer)", "value": "a114f4eea613efbc3d48b4f764edab830d6a943493df64b4bd7b009aca25f356d1038c4873c8ea89358e37a612aadf9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623796855, "uuid": "efa567d6-1f2f-4f6d-b847-a1d9b8938c3b", "value": "CC84AE11E7A0C038F1B712F85A79A3B9E52D7AB17B3850CB52E527EA46346E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623796855, "uuid": "0275d3b3-0f4c-4f4f-bfd8-9692a8b73710", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623796855, "uuid": "a24fe9a8-721c-445c-bded-7cc99f5d5e9d", "value": "6144:z7hsL3ESjOb8uG/z1N1EUQKT7uaTvQojzorkJlE9juMqXp:z7hsL3TObM/ZRQOlTLjzyP9aL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623796855, "uuid": "bde939f1-4323-4eca-b4de-5850b616dd24", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623796855, "uuid": "29469912-eb09-45e1-af73-4e57706ced75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623796855, "uuid": "8550f6d4-5b1f-4c9e-9a33-19081fc0290f", "value": "7d2ad1394e288a542035e5af1f2cc3f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4971afa6-cde3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623766163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766163, "uuid": "c798191a-4cb0-458f-8fd3-359a3ece790b", "comment": "Malware payload (Formbook)", "value": "eaa963442bab33d032bb5708e34b95f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766163, "uuid": "28081a80-ca29-4d33-91a4-99ae39240c74", "comment": "Malware payload (Formbook)", "value": "cbd8d7c3cf92798b8306074a078a94b84cb49a0db60eafc22d277231a23d7fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766163, "uuid": "727f3c1b-431e-4a72-a267-7904c2a3c87c", "comment": "Malware payload (Formbook)", "value": "c80dc51fdde4f052875cfda99278a8127f308e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766163, "uuid": "b9b260a7-860b-4d96-978b-4c7c486310a0", "comment": "Malware payload (Formbook)", "value": "3f88198d3a2f5c18ead432c8bb2ced49b010c641aaf5d06a1abedbf0f33ba74a4d6ffd3bd75d4d8b7e570f92510956c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766163, "uuid": "1c46d9ad-35fd-4afc-ae3e-172b08d1700d", "value": "7624126D27C4189BC0A3867242BB33BEE1BBF76F0666115F6B241F7A15202C1A917787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766163, "uuid": "cd7d46b0-3446-4746-baf1-253b2729fa7a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766163, "uuid": "e832840e-738d-45a9-8ef3-a0cb8ae7ad85", "value": "6144:cQqWn9BYk8Vhk5uccTIKIDA/tPAtMlJgOwr3St:vDYrk5EMKIecM/dq3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766163, "uuid": "2194ad89-45aa-4fb5-afdb-a28488dfb608", "value": 222151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766163, "uuid": "f0510873-3931-48c5-a8c2-33e62a304997", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766163, "uuid": "407fbace-f52f-4bb7-9af6-87fe07cc1d97", "value": "eaa963442bab33d032bb5708e34b95f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d29f66-cdcb-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623755875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755875, "uuid": "c519fc97-0e6c-4648-8c25-10e74c34e611", "comment": "Malware payload (NanoCore)", "value": "20ca1a1ee41fd8c8f6dd16f4a301bda6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755875, "uuid": "4c2f9695-1272-4b01-81f5-1e6103ff6c4e", "comment": "Malware payload (NanoCore)", "value": "cc29aec6f8aad1e459d14849a31e949e662c9fca5b9ab0510fcdff80ac082a0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755875, "uuid": "18e80243-8410-478a-b8bc-02edb0cf51dc", "comment": "Malware payload (NanoCore)", "value": "492f161c8b3de0fc187b2432341504a0f664ccec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755875, "uuid": "68afe99e-7a45-4684-9b1b-444c270fa8aa", "comment": "Malware payload (NanoCore)", "value": "600e3ab2f399842f3a8dcfd8dc5f6a03f006eca4bedc8f9f3f6491603dfbf042cf892c2723e6c4a583d704d316285d7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755875, "uuid": "a9bcaf6b-dadb-48c0-b242-e6aa2365e6c7", "value": "FE15AC9C5159CFA4F07B5B340054D110A26BECAF9532DA1EABA1FB7F2B373C38119266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755875, "uuid": "fd2e82fc-cbc2-47c3-bb15-21d18b1bf8dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755875, "uuid": "eb11d59c-23ff-4e4e-8b3f-79ff1a6381e6", "value": "12288:QanB9VCZ6vCPCkmYCJN0ytxCZpDYiUrBCfhc7q4MCLVDoXGmvbCkIXo2WePPPPPv:QaJtkmYCJN01E7rAZghHmvmkIzWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755875, "uuid": "088a19c1-9870-432c-8bd9-aa3b7f53577d", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755875, "uuid": "54a24d5b-7dbd-41ea-b15c-69aeedd24a75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755875, "uuid": "6090fb16-5445-4fc7-9147-92d572577fa5", "value": "PO 268232 JUNE DELIVERY PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f0ae03-cda6-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1623740149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740149, "uuid": "66c74ed7-5921-476b-b937-b5d33c6d7756", "comment": "Malware payload (AveMariaRAT)", "value": "fb3f04908f8f150a72df754414e3a603", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740149, "uuid": "fdb07a7b-56e3-406c-9895-9fb1e33fe2cb", "comment": "Malware payload (AveMariaRAT)", "value": "cc47a9cd21127f53bdb494d7229bae248aa5a4140e7a70a9f6c521741f6ba477", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740149, "uuid": "68aee090-70da-43fa-a932-59121287b475", "comment": "Malware payload (AveMariaRAT)", "value": "b01e5ea906649f77d01264cc1cb1e451297004fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740149, "uuid": "b64a36ee-bae6-4074-95a6-a985239865f3", "comment": "Malware payload (AveMariaRAT)", "value": "b1f1ad70fa8a9917f0855ef91bf725c102de9966eb1e5191581bff27412a2129b399c5d08d288cdabfdc2bdc229c033c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740149, "uuid": "5225c08d-e658-49c3-8aff-c60ae7f7147d", "value": "3174124193782750D58E4ABBE4D389B062FBFF26A840E40B57E47EC857B238477E9066", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740149, "uuid": "aed6fcad-c5e7-4686-970c-0b9c963f1490", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740149, "uuid": "d03bead2-37ea-4437-baa6-c63c6ee99c22", "value": "6144:2uFl/ZzPgVCr1rZpTxsggRhba7QJxvZlOHYfAtvuNcchn9fzRT/Y0rU1:jlZz4Vg1rLVsg1CxTo3Vu/zRw0rU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623740149, "uuid": "1b8eb33d-7627-48a1-b8c3-9d250c036dee", "value": 354800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623740149, "uuid": "3eac6f22-7954-4312-a9a6-bdebb10cef2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740149, "uuid": "5237e6dc-1fb7-4ebb-a97f-1b04375afd47", "value": "fb3f04908f8f150a72df754414e3a603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6870ea57-cdef-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623771369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623771369, "uuid": "79a86f3b-fbe7-440f-94ed-b1f9a5abeedb", "comment": "Malware payload (RedLineStealer)", "value": "9c4400268a4f913646c7e32e78e66302", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623771369, "uuid": "5010578e-1150-41a7-b4ef-0f874703ca1a", "comment": "Malware payload (RedLineStealer)", "value": "ccbf1853c703609eda36bc07ab8eb2faf692153b56ecf8cf9155e67e7a460c2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623771369, "uuid": "e96fd99c-37f1-45ba-87d6-4ec45251eb05", "comment": "Malware payload (RedLineStealer)", "value": "1cd14f10ca2536aa36be01c785306f2b577a8f39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623771369, "uuid": "e83d8a58-589c-424d-afba-1e72225de298", "comment": "Malware payload (RedLineStealer)", "value": "42381984aff13c905250edccfa090fdcd62d490fef096ac55fef2369c6f51917d35b87797156c5b708ff37c9546e1dd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623771369, "uuid": "d274ae75-1c2e-4e54-86bf-872eaaeb5182", "value": "F9F49E21B543E077D8B600B05A6CA76B643E7D3417648AE7B3C93F795A305C18F32A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623771369, "uuid": "3f50225e-31ed-4f3c-b45a-bf44085e50ce", "value": "e042641788225e9fe340d7739f9f346b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623771369, "uuid": "95f18264-339f-449e-a7b1-f1063925ecce", "value": "12288:8sxLGHr5syeROZMgPSMVo0+OeO+OeNhBBhhBBYKTG8ro3/W67tWsXv72t5GBOhCR:bxLGHr5syeROZMg6MQ2/x1tBi9TmgOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623771369, "uuid": "b1af73c3-831d-49df-8e01-c32cbf25c549", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623771369, "uuid": "fa4c1e06-5b69-43a0-be07-5e1c17f86284", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623771369, "uuid": "126c97d2-fbad-4498-bdbd-e539302defe6", "value": "ccbf1853c703609eda36bc07ab8eb2faf692153b56ecf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298e7db3-cda6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623739911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739911, "uuid": "87c335fb-3adb-4428-8ad2-d9d6ed68abf7", "comment": "Malware payload (AgentTesla)", "value": "f4c6b5914754318ddbe71691c32ab09f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739911, "uuid": "69148fa1-8635-4253-b4a3-6c823565a8b1", "comment": "Malware payload (AgentTesla)", "value": "cdb260bc1d56435c3bd52fe7d5f5f153d8cec4d52450bb53d7db1c669e309095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739911, "uuid": "01778768-2e00-4b28-9dee-5250c1937dbe", "comment": "Malware payload (AgentTesla)", "value": "1d6e56e29e09136855d0c712809925010fdbf673", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739911, "uuid": "e87410be-89a4-4ce4-9e9b-a137ac2611ec", "comment": "Malware payload (AgentTesla)", "value": "9e84baa831bb4a9b01846e87beb0b15c4c1851a4dda411b57d3f0ec1baac50770db0410016a2a3a1c5ab3133ffdb1384", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739911, "uuid": "c45d96ec-1624-42de-bf20-c54086af927a", "value": "33541290A6439C91C5824F7848AF6D03CEB2FF53FD63E55A7486334E6EB33D91AA1409", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739911, "uuid": "4e7ca60a-85e5-4c4c-ad49-d2cd40d4093e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739911, "uuid": "c369ee6b-264f-4c70-8c3b-4f6707fb2877", "value": "6144:ZRlGLgyVt24hhVqY35XVLCil1jfRXO6OFN3GU1:ZRdYvq8tkFRGU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739911, "uuid": "1f9f6175-78ed-48c5-b672-1efc9186488f", "value": 300528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739911, "uuid": "907a5dc7-3ea6-4300-b082-28ecbf356ea7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739911, "uuid": "c6995617-dfa5-4c3c-8e48-0d5d84c5eb50", "value": "f4c6b5914754318ddbe71691c32ab09f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b014a4-cdd4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623759872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759872, "uuid": "448aa803-b045-4906-b846-4b3c3f278b23", "comment": "Malware payload (AgentTesla)", "value": "a31bda335f36a4e33c224c1ed44f2ce1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759872, "uuid": "536db7d5-9e12-4e10-99ca-11be1cecf630", "comment": "Malware payload (AgentTesla)", "value": "cf3df232dbfb7717e7c3ec8b5793440ac502519d0eed85dff93f5733a1f3ea85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759872, "uuid": "58a125bd-61f1-43cc-a180-cbebcc6f18d5", "comment": "Malware payload (AgentTesla)", "value": "55bb38b4bc6ea9493bf2db8aed7b762a292ce265", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623759872, "uuid": "2687b9f5-702c-47c7-8fbe-d6e26751ac44", "comment": "Malware payload (AgentTesla)", "value": "88e08c30a4de810bbe69b7d06a06a187ccf242b1e612f450682756bb0f1a1c77c6c2f81e9c34e6c6e63dca9c62738d18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759872, "uuid": "6f54ec23-f527-47b8-b0fd-bf3b73ecc880", "value": "1615AE575ECE56AFC5658CB69730AC56C2311CBA2609A3132EC234BDD93F1EFC99E012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759872, "uuid": "3a5a36a5-59d0-4726-84c2-7d335cb30bcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759872, "uuid": "74bc3364-bd2f-4c48-ba24-59a5b2353bb4", "value": "12288:0LQqXCK5SMPQipP54GiwaNugoqv+AVnu9ymLo3+bBQntI/FLtYXrpr07602fqupL:4nWipBipugrPuOCBQ+CNr07I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623759872, "uuid": "67d86333-7ba6-497e-8880-7b5c58d3c474", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623759872, "uuid": "31e17de1-d4ba-4217-bd89-e7b5941e53e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623759872, "uuid": "dc953344-9147-4438-b2d1-51d2b151ab0c", "value": "Perintah Siasatan Baru Fuji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22487f7b-cda6-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623739898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739898, "uuid": "48624922-e8f4-4465-a9f6-03275b0cae76", "comment": "Malware payload (GuLoader)", "value": "6572076bc21603b0612703e4dd2e1f67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739898, "uuid": "8e959608-bc41-4cbf-a0d1-4c9c6181aa78", "comment": "Malware payload (GuLoader)", "value": "cf62a78fa8483a391861a1eb56322cc8fd9ccecca90629398ec54ed62af6114c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739898, "uuid": "ceb60a7b-d3be-4ea1-8b7e-3aefe6e519ce", "comment": "Malware payload (GuLoader)", "value": "9f6f3fed450b5887110424d81279ab138bbf6519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739898, "uuid": "756139b4-298b-407a-97fa-8d81aa94d69e", "comment": "Malware payload (GuLoader)", "value": "6d11d3d5564a95f5ffc441d057bff99a21ea4f32bd76ba8184d9c6e4c0e59aa59eb2bf76c9aae4745b30fa9d1f43b87a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739898, "uuid": "bd2686ba-336b-4e42-ad41-5e7e173a3575", "value": "B4E38332F7836500F9668070FC159AFEB9546F316C439D0BA6F2BB0D6175ED3B6A0A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739898, "uuid": "d0e0e30c-fb69-441c-8fa4-c1fd5354a2cb", "value": "2c08d8f9644132654eb702b279083d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739898, "uuid": "9c8bb0fe-39a3-45b7-9b0b-75b902de73b5", "value": "1536:w+mqfTK8fKzFDwZbo+Ag+8ItLItgkBGsXy0exhDoQa8N:ZlfABDi+8Itegk7y0yV3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739898, "uuid": "0638bf9b-d123-4efc-9b52-cbdf05fac6e0", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739898, "uuid": "b3b61794-b160-4f05-a790-f38a57fc8171", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739898, "uuid": "ef10eb35-004b-4e93-b6c9-b9e177e5fd21", "value": "6572076bc21603b0612703e4dd2e1f67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2f5286-cdd0-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623757924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757924, "uuid": "dec58622-fe88-4cb5-bd03-3bf5d7886829", "comment": "Malware payload (SnakeKeylogger)", "value": "0b8ac7290b2f6777df90c3b07023afa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757924, "uuid": "2ad47d58-71cf-42d2-8208-f3255f6f6816", "comment": "Malware payload (SnakeKeylogger)", "value": "d09500f30f90dcdf6caac545bff9663876dc3a7de445d618e947ba64a5f4966b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757924, "uuid": "1f11da52-5fc6-4c40-abfa-e824f176f24f", "comment": "Malware payload (SnakeKeylogger)", "value": "789ac69350353cc3c46ce9e9681a57d6e2d9c6f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757924, "uuid": "5c47a8af-4e27-4eae-91ef-6c3557ac5fe2", "comment": "Malware payload (SnakeKeylogger)", "value": "c39012145b779868f33ecb4618e708479e25f706b8792395fef82dad1bd11ef3a2121cbd133b22423ec6d6b8b144e70b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757924, "uuid": "e463f218-2671-48d8-9a4d-5a3af32012dd", "value": "3C741290B0D5DCC7F5B989B0197BD631D1F5E7269060226F23CA7B9D99B13A7200B28E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757924, "uuid": "4401f3da-4003-4b6b-835f-94bd7486dd7d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757924, "uuid": "c2ad8448-b9fe-472c-9c14-d49405d7dfbb", "value": "6144:dQqA3QVTe68ybXmNaHwbV4C3gihhbdHTq9d66iCxKJeuCe2t3svnvNMj6lqUEfwt:8tFTNaHwbPphbxq9Cez8vNvAUEfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623757924, "uuid": "71006adf-cd6c-428e-96fc-1512c70d0d20", "value": 352386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623757924, "uuid": "294623db-423e-4311-9762-47c1551a3c1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757924, "uuid": "0a4d9c3b-545e-443a-8fe0-c37924cb21ff", "value": "0900000900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f79475-cde2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623765777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765777, "uuid": "68706b4f-7ccd-452a-a1e4-486545fc7952", "comment": "Malware payload (Mirai)", "value": "c2497f536abe25943a1434ef2b4b8524", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765777, "uuid": "6dca927e-6279-4db5-a705-4e720537ada8", "comment": "Malware payload (Mirai)", "value": "d2a95dc2f898a4fcefbf8108f905dbc7c609820103d54a03f5fa16fb2ff71462", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765777, "uuid": "b34402ce-26f7-4b7a-8d76-a5fbd4c97d95", "comment": "Malware payload (Mirai)", "value": "e531f7c393730badd9381b8df2a8e33a687dda70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623765777, "uuid": "de364609-ac73-4fc2-a150-3fa2e5a7a1f9", "comment": "Malware payload (Mirai)", "value": "a0ae3b462f7828b7f184f19e07aaa3d7bbddf7c133f60beffe00e297e234c7ebc2ac8c26420fc52a6b485ea8eef00f17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765777, "uuid": "193a844e-2409-4d5b-9d87-4d97bf1c6be5", "value": "38143A85EA808E23C4D7137AF9AF018E3331A7D5A3DB7106CD145BB43B86A5B4D63B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765777, "uuid": "42f6c05e-5bf9-45ad-84f3-c16b3722c310", "value": "6144:FTeiCq/cvJuKuBylD7JH8Oi2zhG062uc9SOzJVXfcuM/9Ezs:FTVCq/cvJuKuBuD7JOKuc9SOzJ6f/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623765777, "uuid": "eacb6456-1686-4c93-a04c-ebf878a2bb10", "value": 206231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623765777, "uuid": "d3686ae9-5e25-4a85-a377-77d43768b845", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623765777, "uuid": "0afe9dbc-5717-4342-aefa-88b3af635573", "value": "c2497f536abe25943a1434ef2b4b8524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc6a456-cdca-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623755380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755380, "uuid": "7646b8cb-b070-4197-a152-ff1cc0426261", "comment": "Malware payload (AgentTesla)", "value": "d530363e0b6a567a41c7e3ca5cac30ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755380, "uuid": "e80dfd9f-3887-4312-bcf7-879bd09a6ee6", "comment": "Malware payload (AgentTesla)", "value": "d31f0f4615f10e3b756b6e7cb05c0f896d543c55049efe3b51d09b085c9a2648", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755380, "uuid": "68551920-8c25-4cdb-bd2a-a4eb1901d40e", "comment": "Malware payload (AgentTesla)", "value": "0067d11e505d9a91aee83d8013dedd436c7b5de5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755380, "uuid": "96acc3eb-c7e2-4901-a59d-f002e5c58500", "comment": "Malware payload (AgentTesla)", "value": "593297aabfa25f6c269780c97df9b7f7dbb90e42e0980397c9c043fd92354d5f604cf23fc3b4c6dd2857bbd263ea9e98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755380, "uuid": "7d5c29d3-776f-468d-9c9b-c1bc371d3574", "value": "E7D4237EB6E79A8415C6AD70CA02013EF8427ADFE3668C5C0C3AA58D1D0DED72B5524E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755380, "uuid": "20bd0478-0040-4bd2-be5c-e672940729ee", "value": "12288:CxMZEF3+5I8X0G8/oP+OXXiZrbAERCnY9Xq4BPbiwpyV6Rfm+ZH:AD3+b4WyZrbAgCZ4BPbBp5m+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755380, "uuid": "cbff84ef-9150-41a4-b94a-e5f27cf91f84", "value": 623340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755380, "uuid": "7116d935-a8df-414a-be4d-e10efea3ad00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755380, "uuid": "2c2ec3a4-6af7-45ff-9112-5174f53236c5", "value": "List Of Products Q002-O417729.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410d4d29-ce15-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623787624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787624, "uuid": "f4cb7e24-dc3c-4035-8d03-90b36d16dcfd", "comment": "Malware payload (Mirai)", "value": "eaa31d6a7fe40ff1dbefb6a3f45277bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787624, "uuid": "cbb9ea77-5f14-4a0d-9901-416a76a6df95", "comment": "Malware payload (Mirai)", "value": "d3e475862b6e3e95b81304fe85200484b417cf4e9abedc14e5e5fdc9c2d7a785", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787624, "uuid": "10d57440-a488-488a-a424-99d8441c65a4", "comment": "Malware payload (Mirai)", "value": "0684af16b649707f0ef1f4888c4bb1de89a997ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623787624, "uuid": "134a8623-1c4a-404c-8fac-ae2961207521", "comment": "Malware payload (Mirai)", "value": "43256a8815c4f77d8dfce6ce449a16019b59fbdb3328632ea6f39b65eee133005b611ca2457afa7ed981c83783ef33bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787624, "uuid": "f03befb4-d100-4c6c-8dac-a228586426e3", "value": "39338CB5C579EDE8D1144A78BE248E749723E000C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787624, "uuid": "b44c149e-be16-452b-aa8c-eb7c4bfb830d", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvD:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623787624, "uuid": "a7597379-62e3-4c59-995f-f05a64f9207a", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623787624, "uuid": "bd16e191-4956-4e72-b683-bce63262d72f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623787624, "uuid": "780c80f1-d9e0-4a7f-9c6c-fa4d950f4b69", "value": "eaa31d6a7fe40ff1dbefb6a3f45277bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b64d09-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737062, "uuid": "3630ffab-6d62-4197-940a-ed9fb39e1749", "comment": "Malware payload (IcedID)", "value": "141b434627d5183781ed15d2ba91a6b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737062, "uuid": "b539137f-6164-4f9b-9860-007b1a500587", "comment": "Malware payload (IcedID)", "value": "d5a25ae473f51b20f40fd0754e3ccc0a308b5657dccb219ab2108b54be6acfba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737062, "uuid": "7381bdc1-44ee-4c63-aca7-d21df059d4de", "comment": "Malware payload (IcedID)", "value": "47e0af58633d1e8d8d04f493ef6c556eac778269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737062, "uuid": "f0f85339-380e-44d0-a2b0-145789a54237", "comment": "Malware payload (IcedID)", "value": "8284ef5186e1df62f50df9a5de15ffb7947813e1d61d165f6d6cc15df2ee46438e278cd07e5068ce6f6e2ae8bddd1235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737062, "uuid": "5ba1f694-b25f-4ad7-acc6-741665113a5b", "value": "1DB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737062, "uuid": "3bfe6180-2156-4f02-8e49-9a959e2fae5c", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737062, "uuid": "24713122-8675-4e40-93e9-1cb07cd089bd", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8B:t082TLrbNGoVMjPR5DxDRoF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737062, "uuid": "4efa7f55-52f6-4c0f-a21c-fde5dd13177e", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737062, "uuid": "10a016a4-7b63-4ad3-bda1-4e323049d45e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737062, "uuid": "e5b8ff6f-0883-4efe-8dfd-28acf17bc901", "value": "d5a25ae473f51b20f40fd0754e3ccc0a308b5657dccb219ab2108b54be6acfba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652a1a90-cde3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623766210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766210, "uuid": "1ae6e1d8-de3f-4c7f-85a0-70c493ab1a8e", "comment": "Malware payload", "value": "c8d663db597f3f0a515f316c2fd0b675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766210, "uuid": "4e002b77-8c86-4f0a-948f-327927d0ac07", "comment": "Malware payload", "value": "d60e5c1906d5a872d5342c64ab76b0417420c6324c495629be60fee5fcce1f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766210, "uuid": "a0b7bdbb-ad88-4e21-9536-5148e7fb5f12", "comment": "Malware payload", "value": "a8083acfb9bfa8c251d9e35e226982e10aaee0e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766210, "uuid": "3d5fc84c-04c3-436d-8a31-66f8a4bbe1fe", "comment": "Malware payload", "value": "918f09edcc4edd34cdaa34ab2d86ef91c1e3fdfafddc36864c5ef1c1972761e5dd5acce2f26eecf92b70959a02c68352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766210, "uuid": "a996a1c2-28d5-4831-a1ee-ccb45858f83f", "value": "68F49D512EA8AB89F4F99B347EE0431503F77D227B27D3DDAE8871CD1967E808621352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766210, "uuid": "47514e5f-a80b-4965-8326-8ad883fffa93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766210, "uuid": "fadb179e-2e98-4d56-85b2-059b0493f498", "value": "12288:5QPt94uSXvFmWafkN++aJ9n7BXiM9Bt0rGy5NXoOm423YFGF69vquwaHp+akW:5yJt0ZzXFmvrFUquPHp+akW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766210, "uuid": "69728ba1-95a3-420a-8e31-d81454f3e021", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766210, "uuid": "75bc1d42-3939-476d-8c21-82c47de1ea56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766210, "uuid": "7b2c43da-739d-4278-8755-807917c6ad4f", "value": "c8d663db597f3f0a515f316c2fd0b675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e8b677-cda2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623738259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738259, "uuid": "e96a47c3-53bd-4339-ba2d-f1dd3496c390", "comment": "Malware payload (RedLineStealer)", "value": "98a8790f81bdb75c61d84fbba8ef6664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738259, "uuid": "656154f2-453d-414d-973d-fdf2b9c21be8", "comment": "Malware payload (RedLineStealer)", "value": "d645b7c368c3c60c34eab973cd99d5c08f014ac87c56b56eeb8cdc24abddf32b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738259, "uuid": "91e85cdf-6515-489c-9917-e4052d14edce", "comment": "Malware payload (RedLineStealer)", "value": "ab8c9da55c403df97935dab8c632d9d6edcdd4c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738259, "uuid": "7ca88d67-8cc8-406f-843b-9106621c8d93", "comment": "Malware payload (RedLineStealer)", "value": "07318bfcc9655a88f13d8beca9941b335029540c2ec7f6382187b789e4fe05b71dd3f6ba649dfb3d4fd7cd6c80b1a6d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738259, "uuid": "0abb6c6e-c28a-4807-abdc-398ca36552af", "value": "B0C42E2825BFC009C4A7EFB12DDC54BAD99994A3A50E723311B4633B8B52794DE4F1BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738259, "uuid": "ae17e1be-ce1b-4765-a604-6282a4c75c56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738259, "uuid": "242e8086-12f7-4a99-9a38-cd821d7b88bb", "value": "12288:nG128ZEkEkEkERcXxxalve6q2VWYc9fBr0JboidorWbs8GBUvKMYIwyVEiesn:GM2EkEkEkEQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738259, "uuid": "27de51c3-ed74-4d26-8536-ce11a09bb1bc", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738259, "uuid": "f74c5b21-2856-47b2-97d1-623427d992c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738259, "uuid": "33f75452-9fba-40da-b462-a7e921c17b8c", "value": "98a8790f81bdb75c61d84fbba8ef6664.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92aec3da-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737080, "uuid": "340a49c6-9995-41f8-99cf-2643a0fbac03", "comment": "Malware payload (IcedID)", "value": "78f00ce0ab9e8bad98363e14d7a08ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737080, "uuid": "b6e1b4ac-e738-4743-9e3d-b6127709abf2", "comment": "Malware payload (IcedID)", "value": "d68fd470ae30199285adf983ce462f660b8ff10008a68633a4946e5b7f3c940f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737080, "uuid": "e72b064b-7f7b-4e5b-9def-0e4a29cd69cf", "comment": "Malware payload (IcedID)", "value": "4d85c0b7df80f81192d32ac08d66d8c8a8e65ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737080, "uuid": "736d0578-df41-4051-914f-c815fbb89683", "comment": "Malware payload (IcedID)", "value": "292128ae13036d3d1beaf8727c49586639b20760b3f69327137f8df31c9f7d35d8cdf40db1d96ad5f6e7781290dd31ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737080, "uuid": "f5d7db00-0eeb-41ca-a335-ba9897df70bd", "value": "C7B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737080, "uuid": "ac16ed30-bfe5-4b8a-aa0f-f258e34a20d1", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737080, "uuid": "c80d479b-752f-404f-8240-0ce4c06ab86f", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8b:t082TLrbNGoVMjPR5DxDRoFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737080, "uuid": "3931740d-46f3-4c11-a664-32537420006d", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737080, "uuid": "564b4926-9abc-40cb-b466-33e66a8b442d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737080, "uuid": "a8f03685-4cb7-4619-a4ca-a683059ea322", "value": "d68fd470ae30199285adf983ce462f660b8ff10008a68633a4946e5b7f3c940f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56fcfe2b-ce04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623780359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780359, "uuid": "165ca250-3821-4192-b581-a17deea4f411", "comment": "Malware payload (Mirai)", "value": "c54ed4121f7fb234f7c84e7a89678557", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780359, "uuid": "dee9301d-31b0-47e2-b166-c31329a7fb5f", "comment": "Malware payload (Mirai)", "value": "d6b046a40196bbc56dced0271745887529ce49ae7209cf7bc1a33abe1a891332", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780359, "uuid": "8d07f469-b852-4644-8c5f-b9786288af19", "comment": "Malware payload (Mirai)", "value": "86f4c1dc81a8a92683949dcfd27c9ad4320deaef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780359, "uuid": "a7d6c277-b919-4af8-8154-5ac663c6b6b0", "comment": "Malware payload (Mirai)", "value": "53b87977dcee63aa3bce490ab71139bd6a4f91a465ef0a2cea563f91e9cdcb7605396185187144cf3c9b23b14d051e6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780359, "uuid": "ece04a53-8813-45c5-b3ce-908758d3bb88", "value": "73D2D07866165097CB3EA9F82F7003910AA10F96DC97DC47728956CFEBCED5128927A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780359, "uuid": "9b1a13f6-85e5-4a10-834a-f6da1605458b", "value": "768:m/M2ZczvACRtOJFwt5r1hBGCd21z91quQ8WLJgGlzDpbuR1Jm:m0QczYCRtOMVxH21zW/BVJuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623780359, "uuid": "9993bbd8-a1c7-4056-bf2b-ee9b0f672d54", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623780359, "uuid": "62b65701-d07c-4dca-880e-2d437b27d345", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780359, "uuid": "b6f89ab9-694e-47f1-8b77-7bf325b914b9", "value": "c54ed4121f7fb234f7c84e7a89678557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a671ea-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737090, "uuid": "fb4392e2-31eb-4ca3-890c-a260c460a150", "comment": "Malware payload (IcedID)", "value": "d71d085ce957a2dbebb01851ded1ee15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737090, "uuid": "c058d70e-3d5c-44ed-a961-2bf1f7c3e196", "comment": "Malware payload (IcedID)", "value": "d711c6e6acfcefbffd4670fa4c37d3d2e722b86467b6ea50030a909d02c7d0dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737090, "uuid": "86845876-f35c-4fa0-b603-878de81585f6", "comment": "Malware payload (IcedID)", "value": "4ef0936d0748b838df00803e148d41411637a441", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737090, "uuid": "a9ee574e-88ad-4dc7-8cdd-dee01674fc57", "comment": "Malware payload (IcedID)", "value": "e3d90060791fadae0f5eb2642fc7a85eab62dd9ff7518eb157d7c813968603922c9851ecee9c4d3f7562b0578df8cea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737090, "uuid": "26f10c45-cd8c-402f-86fe-e1004c0f267f", "value": "E9B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737090, "uuid": "13d489aa-1635-47bd-90ee-b9a60488f780", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737090, "uuid": "d47c1d64-5a95-4a6d-bbb3-0e4c312eae49", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8+:t082TLrbNGoVMjPR5DxDRoFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737090, "uuid": "05203590-1155-42ae-8d1e-6ac8820c35a7", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737090, "uuid": "8ec0754e-eef6-4c9c-b741-5f535626bf60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737090, "uuid": "5d5ef28a-d764-41be-9b35-2a4050c2c322", "value": "d711c6e6acfcefbffd4670fa4c37d3d2e722b86467b6ea50030a909d02c7d0dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a439a334-cdbb-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623749136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749136, "uuid": "2f5933a7-b06e-47da-88ba-c8caded13251", "comment": "Malware payload (Formbook)", "value": "226d1faeaae4bc81b426b23a9bedce84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749136, "uuid": "d2f24c92-3a88-432b-b33f-7344fb92504d", "comment": "Malware payload (Formbook)", "value": "d71677cc4b276a3ecc1de38281a1d88410be241c11422b2b55147bede496355a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749136, "uuid": "449484d9-613e-44a5-8150-ac57e27b08a1", "comment": "Malware payload (Formbook)", "value": "6bd5ba824a22c026d3405eb3deb0c80f75392dc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749136, "uuid": "1ee406d1-bfd4-46b4-9de8-89a0608196f2", "comment": "Malware payload (Formbook)", "value": "51dbb159ba02372820dc0a7dd3c6e9f2e6d2d7bb8ebed30cdcffc86094cd6dc568b6518fdc0509ec5dd7106fbb29e1bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749136, "uuid": "3ae9d1e6-4c7c-413d-a112-6ff4c11ddb03", "value": "3F24126773D55CEBD2AA063004277ABDF2BBE7043A11015767182FF97874BA287237A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749136, "uuid": "8e9c9cd8-d854-470c-af9d-e140d415eabe", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749136, "uuid": "d1650a2a-4d61-462c-8ab6-6776dad7590a", "value": "3072:cLk395hYXJIM6lW4jxllbhZjwlgfS8avvJkDwIbosikaWSdS3CYyHQYGQe8yqs1/:cQqH6rvwcSFGD9bosUSyYe3JrtH4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623749136, "uuid": "bf4cb108-4c30-4f94-a1d4-84d9b68620b8", "value": 223047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623749136, "uuid": "a620b67e-f522-41b3-86c7-6afa7d2c186e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749136, "uuid": "3ff68818-6d50-45e4-97b0-1c809297f78b", "value": "Proforma Invoice & Bank Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c6aafa-cdb9-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623748286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623748286, "uuid": "13e01dfd-f24b-4b92-91f3-7a7ce091f9d8", "comment": "Malware payload (NanoCore)", "value": "f350445c9b0fedb0d06bdfd31b5db9f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623748286, "uuid": "32b66ac7-5a7e-4656-b464-cfcea398f3cc", "comment": "Malware payload (NanoCore)", "value": "d7f17241994b5a67b6cdca3f9ce24fa78aa1c66285d8829e0428c1f11eabb8c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623748286, "uuid": "a3f788c0-2d41-4269-8616-f65ab7a8e8db", "comment": "Malware payload (NanoCore)", "value": "1f9f0fe1327466778a65a5367fd41c81e6129980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623748286, "uuid": "0ac09571-a72e-4340-b469-0eb390b00518", "comment": "Malware payload (NanoCore)", "value": "95a6069d21b9d4076bdecc6ca42a7a5a31c35fa10aa93fff0cfbc5554c358bbd2a8c7fd9491a57c484ff650b5bab0371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623748286, "uuid": "5e5fa40e-7345-4432-a16b-da90d973c568", "value": "EAA4128A7C65C95BE2A4D4B9F95AC0FA46A3EC01C453FB270886FE08F5F3325F066951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623748286, "uuid": "048e3e95-1b65-483f-bd71-a4a43e0f9e5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623748286, "uuid": "7e030cea-fc94-45f3-9102-1b573df51b88", "value": "12288:xzDXDGE+3pox+uqcYEl6yokOdoWre/QPwaAG8YyP:xP6QcuJTokO+WqQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623748286, "uuid": "f21ae1f6-467c-46bc-9d78-82291fd70228", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623748286, "uuid": "809a295a-2b89-4d1f-9657-e70c7fc5157e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623748286, "uuid": "5b57771b-959e-40ff-b914-334c571daca8", "value": "Confirmed-New-Order_9875609987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51fe1a8-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623769324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769324, "uuid": "29c459e2-3ab5-4527-8e2d-1c7388776a0c", "comment": "Malware payload", "value": "52dbe0b06fdf7f586a7355fd2d888dc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769324, "uuid": "bd965f94-bbdc-422c-bd4f-20d9c005c584", "comment": "Malware payload", "value": "d80eac264e7219c150f99d9ce693215e5d09dad855c3d0e6fd49cebfaff68c40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769324, "uuid": "5f89fc9d-bf4b-4bdc-8c73-ae0d0e8b5871", "comment": "Malware payload", "value": "c4c6005392063ce996d27412a85a0b4c1a9101ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769324, "uuid": "f365d6c0-bb7f-43f3-a4ef-b899972e7fd4", "comment": "Malware payload", "value": "750de50a20c5da8e59b3343e1db92d492590415b67ec67b80a95585ddc6c00f7d207da7fc5b5fa8bb91528ae17d5982f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769324, "uuid": "2c3a4950-e7ae-48b0-9779-7b05759850d5", "value": "DB05CE522EA8AA99F0F95B31BDF0831203F77D127B27D3DD5E9471CD2867E808662346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769324, "uuid": "089dbad8-ab5a-4ee1-b632-c25ddd78323f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769324, "uuid": "fd0efe77-4a88-41b8-b055-736165bc2f05", "value": "24576:kQnkKcIOPIU0sNTF2TJY8tcYUQW+quPHpEaZM:kQkKIISTgTJYm0iQaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769324, "uuid": "1f84747d-9f7c-4667-8155-ba83c85ec76b", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769324, "uuid": "bc799ce0-d480-4d6f-bd20-4b3264bb33e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769324, "uuid": "57c764c3-756a-49c5-ab05-15f37e5a99da", "value": "Minutes of Meeting.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc6bc92-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623769342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769342, "uuid": "aff57d94-cc54-4f97-9ac1-940006bfd0cc", "comment": "Malware payload (Formbook)", "value": "917b13e826cba5be985f7267f9caa8bf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769342, "uuid": "ebb17704-508e-4aa8-8c58-fa1095c972d0", "comment": "Malware payload (Formbook)", "value": "d878c986c881314d4a826ea22d1e20532a0a7bf2787321dd34535acc18d5476b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769342, "uuid": "677cb6cd-df0f-47d1-b093-2c78eeb4974d", "comment": "Malware payload (Formbook)", "value": "f61b952ee35ad6312ead9731fd65ae70b559bcce", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769342, "uuid": "6aa03c0f-8f96-4074-be88-4dfd614ae8f4", "comment": "Malware payload (Formbook)", "value": "4c610864908087ae170554b676de973663d5058a32aee19e32ca68b498b81921244d53c1423ee7a42a6b1ababc1d18f6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769342, "uuid": "5d056e34-c879-4412-bc76-5ba2b20e708c", "value": "CB3423AAC6963D87A7122DDD3B69F03201F5CE162121FC04B63F985D05BBB3BE625531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769342, "uuid": "ce32ca40-f1ef-49f2-bf14-4b4b632ab0dc", "value": "6144:BoLrZEbbtG5iS1oer2Xi1+033j79HOhpu5hrM8MJH49m+XoAo3l:2L1HiSrr2y1V3T79u4oJY9NohV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769342, "uuid": "4035247c-bd8a-47a0-8813-46dffbcbe3cb", "value": 231477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769342, "uuid": "51517c21-00a4-4f81-a1bd-b26e64f98328", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769342, "uuid": "630d5a19-2966-4287-a204-da420ac9d98d", "value": "ORDER47gz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29afea26-cdcb-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623755802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755802, "uuid": "c7d25e82-7f37-4ecf-8e85-18feb9c6452d", "comment": "Malware payload (RedLineStealer)", "value": "796708f87e9e5c7a4e5673725a3e65b9", "object_relation": "md5", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755802, "uuid": "d1d9167a-8a11-4371-a2e8-d4e82d432657", "comment": "Malware payload (RedLineStealer)", "value": "d8a3df5d5ed44873fc091b44a64f98c6c54dae8356d747cddee51b88df9f1d2e", "object_relation": "sha256", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755802, "uuid": "d9d21c63-e74b-4102-8f7d-1c165bb4767b", "comment": "Malware payload (RedLineStealer)", "value": "afdc6f1a4c49795a9daaadc9f4586e57747d0c1b", "object_relation": "sha1", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755802, "uuid": "1ae45805-85df-42ca-99bb-7188e3720f72", "comment": "Malware payload (RedLineStealer)", "value": "1bc85d9607b153c7c4201433263357f5b52cf8fad752036b9f8e9dfc077f7c6ef835d568e7522a55d58a060245fb404a", "object_relation": "sha3-384", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755802, "uuid": "837900d2-30c3-45e2-b704-2adec0283ea2", "value": "35163341B6C4C8B2C572293656B9A7219A79BC301F3CCF9B939441ACCB746C0D736AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755802, "uuid": "80912d01-155f-4cf2-8022-f7a60cf910af", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755802, "uuid": "26cb24e4-99a8-4d8c-bf40-18959e498526", "value": "98304:UbODpoD2hPzo5q9Pc9aqheNRNoY1tUQrEGIkyZ9rR01gDn:UPDe9Pc9aTHNozljN01gDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755802, "uuid": "0927f397-aa5f-48e8-aaca-97199672dca6", "value": 4151622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755802, "uuid": "3b45863f-74bc-4e9e-902e-1cf3470b7be3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755802, "uuid": "8ba43812-0619-4a09-9bb3-2bce7480c14d", "value": "d8a3df5d5ed44873fc091b44a64f98c6c54dae8356d747cddee51b88df9f1d2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59b7402-cda0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623737676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737676, "uuid": "c6afaf0a-7f52-4330-a945-437b59de3d28", "comment": "Malware payload (AgentTesla)", "value": "417f01d3d5d3b5362b4ba8d4dba8b801", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737676, "uuid": "e5ff043f-a488-4989-9947-cc18575e3fd9", "comment": "Malware payload (AgentTesla)", "value": "d8c893be4e7ac028dd406a7592c132e9cd4868b829e0e415c2e97e039266d4cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737676, "uuid": "d7e2a883-7140-4d23-89bf-cda6c90862c4", "comment": "Malware payload (AgentTesla)", "value": "3b87ba510504c1bf51716882400100b70738e91c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737676, "uuid": "e352298d-b367-4ec8-99c6-563594943e84", "comment": "Malware payload (AgentTesla)", "value": "8049184de9710441206e6d64a783fe56b0a821c0cde582533e8730a03e2f28b1e0014ea0c14ce3fcf178fc198ff175d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737676, "uuid": "7d114472-5c09-42fb-9bfb-bb4d28701f69", "value": "784512A983E4849BE41A06711657AB3AE57AE31927C3630FB75D1F3E2B044C3CE523E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737676, "uuid": "683fd8f3-a275-4804-ac1b-9e18649894f3", "value": "6144:lQqJ+LeRXqpzjAGZB6t7ODDUVa5Qje2udbMUtCUOAxa:d+yRXKM7YQq2bUMUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737676, "uuid": "12a9d147-6873-47ba-a321-9928cea46545", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737676, "uuid": "4e3bc19d-14ac-4b05-a742-a70aca4de102", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737676, "uuid": "f1c3c73c-5ca9-4b95-a884-d192eaa96188", "value": "Payment66378.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e7a8ad-cdac-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623742622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742622, "uuid": "9c4b93eb-84ce-45cf-9f3d-00a8a69cda16", "comment": "Malware payload", "value": "74084608256e6e4c3434d17217d0993a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742622, "uuid": "505b8fc3-90cb-4df6-af25-6ec58de83867", "comment": "Malware payload", "value": "d944f7f322c1ae6f36f76069e6c9351d5b19e108b26460cb903aacd115975dfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742622, "uuid": "c5e058b6-f0d3-48b8-aaed-73d99e7bf05f", "comment": "Malware payload", "value": "92033cf08ae75949b8d6edc5652072592f85648a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742622, "uuid": "293d6fc5-b7b5-46ac-a3d4-150234c8d3c9", "comment": "Malware payload", "value": "501de1ceaceb244bac033ed0b37c87f2725042765458e4ad922721d808532132026167504c8410103e09de31cc3add5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742622, "uuid": "ccfa105c-151d-4dd9-809b-b1511e5970eb", "value": "54448E10ABA0C035F6F312F859B683B9A93D7DB16B2490CF56D51AEE96346E0ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742622, "uuid": "3b3d32f5-5c61-4f2f-96d3-362f5859af0b", "value": "ef577d56891015e5ade38c9833df8914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742622, "uuid": "735c024a-1cb1-46c7-980b-33f12ba73a8b", "value": "6144:+KUTMcenlwyBfnxtBOL+JHKKQz6MFn6bkT:+DTMPnjfnxtBOL7Pz6A6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623742622, "uuid": "187b9852-855e-4a0f-b56b-db3dff82fc0f", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623742622, "uuid": "78a023d9-d8c2-4e27-bb08-c30ceb086724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742622, "uuid": "c62399ac-9ac8-43f1-97a8-2ba30acbda03", "value": "74084608256e6e4c3434d17217d0993a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36ee4ef-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623769401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769401, "uuid": "a1611977-c054-4146-97d5-c512b3e57016", "comment": "Malware payload (Formbook)", "value": "71a6906c6b0e83d4f274e14934e1c3e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769401, "uuid": "2f241df7-5017-4dbe-abf4-6b0bedd2be86", "comment": "Malware payload (Formbook)", "value": "daa03acdbf0aefdde41f72f1432cdab7d036b0afc0bae22d37bb9f148ca8da3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769401, "uuid": "4f12405e-f555-4319-8ac4-64a5b0452156", "comment": "Malware payload (Formbook)", "value": "f88becc919606ef1b955c6d9498f622707044621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769401, "uuid": "ffe6fce9-9d65-4538-8d59-ed5d11d13c79", "comment": "Malware payload (Formbook)", "value": "b28ecc549a023523075bb1e245bd9b75435a04f901af9b9d65281a51d3ce5dcfe48eecf645c83f3cd271914db1bc5609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769401, "uuid": "577d345a-cd38-4c0a-ba4c-d3fcab35a76b", "value": "BD05CF522E986B89F4F99B34BDE0431603F77D22BB22D3DD6E8471DE5963E808721352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769401, "uuid": "072d6496-1bf4-4a17-aafa-a7e6446550e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769401, "uuid": "3c4efba7-c535-488d-a3a7-74dd9e732762", "value": "24576:T78ia8z5oy4fqN9scKNWd8RdX5dUquPHpza6D:Tva8dzPsQdSIna6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769401, "uuid": "45c0ff45-8f11-4f0a-b580-797a46053588", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769401, "uuid": "10285a22-d79d-40a2-86ad-8e24a7319219", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769401, "uuid": "71db1adb-df6d-4fc4-8e94-6e274338b8e5", "value": "Payment copy_MT103_9847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6f999a-ce03-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623779807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779807, "uuid": "5c998fbf-cdb1-4b9f-b637-6ecc89ab8768", "comment": "Malware payload (DCRat)", "value": "8282ea0066e14f2e7caf51b7a7d50dc1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779807, "uuid": "b5c1d19d-7e74-468d-8050-a37bf1c7095a", "comment": "Malware payload (DCRat)", "value": "db57de1bf0b133303c2325117a527f1586e4bf6af56219391a17095efb09cc76", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779807, "uuid": "9211de2d-4470-411c-a1a8-9530d7d6c410", "comment": "Malware payload (DCRat)", "value": "83c03517bb11c4ef01ced0b8df76cb35acbf4fdd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623779807, "uuid": "81378dd5-b35f-468d-8d98-8b5e9c4ef92a", "comment": "Malware payload (DCRat)", "value": "78efb56e4f6486eea04807a2bde85b0ef62f41ed8a5544ee7a90182b4ead1022cf9781cba245abffa3f27adf44328489", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779807, "uuid": "621c02bd-ab9f-473a-ae0a-c9da2b21d0e6", "value": "E9356B123A84E921D0795637D9EF45140BBCED007772DB2B7E9E33ACA9613936D0D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779807, "uuid": "008c7d56-4d92-4515-aba4-1591f7cf4828", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779807, "uuid": "6ada5118-1e08-4f30-a69c-7eab596756a3", "value": "24576:/2G/nvxW3WCEu8BWY0Iuz2LoUkM+kZfGBCfXppIaz4F+D:/bA3mVBdmvbgz4MD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623779807, "uuid": "934c56f2-0730-4dc1-9a28-77f328fc5509", "value": 1067085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623779807, "uuid": "2bb488cc-f2f4-486a-913d-6f5812e4e0f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623779807, "uuid": "d8e76465-acbb-4145-b7e9-736dc713e256", "value": "8282EA0066E14F2E7CAF51B7A7D50DC1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7c378c-cdc4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623752747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752747, "uuid": "f86c699d-dc36-47cb-b3c1-795d374f227c", "comment": "Malware payload (Formbook)", "value": "066ed53ccb7a45a3c3247eba0cc2470c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752747, "uuid": "dab4829b-8830-4463-b6ff-785760ed019f", "comment": "Malware payload (Formbook)", "value": "ddd223f17ec3ede6a3c5a87fee6cbbed45369c883e4020ac2c40ea44b2100c79", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752747, "uuid": "215264e2-aa6e-4967-a8d0-4a4edd88ad46", "comment": "Malware payload (Formbook)", "value": "320b5cb6fb88154da71486c75c15f71cc9c045d3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752747, "uuid": "a5e44c2c-f3f3-4663-b3f0-f9797d2e415e", "comment": "Malware payload (Formbook)", "value": "88917cbc3048960fb373531ff7519efa6a98ae7746c4c47ad40b7c71cae5ad0625fbb5a5bdf56aed5e222f594697ded4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752747, "uuid": "952fe6bb-06d0-45b6-9eb5-8cdc493100bb", "value": "89D433DE04E5AC5ADFCCE04741173A316ABD2A67A249901D4A2B8E778D1102FADD3E1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752747, "uuid": "7ce2096c-3429-46dd-ad9d-1e389a6aefc8", "value": "12288:Fktks1xicK8UQQU5Uh8HALM82MZ1IpGdziSLM3+seWbIV9kwIaJU1jMUQ:et71nXQU5Uh8If/1IYMFg97JUZMUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752747, "uuid": "adf2ff57-8bc2-41e5-bdcc-ccec028b752b", "value": 645101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752747, "uuid": "f4751405-ebbc-4246-9565-88bde891d393", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752747, "uuid": "f39a1b48-bf3f-43a8-ae0f-95981b6548b5", "value": "ddd223f17ec3ede6a3c5a87fee6cbbed45369c883e4020ac2c40ea44b2100c79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2209775c-cde4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623766527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766527, "uuid": "3694dfc3-60b7-4ce6-8af7-f47d768ff176", "comment": "Malware payload (AgentTesla)", "value": "047835eb456902b63eb14d9091a0169d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766527, "uuid": "08b98b16-e5ba-4d30-8fd5-9a56e84c892a", "comment": "Malware payload (AgentTesla)", "value": "de2e00592af25f6033e0b10dbf2974b1e482ad117118cb726892a89acf2cd47b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766527, "uuid": "e49d3239-189a-4257-89f7-ecd83c93930a", "comment": "Malware payload (AgentTesla)", "value": "94ac99f80936c0d6af4aeb804b6cd03b080a5583", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766527, "uuid": "fef7ede6-f472-4502-9891-7c7e7ee4cc12", "comment": "Malware payload (AgentTesla)", "value": "b7f255c198ace87581e52bccd282c3ddd10c886152b25c395e574dfeba3eb7f6bcd62f7e10286288f2b3e9ed93e2c793", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766527, "uuid": "44a53b51-7ace-481d-b18f-ce838ef13ed5", "value": "2F15BF512EA86B99F4F99B307DE0431603F77E227B27D3CD6E9471CE2863E808661356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766527, "uuid": "d1e46c13-1b20-4d6e-a529-bd34e8c5200a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766527, "uuid": "add49ae3-759d-4ec4-809b-a964cdceb48c", "value": "12288:ZYPl9MuQXvFmWifkN++85O7BTV5y/CIx1EOGTiRzc1vtRDBWVmm4wm3s/+iKE65G:ZQOMe3TiRY1vtRcwNgHKEuquPHpXa6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766527, "uuid": "e13cbb5e-48c7-4617-b13c-245cc60bffec", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766527, "uuid": "7bb3956d-2914-43d6-b05c-db33b72005f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766527, "uuid": "f96d0b9d-c2cd-4a64-bf66-1b759ef42971", "value": "Purchase Order#290435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c233217b-cdcb-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623756058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756058, "uuid": "edf35831-342b-4642-9d52-d76c7694fcbd", "comment": "Malware payload (Smoke Loader)", "value": "ba5f59b90d28e56e342eb5691116ed61", "object_relation": "md5", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756058, "uuid": "2fa32a38-5e40-4460-9e80-803b8880d4da", "comment": "Malware payload (Smoke Loader)", "value": "df00279749a73b854f3d6415a49e7cd0ea507b69b510d7505f2ca7c908d25a4a", "object_relation": "sha256", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756058, "uuid": "89f5922d-bc78-4cfa-baa3-4182b2bd4045", "comment": "Malware payload (Smoke Loader)", "value": "324dcd1ae37439d190e042188eacbd574d32f101", "object_relation": "sha1", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756058, "uuid": "f5f1471d-79c1-4822-963c-b73f8ac84a81", "comment": "Malware payload (Smoke Loader)", "value": "68fec03de90ccb8f9df6d346e8e908693d045a09ff6fa9143adc67ff5a9866eedf06f5cb26d6ed3001c51be2cec37759", "object_relation": "sha3-384", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756058, "uuid": "7a30d2c3-c0d9-495a-b2c5-9a1cb450513b", "value": "85549F2067A0C0F5F5B312F859BA9FB9A5AD79B06B3450CF53C12AEA17346E1AC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756058, "uuid": "593fc938-3ecf-42d6-aae2-d9a3e83aa22a", "value": "baa7acc629fae892f4f615c8c37bd06b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756058, "uuid": "8d5fae11-4057-46fe-ba59-d2e4499f83ab", "value": "6144:AFCtnUUv4/EIOLeEQYG4VYgLZIpWLTzCc:AUBUUv4/kKmfYWZq4zD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623756058, "uuid": "839d5f59-de52-4ea1-aa56-f8681e01ae15", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623756058, "uuid": "c59faeb6-1b30-450a-a6a9-cdb5afbe486d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756058, "uuid": "90caaa09-d3db-447f-922c-cd1978c9a78c", "value": "pub2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e61694d-cda0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623737503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737503, "uuid": "4d3b52ea-a1ab-4ff2-8d7f-e3366ab00604", "comment": "Malware payload (Loki)", "value": "0dc82a91ec2050d941c78aece31d8c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737503, "uuid": "eec48da3-f262-4763-a527-0fee1c799b53", "comment": "Malware payload (Loki)", "value": "df318af0f656e889c1022740a4d8f825ea95d4279371ed58b6859bc6f09b380a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737503, "uuid": "4e2f5027-2b72-4c83-8bce-9fffb3417ac0", "comment": "Malware payload (Loki)", "value": "e4ee97cf62174d130dd9a63206b47097ab8cc45c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737503, "uuid": "4d8a8565-7e06-4d47-82fe-35135ef3b539", "comment": "Malware payload (Loki)", "value": "f7dd7bbcfbb3ea5391f8fee5d3f941922cd3b1ef3dd30da2d6ff252b7cbce991f6d3baa18c554a4e85297ab0afbdb1f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737503, "uuid": "d7e4c9fb-b759-4ec5-8a46-a92513425689", "value": "E3254A9C7555EF9EF4378A3185549C20E613ACAF4627820BA313B67F6A3F3C78E141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737503, "uuid": "e3167371-7dd2-4371-8eed-d104e3d40538", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737503, "uuid": "1d2df76a-44c5-4aad-adf7-447e894e70e1", "value": "12288:GSqhGL64u9VCZ6v3ceUpNgmNmUFp+7lMAPNi9prcD+Nqc9bND94aNffVJ93RZFNo:k4+ZUtwUFgWRyEqcbND9tN1RIFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737503, "uuid": "45512ce7-8c02-40f0-8405-4f2e0ab87fd4", "value": 994304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737503, "uuid": "5637d8cf-08ab-44d0-ab4f-a22e9cf7c55e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737503, "uuid": "07d2ba6a-e9a1-4523-b265-a61fdb319e0d", "value": "quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50997ac6-cde8-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623768323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768323, "uuid": "adf4a79b-8458-4d85-973f-4198dd600bc7", "comment": "Malware payload (SnakeKeylogger)", "value": "6959e2553ed4fb04d8d998d6f60a990d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768323, "uuid": "b5d329fe-c3db-46e4-994b-63758c6e640d", "comment": "Malware payload (SnakeKeylogger)", "value": "e0a385605ffd09c92c19516d74bf5dca3c2cadf4e7a5767266faba30f923ec6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768323, "uuid": "1442ce29-14fa-4da1-8a13-5e4c85b6ac39", "comment": "Malware payload (SnakeKeylogger)", "value": "a3b0b9c36f8d295618c8adbeff2015a08aa623c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623768323, "uuid": "403c55ca-c57c-485a-8635-9511b3d2a34a", "comment": "Malware payload (SnakeKeylogger)", "value": "53afa937a9e1d5cfe5fab18bbebf048cb9cddc6c80119149d4051e8cb6ccf8cd73756136ddb7a89aa44297664083c8bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768323, "uuid": "2a47e1ae-5ac3-44d0-96f8-4cb42a23bf91", "value": "F3A423473AD8B8B7FC670F716777EF78C3BB2916119049ABAB2D6FA90E001451903627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768323, "uuid": "f999f6e9-56a8-4c6a-a718-87855c314a16", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768323, "uuid": "b17b7b7e-9d30-4c94-bac7-0cca44f352a4", "value": "6144:cQqHV63WLdH7qEF5z36zY5MWwl3lcoBlEam/Af6s4l4pE+RpN4YjjkpdA2oK9YyB:mcGL9qEfbdSfcEzU254iBp7kpSahSt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623768323, "uuid": "81c4785b-e88b-4ca6-aaba-4c5d545c345b", "value": 455285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623768323, "uuid": "d672a018-66d3-4da7-92b6-c4c07493187f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623768323, "uuid": "f5544f5d-1e09-4463-a6e4-ea187704daec", "value": "bigfish.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755ee9a0-cdfd-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623777404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777404, "uuid": "9296ca35-4ef8-401e-a7f6-20ca56a4a286", "comment": "Malware payload (AsyncRAT)", "value": "4e28ae9224a2c9765351b387dda9fbee", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777404, "uuid": "897f2d1f-b104-4359-87a3-71c8d3a23da3", "comment": "Malware payload (AsyncRAT)", "value": "e1ff405eb4bd0d3b159bc9d97006b59630425b21bf95eb48c5491d15ff35cac7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777404, "uuid": "ed3f4073-5e11-4b76-a94c-0ffbe53ccb38", "comment": "Malware payload (AsyncRAT)", "value": "0d06db6338a22f9c3c21688c57d213a395b6e91a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623777404, "uuid": "24364470-e819-4c17-aa0f-accf4dd601c0", "comment": "Malware payload (AsyncRAT)", "value": "fa4a005dde58997a8bdcef05ffa93ab7c15a6a139b5155891622faad674fae05f9e15b1b98366ccb700a233853e358ab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777404, "uuid": "7793ac49-d3c5-471f-a18e-c449c1e28b02", "value": "6D231C003BE8826BF2BE4F789CF26105457AF6B36603D54E2CC452D75713BC69A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777404, "uuid": "4e991fd3-0759-4eb3-9de0-22ed6db62b35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777404, "uuid": "6b020d28-65d9-4944-9568-c726e73d3931", "value": "768:XuScq5TAYGTqWU8j+zmo2qLy36tEaOPIWzjbngX3iymkGBDZPx:XuScq5TA5c2qEa3W3bgXSymhdPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623777404, "uuid": "50342f70-31ca-4dd9-8ddd-ed0795026370", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623777404, "uuid": "87f4a7a6-241e-4144-9ead-ea7da6a11703", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623777404, "uuid": "cb3ffbae-fec3-4a0d-85ad-68f39d2a5c72", "value": "4e28ae9224a2c9765351b387dda9fbee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237366ce-cdcd-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623756651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756651, "uuid": "0945d4f0-eb4b-4de6-9fee-f31b630b8c82", "comment": "Malware payload (BitRAT)", "value": "c3b423f4e55cf67efe89633d97f98b7b", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756651, "uuid": "d385f8be-d327-49a4-b4f3-2e5c68f83115", "comment": "Malware payload (BitRAT)", "value": "e22de3f4a2900f29ec488b042714ef75f0b0d51e9bf4a8e7e47f5cf9d7722521", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756651, "uuid": "5aa53e95-6dfb-476e-bba9-fe27b5a5c9c1", "comment": "Malware payload (BitRAT)", "value": "e838cb2ac52cdb5396b87be7d4564174af7065fe", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756651, "uuid": "23182de8-e121-4c8e-b830-ff194aea2428", "comment": "Malware payload (BitRAT)", "value": "863ca715fc7b01d8e8421441a8f001d066f64c042fdf267c0d7cf197eecc8ecb2134815da0b8790f0e9f9fce9242ee09", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756651, "uuid": "338dd188-9ed8-4650-85d5-9aae37d83760", "value": "2FB5F00AE4E96134DDBC837F5F5E21712E2A9F43AE29C1449CC4DDD061BE193A6F8C4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756651, "uuid": "7215a81f-7c69-4825-95e5-55a83882e2ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756651, "uuid": "aeac49eb-64b2-447a-9e8d-924da210e1a7", "value": "49152:4dg6mubDX1YCNQ57Nt6hjutLoBqHgPyYs8pjrc:ybDXa2ONtIjRbI8p8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623756651, "uuid": "b9174952-6d31-47c6-8867-fcafb48e76ed", "value": 2432512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623756651, "uuid": "969bd0f3-68ef-4601-b397-c086ace1a472", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756651, "uuid": "9bc86723-8e67-4486-8ced-a7db95df990e", "value": "C3B423F4E55CF67EFE89633D97F98B7B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea809274-cdce-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623757414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757414, "uuid": "86488dcf-ad20-4f69-8bec-ebd8becc4c79", "comment": "Malware payload (NanoCore)", "value": "3f9df09586e5a7ce4e32246a8b91668b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757414, "uuid": "81c73fb4-3bb4-4751-b7d9-07bf0a20ba82", "comment": "Malware payload (NanoCore)", "value": "e25b1b6a451b844ab44000424c27db5f3b9ed47c6a6e627c06d5704debbae9f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757414, "uuid": "7613171b-3280-4166-acde-e7a4d0c5e8b9", "comment": "Malware payload (NanoCore)", "value": "5455cd31d4a66b66cff0cb5a073119016f897832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757414, "uuid": "f5928278-df42-4f38-b85c-50ea397ba156", "comment": "Malware payload (NanoCore)", "value": "3af2657d01ab734bb3afe39617e7a70ba6c65acdee8a1a8880586e716e8d3a02ad403d7c4e4fc1f439270889f0805f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757414, "uuid": "56db2fc9-2e1a-4847-b90d-f4e916b9f39d", "value": "F2356C9C7545EF9DF0778A3249488C20E227ACAF4A17821BA363B67F5A3F7C7C914065", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757414, "uuid": "fdb1a4d8-56e9-4276-bd16-624751d81b6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757414, "uuid": "b1b1e8ae-f42c-48da-8072-7e0317fbbf24", "value": "24576:z5QegundQePUX7g2Y2dT0u/4KU8qQsLIFW1:a9undQBXTY2d5/iQyIFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623757414, "uuid": "c8d53269-50ea-4741-a347-dc7208af7831", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623757414, "uuid": "b082b92a-eb56-4fa3-9ccc-f1fdac37b7ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757414, "uuid": "5049cf73-b83c-47ad-9910-b679671d318c", "value": "contract_proforma_invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032fcf9b-cdde-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623763898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763898, "uuid": "c2dd0dcc-ffac-4138-a392-9cb15f31c32d", "comment": "Malware payload (NanoCore)", "value": "fab5f62d7cccb04009882df3efd99c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763898, "uuid": "3aeeaedd-2f71-4a91-be58-dd3b565a1c4d", "comment": "Malware payload (NanoCore)", "value": "e2898c2cc79b493fa36f191e1c06623517bf82454de9ab073d4c630563cfac06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763898, "uuid": "b172dea0-763a-411d-872f-497c879dd87c", "comment": "Malware payload (NanoCore)", "value": "a4ac0edade8a53a161229306cc6055430db6dbaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623763898, "uuid": "332a0af1-ed33-4657-bec4-b7c8aa5797a8", "comment": "Malware payload (NanoCore)", "value": "4b2c76f96df81d3f72f0f3eb7aa373a629a3ff71141c17f6b84e4cf9a7347b459b068aa5ac9c4c21525574ca56c57b95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763898, "uuid": "0a48de4a-5b5c-4f04-b0e6-6cb178be07f2", "value": "D2E47C83B584254DF8EE87BBB5D94A25D6E51C5B0843D80045B13F85BFAEF8287C0A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763898, "uuid": "548416fa-9ec8-4181-8023-c34c98dcc337", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763898, "uuid": "fb646fa2-1747-4972-afc0-89fabac1fdd9", "value": "6144:8MpLnle0Ijtf84uZKGivRu13UeCfvfRpS4tqWbcImoIaUurpOCUZ3GWyCNHpIjKw:8MSVBf58MZp1xICr4PPBTIjnuxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623763898, "uuid": "9a46c13b-27ff-4190-90dd-91f5fba8df7d", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623763898, "uuid": "b78c13c7-77a3-4751-849e-7d24c85dd613", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623763898, "uuid": "de989e80-6d8a-418e-915b-76229fc0c404", "value": "fab5f62d7cccb04009882df3efd99c8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649fc523-cda3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623738721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738721, "uuid": "4604abf5-997b-4d94-82c5-ce2058f91745", "comment": "Malware payload (AgentTesla)", "value": "6dc2948da6f9601c4f389df3c134e218", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738721, "uuid": "39356180-b341-4bb1-a289-e8973608c6f3", "comment": "Malware payload (AgentTesla)", "value": "e28d5254f259f021ad807092189fc8d60c8de80213760094fe2a9eddab2fc159", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738721, "uuid": "2d879342-669a-4c3d-bf6b-9c6f56c67778", "comment": "Malware payload (AgentTesla)", "value": "3222d6888df86f9c14af14aca3ba6f859ed7fb46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738721, "uuid": "26c3048a-4f87-4d5a-bc2f-da50b3e7689a", "comment": "Malware payload (AgentTesla)", "value": "24116523428edb3dce6d6f165be4cea7379bff9fc50d2bc60899d4bf2f7050d7410040e0b70be0cdbb3a2c9ee8a5e706", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738721, "uuid": "80241f33-79d9-4dd3-9daf-96096e941ca9", "value": "5AF4BD9C954DCFA5F47B1B340450D210926BADEF9522DA0EABA2F77F2F373C28119261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738721, "uuid": "2da893a9-9b17-4c0d-8199-6343c50871a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738721, "uuid": "c53e98a8-f696-479e-a45d-83e3f800bff0", "value": "12288:OcqB9VCZ6vtjYJJrKVwN3xfNbVPqeie0i/1U8h9WegkLPPPPPPPPPPPPPPPPPPPY:Oc0tjYJdKVwJA6n/1US9yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738721, "uuid": "647a9f69-4a4e-45c2-a3fe-ea5b79253a87", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738721, "uuid": "9146a3ae-8937-47ca-a029-174ae3a046c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738721, "uuid": "60f4c839-b761-4cf0-846b-88fa82835d10", "value": "6dc2948da6f9601c4f389df3c134e218.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d52d51-cdd1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623758480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758480, "uuid": "1e30671c-3379-450c-96df-972b62bdb2d6", "comment": "Malware payload (SnakeKeylogger)", "value": "fa9a413bc3541816b92783db05d6e808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758480, "uuid": "9a5d3b78-6881-41cb-985b-dd118e0f5316", "comment": "Malware payload (SnakeKeylogger)", "value": "e2cce43e425c6b7319d6ea0611291a1a6840d2e7c9ec268e0a13d31f5eaf4d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758480, "uuid": "e27a0774-65fe-4a71-871e-815b798170d4", "comment": "Malware payload (SnakeKeylogger)", "value": "a6880f8d6c7c3e040cf524ff0969897741e44d22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758480, "uuid": "05436298-2afc-4dc0-8d20-f1324fdcabe4", "comment": "Malware payload (SnakeKeylogger)", "value": "9a31b6ee9181eddc48213aa660e3b194448ed1a40918bf535e1175d99f3a044fa3b41ff303610bef41899b82fc631d7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758480, "uuid": "a673e64c-75fb-4fe0-986a-e4bc18d1fb0f", "value": "06254A8C7555EF9EF4778A3185548C20E513ACAF8627920BA313B67F6A3F3D7CA041A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758480, "uuid": "5ae3ecd1-c9f5-4279-95e7-f6e496e15e73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758480, "uuid": "d069bd75-327a-4ea0-93d5-1666d2b32e3b", "value": "12288:mNy9VCZ6veeIuyAY60avoFT5glBLgHCvADR05OKL/pgXpXJ1Of4w2vtwuvJGiVK2:1eeIPAY6sFTYgHCYdnKL8KIFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623758480, "uuid": "4e815cac-00e1-47fc-91da-8b57319a8895", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623758480, "uuid": "f1f19814-e2d4-4ae3-97b5-466b771b6f62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758480, "uuid": "0865b2d4-0ced-49aa-9d79-24c2113f7fd2", "value": "Swift Copy Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce98e94c-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623769393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769393, "uuid": "b9fc1f5c-2d77-4fd0-9a36-a29e61fb35eb", "comment": "Malware payload (Formbook)", "value": "836de5f13a8a87c65f65c8f02de47936", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769393, "uuid": "fe262269-a38f-4cee-bec4-9c63b861b998", "comment": "Malware payload (Formbook)", "value": "e2f180598e28154235e9b4fc7df82f747f4b7bd93c74191644e4ad74fe669d27", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769393, "uuid": "913c14fa-28e6-46aa-8d29-a47f66b049e9", "comment": "Malware payload (Formbook)", "value": "326ee3fbe62032ca1b03fc64b1d2b5bb04efc241", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769393, "uuid": "adf4f724-455e-492a-8d04-3d410ba4c7ea", "comment": "Malware payload (Formbook)", "value": "853efa8502e8682021ca166dac0efa50438efd0bfba3e2688adea5c28d1abbdd847fcee480582880cdffee92ae8993dd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769393, "uuid": "cee37805-e92c-4e06-a81c-ad315b0f0414", "value": "F5D42315984516A1FE5E599596C0BBC8AC4E60B3FC71F17BFABA033EC2F14401B825F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769393, "uuid": "f891c426-c6fc-4aa9-b228-8289caa3b299", "value": "12288:cRxNc9u+dkwbqm+Laz0AT9Nmy8qfCnqWexR+aevsxKN1EdDZAR0WXfZHKnlA0hQ9:cRM0DazRWyKnqVRmcKN2duRFXfkA0ygO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769393, "uuid": "ff4779f1-baf3-43aa-87a4-c6f3202ba582", "value": 650122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769393, "uuid": "0be853a1-23dc-45c5-975a-8cc78e5bedda", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769393, "uuid": "7475d06b-b8c6-4fbe-8d5f-5b22eb8c0d27", "value": "Payment copy_MT103_9847.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ad978c-cdc0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623751224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751224, "uuid": "96521ba3-a15d-4358-a539-0759f494f8d9", "comment": "Malware payload (AgentTesla)", "value": "efb321c542e621662705c0d6e92ef516", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751224, "uuid": "78deeb4f-1a22-4766-8084-6780a59df618", "comment": "Malware payload (AgentTesla)", "value": "e310c6b4b1aadec0f91646dc9e36e1b36b8f74e9435dd5c2d5cd92cfbecbe7a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751224, "uuid": "08e193fe-8159-43e1-aebb-acdd8f3b7070", "comment": "Malware payload (AgentTesla)", "value": "fc7d2f21038b88eb2715b018bdcda50b2da6565e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751224, "uuid": "86077281-0fa6-465a-871e-66ee45971bdb", "comment": "Malware payload (AgentTesla)", "value": "60f7a0a76d7d598fe90e9ba2b8c7a23899ddce1529f077414b56a720d84c682141c57c8dfa80923e6a82c8117afbf723", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751224, "uuid": "b02a1491-e39f-4ce7-be76-4a87915fd01c", "value": "9F25CF534ECF826AD2744DB66731AC8782325CAA294873223EC075BDD9371EDD8EF911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751224, "uuid": "fc251d1f-c69c-48e5-b7c6-07eb96bcfecd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751224, "uuid": "dd6c190d-3fa9-435e-9c8a-2cb9a9c23b37", "value": "12288:x9uSMPQipP5fIG50xKpulWTfuJKVJi90aF8CjSgH9fOzeic20AVNbpN:BipdIG5OKppIw6F8Duuy8NlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623751224, "uuid": "2a25b7c8-0f09-4193-831d-e2530a2550a8", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623751224, "uuid": "59751892-6f45-4909-93c7-473b00dd6872", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751224, "uuid": "948ea629-e350-4730-be8f-d2663fdf9b32", "value": "P.O ENQ_AQT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de12f03-cdd9-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1623761956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761956, "uuid": "a2d3036e-79d3-4dff-bea4-2508eb5740bd", "comment": "Malware payload (NetWire)", "value": "a8b3700a836387c8f76f6619081970ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761956, "uuid": "788e4d6f-1644-46f5-a858-1f87f23b848a", "comment": "Malware payload (NetWire)", "value": "e3b59ad472a4da79d33cd1b994394f9d405befb76ba377d1763010ecfb4c2591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761956, "uuid": "6dc1bc0a-7fc7-4c07-8c9d-cc63d9e1138b", "comment": "Malware payload (NetWire)", "value": "e881c886aeea80b685b0334f9cc882992033166f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623761956, "uuid": "ee9ed68d-901d-4cf3-a606-b79417e13ea6", "comment": "Malware payload (NetWire)", "value": "e6b68e6f42c349d39a509098dc20423b7c604e1611293a05ba4a64b7bd80e95ce47adec961524fba11c1a038f1ab303d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761956, "uuid": "990d93b9-cd49-4091-8b61-fc44e231dcee", "value": "3215AE575ECF57AFC5598CB69B30AC56C2311CBA2609A3122DC230BDD93F1EEC99E412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761956, "uuid": "0488543a-ae96-4d78-870b-ac11a92160b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761956, "uuid": "7b51a790-1874-4980-9fae-ae9c07de0f6f", "value": "12288:wXi/qvSMPQipP57iyzvaOUjNNdapQ20svjUKzMtJr9AOcSlpGdatkWOooY9fs1+d:wS/qyipUyF2zA0sJCAOcSLGdatk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623761956, "uuid": "c056a881-ea4d-4e02-ae47-1e36d29c2281", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623761956, "uuid": "d65d3954-685f-46e8-8968-e81851a01c1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623761956, "uuid": "b1cb95c3-6293-4200-86bf-606a4e3dc91f", "value": "Payment confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a490b8-cdc8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623754854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754854, "uuid": "173dbe87-cd1b-4ede-9a35-0394c5c01eee", "comment": "Malware payload (Loki)", "value": "ce51f15d31008c3606729b00036fe841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754854, "uuid": "2232182e-8923-4df6-afc2-6e743b37d46a", "comment": "Malware payload (Loki)", "value": "e4effdebb79bd1b3d2e3a2510a96f44cbf9ca4961340c7ca1f276bd3c527afb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754854, "uuid": "4e3b86cb-96bc-4cb3-9438-825b92c33fa7", "comment": "Malware payload (Loki)", "value": "9ed0987c6a26f61afb6fa772dce9b4a6ddd9090c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623754854, "uuid": "9b2089a7-cb0e-4958-a375-a0cfaaa5b2e9", "comment": "Malware payload (Loki)", "value": "e932f1855fda63c53e72e266c58990b01fef440b064728730307709e844e86ef7391857b363a01b9db9a0378963475ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754854, "uuid": "679e5fc9-5338-4332-be81-3480f7d3b33f", "value": "8AE36C56850896A2F3770136FA2E0B7E25527C622D439E073759BF9F39342D3C9B8326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754854, "uuid": "070b0acb-3f04-4745-a591-c33b6aa26f27", "value": "646b0badad20ba025cd8fef6f59a6973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754854, "uuid": "90a3c8b0-e0c1-4646-b77e-fc73f3c2b0d4", "value": "1536:hCcQYhjIXnSCSv+0fYB8C0By866sqptPDe9bHE+ksxuBv:YcDgC5fYSCA7De94n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623754854, "uuid": "a65e6e2f-a998-47de-b3e2-d45ca9faf073", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623754854, "uuid": "c9a1bb18-8ac0-4be6-abee-4d14c36dc0e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623754854, "uuid": "c3ef2eb4-c85c-464f-8f1d-65a50a8dcf19", "value": "RFQ No3756368.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a732ac5-cd7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623721605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721605, "uuid": "4afc873f-1f78-4a7f-b8a3-444e34db3720", "comment": "Malware payload (Mirai)", "value": "8b7edc6e075ee6693b802ab333ac3496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721605, "uuid": "3c5eeaa6-462c-4077-b187-8c61c8749611", "comment": "Malware payload (Mirai)", "value": "e698fac919dfbd75eddf77c9e56f309c5200840397e0067f9931d248d8bbdcbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721605, "uuid": "d861918c-633e-4264-acff-c84a86bd1beb", "comment": "Malware payload (Mirai)", "value": "131e4fd9aa37b5e4f97108bd2385d359c4fe0dbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721605, "uuid": "a6da315f-615a-4ecb-9a53-b78af9b7d91c", "comment": "Malware payload (Mirai)", "value": "28c1b9d5b9a1d41805cf92cfaefb84088b992fe94289ac207f26ef35c2d970cb12cdc772ac0878fb52721b6bda45dbd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721605, "uuid": "012df6d1-497f-4942-960a-fdef985d40af", "value": "2113755A2E628FFDF66D863087B74E21939873D226E1C680D25CD9041E7034EA45FBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721605, "uuid": "8ee2dc6f-37a6-4e3a-8f36-a4802e05c3c8", "value": "768:g+imbAjkJ25rC0OWFVpNUk8CAoYI6Di2hKHriGrw4QIeXK:limnA8C9NFryIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623721605, "uuid": "f9873580-106e-4284-9884-b3e67d8bd48f", "value": 43036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623721605, "uuid": "10883972-c094-48a3-b494-7255cf33739b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721605, "uuid": "57866430-2204-482a-9b00-daf23f101f09", "value": "SecuriteInfo.com.Mal.Generic-S.31540.15179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c849ab9b-cdc3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623752632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752632, "uuid": "34176c68-9473-47c8-9e50-9cf1ccdd567f", "comment": "Malware payload (Formbook)", "value": "cdb040f6a70dc3336d5dbe7dea8752f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752632, "uuid": "18aa905f-f69c-46c8-83b8-74a47724a590", "comment": "Malware payload (Formbook)", "value": "e6e7575f09a3e973c9b315f3206448f9ddd04b3b8ca39d126e02bad763a17948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752632, "uuid": "4175fa05-54e6-4e21-b8a5-92c80bc8d64a", "comment": "Malware payload (Formbook)", "value": "e57237b6a9c5524556a1c16399ba21d50284b905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752632, "uuid": "bf2b4f37-0843-4b5a-95a4-eb80d1479b99", "comment": "Malware payload (Formbook)", "value": "d72181d5fdc7d598a25d9034008a6609f568ab1fe1af0204f36d79ae136ddad850b6d846895fcc60086ad68cf0ba5575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752632, "uuid": "ec244642-0388-47b6-8a10-a9b2c3c3ca6a", "value": "7D34125270E488BBE4264A3455B15EF2D3F67F322E21265F2BA07FFB61321C6142D1E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752632, "uuid": "b6c79c36-b796-4b69-bec6-baa6228cd241", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752632, "uuid": "74c27df6-107b-46a8-963e-d4d8210a6362", "value": "6144:TsMvvCfZcY2/RIXQoDjGCla5uxmG5FlaBjKuuqAxIS:Pvqhw/RIXxbocxrXaQuWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752632, "uuid": "aa972325-0bc3-4dc0-8b7c-f0a7b6c648ed", "value": 236118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752632, "uuid": "492eee96-acd2-4b02-a26c-87d6020f3e67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752632, "uuid": "8bdc16ba-9e8d-42a2-97c6-362452ac5d89", "value": "DocumentCopy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3814d14-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623736384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736384, "uuid": "e30f6bbe-39de-471c-bbb5-24954be2ea8c", "comment": "Malware payload", "value": "785a3049a5595ae2856ca31bb1bf0b7f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SCB", "colour": "#46EB55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736384, "uuid": "1cf92968-ecfc-4a23-a24b-571d567a35ae", "comment": "Malware payload", "value": "e843747665a863627f6c6fbe8ee079d4662cfb7883e23280d21c1d95431d5534", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SCB", "colour": "#46EB55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736384, "uuid": "27f49e13-5231-4e9b-b0d8-4d9c673b89cc", "comment": "Malware payload", "value": "cc0799381dd6dcbfa03f1a428c85316b28bde67b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SCB", "colour": "#46EB55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736384, "uuid": "0fc535d3-1222-4056-8f7e-2072a35e9c7b", "comment": "Malware payload", "value": "7fd6d97423b9613f9e73739bf49424e6058bf505fa1cc37eb77959d211bc98bed0afc77d11f6d3ff4db0c15a95b41b6b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SCB", "colour": "#46EB55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736384, "uuid": "26f6e9ba-ce34-46c9-839b-1e8c362749a2", "value": "B7710BEC23FC09B5EE4E46EA763FFD6041CAF443C6D64A58715DD8D103A63A5A431C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736384, "uuid": "6e2d6f4d-f65f-41d7-8993-3b51f4ea2b6c", "value": "96:d93C+lBEKiLNYhQsUW7YARmDWRQ2EP/th:d93ze/YUW03th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736384, "uuid": "bef98463-20bd-420c-a9da-7180393a0ea2", "value": 3531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736384, "uuid": "e1a5475e-1440-4c86-a406-1ad370fcbb79", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736384, "uuid": "648e614b-1719-411c-9381-daaa0333b7dd", "value": "Standard Chartered Bank Advice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3ef70e-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737098, "uuid": "fe9b6d84-2f48-41c4-9de2-40d4606f3353", "comment": "Malware payload (IcedID)", "value": "6e979e6b474f6738e0bae4de335af52c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737098, "uuid": "fed5a030-ec07-4a57-9dc3-c0719fc6a71a", "comment": "Malware payload (IcedID)", "value": "e8b85cb54bde52d75b6ca9ec418fd38ffb135f01a0533ccc7b15c0817f7b427a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737098, "uuid": "ce2c6db0-67dc-43a9-b137-0e2bbf5efe46", "comment": "Malware payload (IcedID)", "value": "9d1e5aec71cad4f41be21919c734264e1b31e058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737098, "uuid": "a4d89303-af01-43ec-9681-820385202cf2", "comment": "Malware payload (IcedID)", "value": "a985d3ccf601b131d74856d6a64ccfe03bb28874a964234e09f9c049f1b7803fa5da8bd1d60419ebe457e055cba7390c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737098, "uuid": "b52f70d3-fe5f-486b-9bd7-f5f9c682332f", "value": "CAB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737098, "uuid": "3bf6cb42-4e1a-4ca2-bd04-417303831a6b", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737098, "uuid": "841d5cd0-7449-41fe-835e-f4c689240c03", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8F:t082TLrbNGoVMjPR5DxDRoFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737098, "uuid": "7d4d2ece-12d8-43c0-b205-27e1c6027442", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737098, "uuid": "00d39561-5cc8-4214-997c-172dbf5fadfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737098, "uuid": "b8c929a6-63b3-4235-a380-cb36d10daf52", "value": "e8b85cb54bde52d75b6ca9ec418fd38ffb135f01a0533ccc7b15c0817f7b427a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c51e60-cdcf-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623757864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757864, "uuid": "f8aac4a0-af11-4a67-a51d-c31e8c46fecb", "comment": "Malware payload (SnakeKeylogger)", "value": "8a9babfc6f607d4225180776c608c3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757864, "uuid": "64a01626-fd26-409c-92ce-1009f5fd6b69", "comment": "Malware payload (SnakeKeylogger)", "value": "e8bc94b0faea9886f1fa39e0e9f609f2f266b3d7d812faad4b2ae9904b170b00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757864, "uuid": "af7607ef-9b2c-4daa-bebe-c6aafc0a1b41", "comment": "Malware payload (SnakeKeylogger)", "value": "0cb8116bf3b893a38e7b5d91c4ff74f99e052133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757864, "uuid": "636fb212-63b9-4c19-850e-c03d67b1519f", "comment": "Malware payload (SnakeKeylogger)", "value": "2c3967cc5cdf3bcf6063dbbddb629d7bbd4ed8e23f63fa3f562eec7963de92ab1669a735ff5b95133e1db6a1a97b9a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757864, "uuid": "d37c1d2c-4fec-4e76-ba77-6d97e8202b0f", "value": "02A47AD9A882D052D63C0E39CE91D7CA5357AE02242E787A2EFD3685167CC97D0CA7CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757864, "uuid": "10714b29-0cba-49b8-96b6-21e141847fd9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757864, "uuid": "b875fbe7-f6cf-4d68-907c-913d5ba5ca41", "value": "12288:BWSRvhe4HEpSXBMvq05C6qEyl/+0UJCqf:BWSF9Kq0vq3/+f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623757864, "uuid": "12cea264-6dd6-4af6-a5a0-dd25fb8daaf1", "value": 487336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623757864, "uuid": "e1623388-cfca-446d-a10e-f195c19f827b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757864, "uuid": "bd36d279-846f-42f1-9ace-fbacca9b5052", "value": "090000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838593ef-cdff-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623778287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623778287, "uuid": "07bd8feb-0629-42d2-ba4d-aea2cd4998f6", "comment": "Malware payload (BitRAT)", "value": "7548f1108fea0f9837f1201eae3f4eb9", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623778287, "uuid": "21eb0e45-3222-41de-9fd1-2dd1a900a094", "comment": "Malware payload (BitRAT)", "value": "e920375bbbf8ee91b981fcaa92cf542edcc66b603f33fe888bf0056375a3af27", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623778287, "uuid": "e4f0af30-636f-4182-9248-924401e55576", "comment": "Malware payload (BitRAT)", "value": "19136b576d3f258ae9071968e2f127c45ee47851", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623778287, "uuid": "04d693e2-4838-41d9-a853-3649eadc8e72", "comment": "Malware payload (BitRAT)", "value": "c2ed190874c973ea0d9ebd955858fd9c8618619d87c64bf810d1101f1b12f3989dbbba0eda5a6ba54c7842c70965048b", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623778287, "uuid": "9563d9c9-e288-4a84-bd8f-e7a0b189f44d", "value": "FA6533F682129027FE5CCA7C76116F3A1522856393BD73E23C8F85276E3C25AB941C76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623778287, "uuid": "dee63784-a31e-4489-85e7-dc08f23bba29", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623778287, "uuid": "9fd5e9ba-9013-42de-8c6b-04f712ef3456", "value": "24576:SJmQ3QWWrDXNmFyC2SadnEHgeJhDIZyHvoUdEdNH4Nh564YI63PJGk3msd:SqrD9TC2SVACoUe91JxGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623778287, "uuid": "cb3adead-8f60-42ea-ad05-65e63ab7c356", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623778287, "uuid": "638cb72d-612b-4f96-8980-429d43f32bdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623778287, "uuid": "4a1fab1a-5e05-49e5-a032-e603ef41f26f", "value": "7548F1108FEA0F9837F1201EAE3F4EB9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e579945d-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623736360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736360, "uuid": "b357cda3-0250-4798-a519-780866b0f315", "comment": "Malware payload (Loki)", "value": "b379e19d45da62008667f67e9fcd48bc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736360, "uuid": "1064feb6-9d53-4d60-8292-30ccd362fe2d", "comment": "Malware payload (Loki)", "value": "ea29d81a2564ad39f91e61a5124b47927fd3612f69840a39fdf26bb5f923a314", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736360, "uuid": "0c898366-7ea3-412d-a8ea-d66691f61bb4", "comment": "Malware payload (Loki)", "value": "383b70d823db6fe7ae00c2b0c1afd234f965cb8c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736360, "uuid": "489dcf31-5527-4e67-97c5-3da2c88a3a2b", "comment": "Malware payload (Loki)", "value": "860de54a3dd1b3a960f8dda11604df4f7e51a0dd88f828f7c7eaf8f6be25fd87e4df1c908f4102a3fa47a3201a8a826e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736360, "uuid": "6626b2ed-024f-43d5-b563-7e0b1cf8fc38", "value": "E935236A2DD2CF33E50F1530CB66E1D8910A8CCC5754F84E8B01B69D7276635A7F2E26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736360, "uuid": "c80be507-97dd-4d94-a79b-92ead263f04a", "value": "24576:zKXV9GMwu88WW2ENFqV75JA6xKR+fRuoVQxXWLg:2l9GMm8WWHFuw6xRKxXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736360, "uuid": "ae7561f9-3dee-4d1b-92bb-d6e25387c004", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736360, "uuid": "424217bf-9301-4bb5-8237-116f2f46e752", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736360, "uuid": "feaab4e2-020f-48b6-b1df-ffe55697ef18", "value": "vbc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015fb7dc-cdc4-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623752728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752728, "uuid": "453d8c44-ac8b-4af0-af5d-ab872edaea77", "comment": "Malware payload (SnakeKeylogger)", "value": "7a0fe5d8353eb01bc7e2419f9f98f964", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752728, "uuid": "cf3e0dda-c4b1-407d-9ae4-4dc7c0ee2752", "comment": "Malware payload (SnakeKeylogger)", "value": "ea3e1e0fa024ac4ad1f9b126f2c459714bc203c32c19e16962ad76755d26f546", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752728, "uuid": "45545851-58e9-4cd9-82cb-e27a8efe9d0f", "comment": "Malware payload (SnakeKeylogger)", "value": "504fb517374b8733254165734ce5cdda57d1be46", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752728, "uuid": "f4e0098c-5b14-431d-a7d4-0e5f9ccadcc1", "comment": "Malware payload (SnakeKeylogger)", "value": "e2b36d790a0a49f28e665190e149d2f96bf58ac8346584daf2caab86bc35e9e745a4287bf7ed964007b8de1ed06e45a1", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752728, "uuid": "5c0c6365-64cf-4e1f-82da-421befa924de", "value": "A1E4232F597BE5F8C35967822F2CD1B46C41793403CF5E4061E33652E0759AAEE0E9B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752728, "uuid": "749813c4-6745-45c2-8dc6-4f157c02f612", "value": "12288:YEdJAvKN+BKQQMB4Rq3vqOYYJSHKRiL+SMxwFfjdFMH0i2XTekrR1c+IFOiYo3tU:YHRQMBeqfT1SwSGMfjd+SXT/R1MOvGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752728, "uuid": "e7bd9095-f99a-46c1-a3e4-81cbc18776fe", "value": 670376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752728, "uuid": "75eb6086-a722-4f33-b5b0-240eb41d9536", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752728, "uuid": "319edc30-6891-4f1a-b8a6-c2bcbeda523a", "value": "ea3e1e0fa024ac4ad1f9b126f2c459714bc203c32c19e16962ad76755d26f546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8d096a-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623736209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736209, "uuid": "ef3374bd-b1b5-4558-aa83-13ee5ffd3117", "comment": "Malware payload (Formbook)", "value": "d1a2923a7a40719aa7e097f31668c57f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736209, "uuid": "951ed79b-2723-4498-bcd6-01fdbc3d8e29", "comment": "Malware payload (Formbook)", "value": "eaa37ab6bd03100c7f970c55aa9f2fe0eedddb0e6ecd2fbc2d8b517a623472be", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736209, "uuid": "73755e5f-08a0-4336-bc4d-8160e93c70ec", "comment": "Malware payload (Formbook)", "value": "3912ede8ed7f56d3c30193f1adb95a3611cd8b08", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736209, "uuid": "d2e4d0ef-9681-4eab-9cb1-3e5d3a32f5fc", "comment": "Malware payload (Formbook)", "value": "a485957f67bb42e15405cec57740426f164fa03533372f336caf0e2306107e8cd316ee936b3a18687064c00d545b3902", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736209, "uuid": "f1a5ef05-184c-4048-8cdb-25dee10402db", "value": "C4542374A8AF6903D8A5CC69F5F4B90C6B8B71757C61C2ACBD87438283B94A1DD0E15C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736209, "uuid": "a034b2ed-daa4-47cc-bf7d-3970b186e257", "value": "6144:7HG8w/v1nsDd9Dk4ftJrvqwdnOGfCgEdrHmAteAwZKfRtsYKvyCKIHHEr:rw/dnsDHbbrPOGvAgpQCbjKIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736209, "uuid": "8aad2f85-ad9d-427b-aea2-319d1cbd21d7", "value": 283590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736209, "uuid": "983bafe3-216c-4b99-9f3b-68c6b210378e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736209, "uuid": "8c9b83ac-108c-4efb-bf99-c2c29570efc3", "value": "DHL_SHIPMENT_NOTICE#6142020_Signed_.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd10cc9-cdd6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623760638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760638, "uuid": "4ccd38c1-2379-4766-a0d7-0b33c44e1598", "comment": "Malware payload (AgentTesla)", "value": "261521d462c0fb34d5bc6e40e0bef1cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760638, "uuid": "7f60569f-7f4c-4cc5-82bb-53d23cbf11dd", "comment": "Malware payload (AgentTesla)", "value": "eaafd1f5bbc5cc71afd88af3e8cad44b766210283b8e2e376ed3b829de4c4ba7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760638, "uuid": "2b873e5b-9f88-422c-a69e-388489143989", "comment": "Malware payload (AgentTesla)", "value": "c98194a7f03682a18c6a430a5f133acd9d6d792a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623760638, "uuid": "23755865-d035-4c0a-a680-4d40784ac288", "comment": "Malware payload (AgentTesla)", "value": "eac3176e75a1085e3d31a3964d4cdbb4d6c1abb39a5e47405ba23048ed01a2da041cb5887aa0a4e675b9220b5cc8c0e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760638, "uuid": "51112e6d-0347-4f42-809d-2ce1cd57a144", "value": "8115AE575ECE57AEC5658CB69B30AC56C1311CBA2649A3123EC230BDD93F1EFC99E402", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760638, "uuid": "7bd376c6-b2e8-4e5b-99fb-646d04953379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760638, "uuid": "1f5bbfdd-93ef-44a3-9a2e-aa7aec014de3", "value": "12288:T6u6SMPQipP5YjrAdCX1K874GoWHmR7LsiWRkq5D9NinsXS:T9lipujrAIX1KEHEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623760638, "uuid": "3f7c633b-0791-4b56-99d1-7daa46857065", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623760638, "uuid": "945f94f9-be48-40fa-aa16-25c5fbecff1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623760638, "uuid": "fe50a0ea-5803-4ba0-87cc-346041d4bacb", "value": "RFQ 6789097_00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e6c8e0-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737104, "uuid": "49a539b5-d177-42d7-b151-6ab7a0790bfb", "comment": "Malware payload (IcedID)", "value": "078c05c5f79d75d9fa09e4f6253a5dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737104, "uuid": "21d3f981-c624-479a-a890-cf070481b0d9", "comment": "Malware payload (IcedID)", "value": "eaf23fe4c2da443a5d9e70078c25ac68aae8093826baeb600b6399e8f5548940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737104, "uuid": "a6d1ceee-1395-4132-890b-f635ec8fd1d5", "comment": "Malware payload (IcedID)", "value": "8f18290df98b60877af477e6ef3a106647145992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737104, "uuid": "45977622-9dbf-457a-9c39-162aaacb20cc", "comment": "Malware payload (IcedID)", "value": "fc94836faef404054f3631a464e634f8c2c29d7404f3e4a20f20e92d6479eca4394bfaf0b6190d63669d6e6b7ec8494b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737104, "uuid": "61411be9-71b8-4c57-b2b0-443dfb78acba", "value": "70B44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737104, "uuid": "9862d488-38f3-426c-bac4-37d065ee33d8", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737104, "uuid": "74f0817f-0c03-4c0f-8bd4-51b005499b99", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8K:t082TLrbNGoVMjPR5DxDRoFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737104, "uuid": "b7448c34-37ab-4445-8777-8a2c9092598e", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737104, "uuid": "f1e004b2-1db5-46ad-9f79-a74f00bae5a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737104, "uuid": "a0fdff9b-de7f-4e31-acdc-1441c90f1e79", "value": "eaf23fe4c2da443a5d9e70078c25ac68aae8093826baeb600b6399e8f5548940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462f9ef6-cddb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623762722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762722, "uuid": "b9b9e64a-e9ce-4b75-996f-7953ffd5d5bd", "comment": "Malware payload (Mirai)", "value": "4f351dc3074a621dda1ce93021af4402", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762722, "uuid": "d88e09fd-3821-4788-b7bd-95825c9c5f99", "comment": "Malware payload (Mirai)", "value": "eb4d32e14951e3a83096edefa78190359074d82135fe0f48c0825fbbaa750ab9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762722, "uuid": "90ef95be-3a8b-4f3c-9574-9b1265cfc8d4", "comment": "Malware payload (Mirai)", "value": "1e2c0b0188a89bbbcf0b3a931b3d76f4b019c840", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762722, "uuid": "a99c34db-305c-4d38-8266-2e55a34fe725", "comment": "Malware payload (Mirai)", "value": "a00dbb26d0d92079a726bd8842c3157e466d8f3d5975130f1c1feb8376b5fb411db62d4e35ceb4f07b7a9296ed4f0839", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762722, "uuid": "c77632fd-4215-436e-826b-aebf4636b82e", "value": "73F3821ABF150FB3EC9BDC3709E92B05188D250621A97B767D30D958B64B31B26E7CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762722, "uuid": "81be7fec-7779-4b14-ab2e-5bbb10697f49", "value": "3072:M8gkjIKj/3W3GfQZk0W+VxigS8lHippXh/iJDipxtRdqGWLBI:PgkjjjiW+VxigS8lHippXh/nXtnzWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762722, "uuid": "144e2e67-6054-4a66-addd-4d9458661c69", "value": 167148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762722, "uuid": "a3573edd-8f36-4e03-b106-696688c87cc7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762722, "uuid": "986ff614-0c4e-44b4-8e9d-eba3a5eebd3e", "value": "4f351dc3074a621dda1ce93021af4402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc469875-cda6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623740157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740157, "uuid": "bfccc9d5-ef97-4d88-8f5b-4be4cfe94495", "comment": "Malware payload (AgentTesla)", "value": "bd75edbd6e80ceb4ebf356cda78263f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740157, "uuid": "51dcd907-ae24-4185-83dd-57e62123eb00", "comment": "Malware payload (AgentTesla)", "value": "eb9a0a7dfdb07e81595ece5734b939b8a77c54eddbb58655a4f0456209606edd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740157, "uuid": "86c52168-ef4e-48e3-b47e-42490e55d732", "comment": "Malware payload (AgentTesla)", "value": "2413915efe180a7362a6af7ec2c6bb512a4083cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623740157, "uuid": "99428780-6079-4183-9f06-036dbac90743", "comment": "Malware payload (AgentTesla)", "value": "2bafdeecff0282afc0cad47131035df4b9281e898e44a6f909bdb4f6c853378b43973c9e5c3fc07f666691284ea06c63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740157, "uuid": "a6719bda-1478-4fe8-a6c1-46c920913131", "value": "90354A9C7555EF9EF4778B3184549D20E113ACAF4227820BA353B67F6A3F3D38A141A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740157, "uuid": "3a0ec9bc-4579-4012-8b64-358f082e1f41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740157, "uuid": "2884e4aa-d67a-4383-bf04-ce48453263d7", "value": "12288:dsvHego49VCZ6vi/cNm/vx4Qh92OqYSox+bQJHTwWi5tRU9OtxXjeuOPCyesj+QX:Y1kcwO6YP9FQJzwWyU92eDIAW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623740157, "uuid": "21edae1f-ba86-4acc-b08c-eb32d840ee7b", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623740157, "uuid": "78f1eb53-fa9d-43ca-8e2c-d5bdf434e6cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623740157, "uuid": "0f933002-16ac-415c-95d9-44fbc3b7cb02", "value": "bd75edbd6e80ceb4ebf356cda78263f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a9247a-cda4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623739186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739186, "uuid": "61449e44-1c9b-4de9-98e7-022621770e25", "comment": "Malware payload", "value": "628507826e1b4f53cccc7d795a83a6e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739186, "uuid": "6540d253-64e3-411b-a6ef-9f18d29b0929", "comment": "Malware payload", "value": "ecc540a094d6ae713b8ddcf52172f0f87f4161b026c36e992aaf2b23dd02ef10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739186, "uuid": "fdfb6dbd-366f-4bd1-9b08-65f11dc4d4d3", "comment": "Malware payload", "value": "1d9d9bdf9e21dd9b4dd4bffb5c188d5dc14c09f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623739186, "uuid": "d2f2eb5e-c600-453a-82ea-fda74a67e625", "comment": "Malware payload", "value": "1ceef680a5ea36b8c75509652b1d721ab4c64a956d642698e1bc1cec0e9c5ecaad79079edf5bd82cff547fa62d71d52d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739186, "uuid": "2f1bd857-a50e-4441-b9d0-8daf35caf404", "value": "5904D72CA2A84132CBEACDBC0CDD513806604A9B6D11FF56A9D87E9735AF383F1D41D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739186, "uuid": "1ccaf7be-6afb-476f-9ded-b66dfa7af326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739186, "uuid": "cb3d4aab-b14f-4bd5-bbdd-02ce27da2a6f", "value": "3072:OI8v2vDkRnsAwZ4mnuCL+TpQO15Pn9dWEN1C+6/hMY:J8vnsAwWmn/dO1F9d8+6JM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623739186, "uuid": "4d8ec40d-abc5-4fc3-bf13-88d29a3e585c", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623739186, "uuid": "4cfd9e15-c271-498c-a0cb-f237b1ca8d23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623739186, "uuid": "415ca533-5ea4-4360-bbc1-67deca34d4e9", "value": "I-Record.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e8f686-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623769132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769132, "uuid": "f5337f6d-e543-4e88-9297-683b7ce65136", "comment": "Malware payload (NanoCore)", "value": "a06bc583ac95241fc99fdfa4d0f0f610", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769132, "uuid": "3690d376-faff-458d-b493-f0c3bd0dbbaf", "comment": "Malware payload (NanoCore)", "value": "eeb187ae3b23263586f2cf75d36125037a0ac95bb9732b16a5316361b42901c0", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769132, "uuid": "71e16b78-79da-4c72-a0bf-4a12f5518c15", "comment": "Malware payload (NanoCore)", "value": "cf8cbdaf409de7d131a3bb1221e4f58a5389290a", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769132, "uuid": "cc1be063-f83a-411f-88ef-6ebab29a7a92", "comment": "Malware payload (NanoCore)", "value": "a63892d37d9b31acd4e7c96b4c833f879b32a60ca4ae0d540c414a0ddc0eca6927f4b1844b5380cd9fe3b2b07b5eb01f", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769132, "uuid": "af2356d1-dc49-493c-b199-a17d51f8df9d", "value": "BF456C8C7545EF9DF0778A3249488C20E217ACAF4A27820BA367B67F5A3F7C7C914165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769132, "uuid": "1a55a445-6e71-485c-bad7-515b4214c4e0", "value": "24576:R5QegundQePUX7g2Y2dT0u/4KU8qQsLIFW1:A9undQBXTY2d5/iQyIFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769132, "uuid": "a1b163bc-06e9-45ef-82f1-fb75c4dc522d", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769132, "uuid": "82447bf5-6ff0-4f5a-81a7-630c04e7ae4a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769132, "uuid": "4fa9252a-715d-43c3-8be7-9b596a50ef62", "value": "contract_proforma_invoice.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51906d81-cd96-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623733106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733106, "uuid": "c4a90632-3cb6-452e-94e3-6878f08d19ec", "comment": "Malware payload (SnakeKeylogger)", "value": "da3723cd278b6ddcbde0f6f66160184d", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733106, "uuid": "ba18bdbd-c8f0-473d-bf16-5014883256d0", "comment": "Malware payload (SnakeKeylogger)", "value": "eeb6c8e812939e031ddcd63c4bfb5c07864a6fd8c95d1fb2097bbcc90e942c8f", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733106, "uuid": "eb2b527b-8b1f-4ce3-829d-5a7d277c3a79", "comment": "Malware payload (SnakeKeylogger)", "value": "6b4c6f63e3e396de3b79e54741bd67b3677c200c", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623733106, "uuid": "f1dbf315-92e0-48c8-ba94-c622b36659e4", "comment": "Malware payload (SnakeKeylogger)", "value": "7dc2834102ba57c0cc27c1229411cd7c9e6e1c595646cc25324290e1fac9e55d2181c651c71aa106419838b72cdfbfcf", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733106, "uuid": "26fa631b-e86c-4ba0-be38-19a69dc60e49", "value": "E21533A83494DD448ADAFE6DAE9867C2FE2C0BBCDC4531D6F4BA0741D8150B86A5806C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733106, "uuid": "c9df70d3-b070-4097-bda5-b535a7e85f64", "value": "24576:8xOO+jIWzjDJqfZpc86734eDlOPSF0VWp+WVK:8xOp0gjD8Rpb67Idu03V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623733106, "uuid": "b01a6fdd-8c0b-4a46-a61e-5ff157b73f6b", "value": 949971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623733106, "uuid": "3f561560-c57a-449f-b146-531d4b07476e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623733106, "uuid": "0fd6a631-f718-4995-98ba-dc3847b2e71b", "value": "PO.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b810aa-cd9d-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1623736250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736250, "uuid": "534033bd-4f0a-46bc-8332-7c5cbb63b351", "comment": "Malware payload (AveMariaRAT)", "value": "f603ab897766610aa9609935e5a65359", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736250, "uuid": "873d8735-1475-4df6-91e8-3c2341dac97d", "comment": "Malware payload (AveMariaRAT)", "value": "ef9f3640a11c9355fca84a3ded21a4e60b0565a2ccbd70d24bb4204a4c85651f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736250, "uuid": "26678dc0-609e-4328-a4b0-bb32dc400dd4", "comment": "Malware payload (AveMariaRAT)", "value": "9800aef87722cb04b166a74ebf66f84ddfb44aa7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736250, "uuid": "c37026d0-3a40-4fc1-8391-0897eac85e33", "comment": "Malware payload (AveMariaRAT)", "value": "938394b761e88db070e6fea7b58f31f06aeb161fbb793b203228a48e9fa99413484a3c9bb1b97142e15340dd6ba2f920", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736250, "uuid": "2f57337a-370f-42aa-bafc-66897bfd68fa", "value": "CED29142B3E9CC16F11201718DC3D6CA7729BC5DAE0AC20B3385BF1EBDB52B08A21759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736250, "uuid": "348803e4-a2cb-4c7f-971e-251d3dd1483f", "value": "192:wAnzTD0NslLZEvA+6/6rrILd/Kf3HO8te/AsBuKjuENSvnk3My0j2dhTotWFqC1E:wU8iSUR/8deYYenIMy0j0otJC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736250, "uuid": "b1d135e1-91cc-4f33-b9a5-00a8b77ea971", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736250, "uuid": "d0798b31-437d-4ba9-ab73-2052fc241cd0", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736250, "uuid": "ecbd1eba-b1da-4f32-bb81-82d10e129cf4", "value": "IMG_701451200.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a6c289-cdac-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1623742483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742483, "uuid": "dcb7ea29-44b2-41ed-8a9f-b1978972562f", "comment": "Malware payload (AveMariaRAT)", "value": "22cab836eed32f9a6e55283d764863dd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742483, "uuid": "d9315265-d47a-4422-9710-cf993cc35c75", "comment": "Malware payload (AveMariaRAT)", "value": "efce2d3f537e2cd579e96a6142338275e8f9da20fd356cabfbaf976769ffcc3e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742483, "uuid": "6770fdf8-5b7e-44fa-8d16-f11254b7f7cc", "comment": "Malware payload (AveMariaRAT)", "value": "745846f1cc2914e2d14c8e6dc729efc5b63cd6b9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742483, "uuid": "5ee5b666-d4b5-443b-a37b-293d4505cdce", "comment": "Malware payload (AveMariaRAT)", "value": "9ec0a99e3c63df306135f183cbed3d8ae11c8129bd510dc5a61861364421d346a10e522e0cc680acf1cc2156e8d87d8e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742483, "uuid": "c9d426ba-a5b0-4b95-9258-a12383052ef6", "value": "DFB39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742483, "uuid": "d76ec305-2277-46a7-bf91-5a878702aa43", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742483, "uuid": "c5e5782d-9a7f-4eb1-a77f-7b230073a41a", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01l:K1VmhaH8EFvW+0OVE0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623742483, "uuid": "a7f81716-40c4-4fe5-ba0a-8af990855dce", "value": 112007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623742483, "uuid": "b8ee409d-a9f4-48b6-9743-1880234d0235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742483, "uuid": "8c95fe98-1cbd-4446-ae17-532de34729fd", "value": "22cab836eed32f9a6e55283d764863dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5cc87f-cda2-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623738251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738251, "uuid": "567b89bd-0ee3-4043-ad0c-664004520d42", "comment": "Malware payload (DanaBot)", "value": "3df0a041551e82f2c84e56c36de75c3f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738251, "uuid": "1811843d-b2f5-4fc5-baec-9333f6d02f60", "comment": "Malware payload (DanaBot)", "value": "f01d195f4dbf1e4be25a170eba29671d2d7923888028bceb3895cdcb3641b216", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738251, "uuid": "f7dd8333-e81b-4e42-ac05-53e326d77fed", "comment": "Malware payload (DanaBot)", "value": "d3e0a9050e3d11e3b76b491338e42a3655b280cd", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623738251, "uuid": "e71eebf6-2292-42e9-b567-88979e6cd904", "comment": "Malware payload (DanaBot)", "value": "f5a821d88d899c963e7bb90e018a8f3d5e90b2cc57024b5f377d521901fe0d12fed177bf286187dad1349a87881d7bef", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738251, "uuid": "18c51aaf-03ed-4877-91fb-623c636730e0", "value": "7D563341DAB0A035E2B766F487B592285939B9D0173992CF41CA0AAF5B5D2F8DC70F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738251, "uuid": "5d5004b2-1af5-43b8-a858-08f2220b491a", "value": "b0d3854c557fd79a46b820c312bd2709", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738251, "uuid": "1590509b-7a91-4efd-bc1f-fd4874182add", "value": "98304:798jQN1kECeyz1/ZvwpSTqtAaN44GHWfjMO2wUxnZkTmnrRPwNb1e+860d0:7ejJ3Z/9cSTVaNaHWrew+awVPAb586", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623738251, "uuid": "b36eb0bc-a601-4e70-a4fa-16f29be19f58", "value": 6298624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623738251, "uuid": "147b598d-0d16-45e5-939f-270e95db62b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623738251, "uuid": "108aa541-d0c1-4338-83cd-0837d42a87d3", "value": "3df0a041551e82f2c84e56c36de75c3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1eac0e-ce04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623780368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780368, "uuid": "e30f51de-e240-4603-9d1b-396f30238901", "comment": "Malware payload (Mirai)", "value": "6da7b539c3e6227d7618576b6456b1dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780368, "uuid": "18d3520e-5e55-4d8d-8260-e6236837e9d0", "comment": "Malware payload (Mirai)", "value": "f05421daffa9b7fdeb6cd7318ebc9313aa56fa83bf37a7e343cc3f7800c33a0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780368, "uuid": "27c7286c-74f2-4514-ab49-f4b2421e5ff4", "comment": "Malware payload (Mirai)", "value": "a54cc9b10212871684133b585620cf26c9a8e53c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780368, "uuid": "0bc59a4c-e673-4e3d-a8b0-0193e1f9366c", "comment": "Malware payload (Mirai)", "value": "526c5c109b69d9ee572b761924e4db809464b1e1fa8c90b02050b26def0f6a97eaec3c29774c3e76c7f85ba77e156708", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780368, "uuid": "dbd6b554-2528-4acf-bed4-c488d812e29e", "value": "EAF2E186C92DE873E3B30B36DCFE0DC25F62956E9AFD51421768098462C784246E6F03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780368, "uuid": "5fd04558-7954-434c-b3d1-00edaf66a8a4", "value": "768:harjeCSi9ZoHN3Hv1rdjJN3R1ZqHLUMT7ZSvlv/Vsg9q3UELfR:ha3eYu/RdbR1gHT7ZSNAL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623780368, "uuid": "2cb75075-7d8e-4fe9-a03c-3cfd1e340b9d", "value": 34496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623780368, "uuid": "aa62365a-f17f-4acc-9f96-8f66f00cdd51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780368, "uuid": "da71f96f-aaf5-4470-9caf-8618d1196734", "value": "6da7b539c3e6227d7618576b6456b1dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a33ea84-ce04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623780365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780365, "uuid": "22ebc51a-ff7d-414a-b0f7-70d4d9b68feb", "comment": "Malware payload (Mirai)", "value": "0301dd9ac4172bc41101eccb48416d97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780365, "uuid": "7b5ff986-4e2e-4d56-83bc-94999447f143", "comment": "Malware payload (Mirai)", "value": "f14bf33b48b66d785e4acba474ec9655e0eda6ec5256bdb86f06e60e4980b0df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780365, "uuid": "ea8d6418-6a78-4438-b0ed-6d474aa92a55", "comment": "Malware payload (Mirai)", "value": "483b50de90a49eed3c2c318ab4bd60741d8f366e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780365, "uuid": "de3cb391-873f-4b36-9350-8644cc587f82", "comment": "Malware payload (Mirai)", "value": "83975145d1db2cc6952285af8a2ec65c285acd2957736310b1cf040024c0eec3d06a50f1a2b9723e670caf8cc37a6a1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780365, "uuid": "72655968-d830-48bd-8de9-27bc567243a1", "value": "E6E2E1FEE48A79DFE66C0C7A608E12627DD821B273DF434C279608CC1319906BB1D56C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780365, "uuid": "2eb6fc52-64be-49d8-ad6e-e613c869acfb", "value": "768:QbkNqg5VYGgxpepHRVT/2ENsKZMIeM7wirjdCi+WY:QbkwSgxpeRv/LNvxeHigB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623780365, "uuid": "09e4685d-82c7-4aee-9a3c-f818aa196e84", "value": 31984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623780365, "uuid": "f41eb066-7c58-4c5e-9c96-87089d25ebb8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780365, "uuid": "1b0aaf67-4124-41bb-bb01-4012079eaae6", "value": "0301dd9ac4172bc41101eccb48416d97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f596111e-ce04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623780626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780626, "uuid": "0b98440f-7467-467c-9c7f-4053d1772cc2", "comment": "Malware payload (Mirai)", "value": "9d3805c2531fe84ebc6d619ee2264884", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780626, "uuid": "d8a323da-ed25-437b-b323-49777376891f", "comment": "Malware payload (Mirai)", "value": "f233a3764c20dd598968bacea6f83a8aae5ce9ea936618ee688b1ced5cc02ae0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780626, "uuid": "9d6179d8-5c6e-4eb8-9323-dbffdc94328e", "comment": "Malware payload (Mirai)", "value": "a762cde86b91fa4361cb18552e4947d228f2fc2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780626, "uuid": "e133e8eb-a4af-4172-bf7b-cdd2c95094a9", "comment": "Malware payload (Mirai)", "value": "091450a24ad9b174d6dc112c56e7f16e0322f4f353d480bdce3d6dfadee84bdc365a3316a3c3716206a025e00df4711d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780626, "uuid": "f1159a3a-30be-4fb3-b09e-8b5eb9f568a9", "value": "833302BCAA08F110C72065F638ED50261D099FFA97C7B83526B0B07F9C9649B8B7D5E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780626, "uuid": "4f13457a-781b-442b-98be-5b6ad216a210", "value": "768:Xkmvf0FtZtFN82wOL8UA+bcWFl954m6CGp9c2ct6Kn9q3UEL9Os8qMLPVhwLYKfs:BvfyZF83ujA+btnCjCG0FALKV7Kzup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623780626, "uuid": "ad333bc6-b8ca-4379-9258-8647f5f97a73", "value": 53608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623780626, "uuid": "ab5a8ad7-0cb3-43af-934e-051a4ca38909", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780626, "uuid": "30f4e467-d264-44b1-9d4f-719f23a711b9", "value": "9d3805c2531fe84ebc6d619ee2264884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3d9ae0-ce0e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623784851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623784851, "uuid": "281ab6e7-b7c7-4b8d-b27f-586579ce0b4a", "comment": "Malware payload (RedLineStealer)", "value": "fdc61b183bd213e4a66286eae789fcbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623784851, "uuid": "e889e311-8d90-45a6-a01c-eb9e3e5df1a6", "comment": "Malware payload (RedLineStealer)", "value": "f3628edc83e0a331119e138491a24f546d6f5bdf3de8a6df38a8088ede5a0186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623784851, "uuid": "b584aef9-99e6-4a0c-97b1-04575b73bb02", "comment": "Malware payload (RedLineStealer)", "value": "e058285bd1a574f65a5fdb53157b32075470073f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623784851, "uuid": "d57b4144-c14b-4489-ae24-948aab7ccfe9", "comment": "Malware payload (RedLineStealer)", "value": "193bd54490dc5a7ffa85284bf9c5f155ed6fc8a2c09e4a97351e11f4c63836823460b79de9195178608e9d7731fa7083", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623784851, "uuid": "a1f5b79a-74e8-46dd-9aa6-f14af832689d", "value": "6484AE00A7A0C038F5F352F45A7963F9E92D7AB06B7890CB52E527EA46746E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623784851, "uuid": "165657c9-8443-4b5d-8264-3b04ef3ad34c", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623784851, "uuid": "ba1c3001-a68a-4600-8c85-07da8b168403", "value": "6144:UQ0TL3USjObgZhp6eZYME/EVhDiqHYCT2vYEn5jLhdW4Q3X9O:UQ0TL3DObgZhhC/EL51mYGdhdPqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623784851, "uuid": "7385467c-8303-4a03-88e3-0c9ed645e71b", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623784851, "uuid": "367f019b-91a7-4d4e-9539-59cae741f922", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623784851, "uuid": "fc186be7-5363-4809-af69-825c268ede2e", "value": "fdc61b183bd213e4a66286eae789fcbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0e687b-ce04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623780373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780373, "uuid": "acbc8591-4025-4d0e-b638-dd82971308c5", "comment": "Malware payload (Mirai)", "value": "59ee3bf51954e1988a8531a676a881db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780373, "uuid": "81bf7ccd-49a6-47e5-b47a-148a60e6e77c", "comment": "Malware payload (Mirai)", "value": "f3ca74877778591f94669315962c31f66e981a0062aee2bed1d34b7e293fa119", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780373, "uuid": "5025a7d6-b69f-402f-bf25-23f30d15f4f9", "comment": "Malware payload (Mirai)", "value": "c3d0e0282f1bf9a733aa03426e90724f7ccde76b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623780373, "uuid": "3cd20141-fe3c-458f-b8e5-c39517accb9d", "comment": "Malware payload (Mirai)", "value": "60adb86199f777d73d36db0035d42e62cfcb252afa15e0593a2eaa4ab5f6b924307025e8a1a7620d24f38dbb2394fbfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780373, "uuid": "b5ff40fd-5a19-4553-9093-7f93556c1c00", "value": "8B331A8A64112E6DE9DA9CB980674F0EDE541220B0A3171BB3BBFDC33933354FE65949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780373, "uuid": "dc1e0d81-2068-4455-8886-90c8923b2f68", "value": "768:QaXTrofl4ghoueg2meG3PAC3Uc/Q7Pw67W3We4oRol7wSuN+f1pr85k3oeVyM:QaKdhoRg2mewoCxQ17DZ7wSig1pQkyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623780373, "uuid": "d749d9d1-fcf2-4abc-9ecf-ccf167bdd75b", "value": 52836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623780373, "uuid": "d800cfc9-96e6-4547-9c01-7607bfe83119", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623780373, "uuid": "3eec7ce9-3dc5-4d78-9855-f477199724a8", "value": "59ee3bf51954e1988a8531a676a881db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79d445b-cdc3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623752712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752712, "uuid": "c4a821dd-e74e-47e5-affa-7d377cb2b5b5", "comment": "Malware payload (SnakeKeylogger)", "value": "c3e229d08e5d58ae0ed2c8328566a62d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752712, "uuid": "8fa238ac-fd76-42ea-bb69-e14d54736269", "comment": "Malware payload (SnakeKeylogger)", "value": "f3d1f6dde0ade6374da8fa8bfb1fae065a53715c4dc0d1638ed8302f8d53684e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752712, "uuid": "88e8c1ab-e68c-4c53-9603-ad4707e359f2", "comment": "Malware payload (SnakeKeylogger)", "value": "21480d80169394ba035ebbb4372da5466fc8885f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752712, "uuid": "084c6dcf-6b80-4978-a005-d744b6515107", "comment": "Malware payload (SnakeKeylogger)", "value": "335c7ef6a4d0f671d287fd5684a4131ad30667a8956071a71b3848f3fc2c6458da7e7f69adfb1711c1824a118b2b1975", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752712, "uuid": "71242626-04ac-4b73-8197-d08d227e5877", "value": "F5D423F06B769E60ADB031F6132E7271217A1224A779C4F33AB9C4FD625C1468897FB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752712, "uuid": "f45b3141-7e04-464c-a02b-a2c377c23cea", "value": "12288:05lZmniiHDSYQXx+A8hdhFZewKJ3CnXTpuCDQKWrhDgDhs/Zo:05ls1D2+AgbZewKJ3CXT8Csrm1s/Zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752712, "uuid": "e1130245-3429-467a-aa25-fbed02e11f4f", "value": 634081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752712, "uuid": "a39b2a49-9974-43b6-9e06-3b1f457690ab", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752712, "uuid": "cf77776c-702c-4b42-a5db-d49dbdadb0b9", "value": "f3d1f6dde0ade6374da8fa8bfb1fae065a53715c4dc0d1638ed8302f8d53684e (1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ee1c80-cdea-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1623769290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769290, "uuid": "2656fd39-d21b-4b9a-aa8d-9cf55a137282", "comment": "Malware payload (QuasarRAT)", "value": "b127f3a9da9a84ab311eeff6917b7bd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769290, "uuid": "d288386c-551f-4920-a6be-6419b15591a3", "comment": "Malware payload (QuasarRAT)", "value": "f4fd51e6e0684d722cfacceb9a3abb8e4c449e96dce19b1f8b47fc8b09abf9df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769290, "uuid": "5ddf8732-46fc-4c9a-8b67-b8def9aa846e", "comment": "Malware payload (QuasarRAT)", "value": "2d7ab3ad129e2d372e672a236aae5e82ba835626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623769290, "uuid": "c8eeb963-db83-4132-8c6b-359f2233d3a2", "comment": "Malware payload (QuasarRAT)", "value": "b72c277e73c11296ce1dd9ab9faf20483ea31addb00965743a23b156efb2ffe62d4f41d63219f95dad528a88a1880cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769290, "uuid": "8e0f4744-1c1f-43f9-8606-fd8be7bfeb34", "value": "64B2F80572E85B22C0BE0BF51CB19414C7B6B6572924EF4C6EC930CE197AF485E51FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769290, "uuid": "3a215cb2-14fa-49d9-9500-75d3f4c0dbdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769290, "uuid": "f4a313bf-2dcd-4374-b038-116ae82ad249", "value": "384:5vrOSKo2KlUgzlMX4hGGBVUUUqUUUUUUUUUUUUdTvULJ0+IeMQqt/UGK8X+uxLeU:trOZtkXBVUUUqUUUUUUUUUUUUdTvYJE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623769290, "uuid": "97e4cd8e-e4b9-44a5-b158-2a24f6d73584", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623769290, "uuid": "021525e4-5116-46d4-8036-de49ca66e5d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623769290, "uuid": "8d930f2d-7d4c-4850-b36e-3702820c1d59", "value": "b127f3a9da9a84ab311eeff6917b7bd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8374f60-ce1b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623790455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623790455, "uuid": "7b6ed73a-72d5-44df-9d59-0d8792a5e69b", "comment": "Malware payload (Mirai)", "value": "1a05e7b2e95cbcae572114edb0b59750", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623790455, "uuid": "214c0d6c-2f7a-432c-9c3c-ed3f3f7453d9", "comment": "Malware payload (Mirai)", "value": "f5c856e51bdf5323f0b300756ab1bfd94f730577a19ae83e5162b72790d7cf2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623790455, "uuid": "46e8ce9a-43a3-41a1-9b5c-eb6a463d711a", "comment": "Malware payload (Mirai)", "value": "aeb6174192795c08f12cedd042584bd22c166eec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623790455, "uuid": "5c743c1e-0444-45eb-8ce3-a22d82c80dd3", "comment": "Malware payload (Mirai)", "value": "96b737ae35916d8edb77fb228bdcdcd8dd952d4090905a0fd541e1326f2cddfb0c3b8604d7d7b9bc318f60a7ff12b046", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623790455, "uuid": "20168c5e-e35d-41e7-a0bb-b835a0dca165", "value": "AEB32A5AFB408F03C4D51776BADF42463323DB54A3EB23065918AFB43F866AE4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623790455, "uuid": "d9f7e134-86eb-46d6-8a40-66e331798a34", "value": "1536:ptn/83sQrI9ZHQPC9X3CPp7gdlRiJiEAfi9twmSAW9SUkUzw/9W4fyyVEoM88E5Z:I3oRQPC9X3CP+GAf2Om5WHM/9W4Djr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623790455, "uuid": "31bea195-ec49-47fb-a620-586faa82f03b", "value": 108782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623790455, "uuid": "088dbc02-67b2-4e2c-ae38-5e9b76afa036", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623790455, "uuid": "421b820e-30b0-46a3-9d3c-9729c938ef15", "value": "1a05e7b2e95cbcae572114edb0b59750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddb1c63-cdad-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623742897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742897, "uuid": "b22626ae-c3fb-4a5e-8222-7184140cfa29", "comment": "Malware payload (OskiStealer)", "value": "5de3e4602f7627978676fd3a55c1971e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742897, "uuid": "448b2fc0-e9ad-4eb0-97ee-c2bfc6636cb7", "comment": "Malware payload (OskiStealer)", "value": "f5ea3806b88021cefb050fffe3f28a86183940345d8df71e9d07e7c52edf617e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742897, "uuid": "f615ff4e-8677-4715-bfc5-5bc940240261", "comment": "Malware payload (OskiStealer)", "value": "13768622e98e78014b0c0eed57d92c5d3c8e714a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623742897, "uuid": "c40300b5-d5cd-46db-81c1-07ca7b2178bc", "comment": "Malware payload (OskiStealer)", "value": "57c316b0442b87a286ecbc91eca1143c846790cdd6bd75f1f32a8d1e21a7017911ba4fbfa67f7a0f026de0a634de0693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742897, "uuid": "169fa7bf-a6d5-4f4a-ae1e-c25e7bb127d3", "value": "4854129B76F880EBDE2305B193B76978CAFBF35230107DB72B192F7D48286469496113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742897, "uuid": "8bf50b78-6d18-453c-8377-c5953011e87f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742897, "uuid": "ad2d04d7-aab6-4e12-a6d5-b7afedd927f2", "value": "6144:JQqQRnuHQgpXXc4BpBN7wZr5sMd96q4j3uSyfGA5hyui4t:86NXXF2RT6dz6hiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623742897, "uuid": "8af425c0-0a46-4058-b6f2-ec187173b1e4", "value": 289173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623742897, "uuid": "89f42871-e4a7-42bc-bb64-04c55aa659e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623742897, "uuid": "a6678446-503e-4cba-8766-9dc61418235c", "value": "DOC120229921JUNE2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36713a25-cdbd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623749811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749811, "uuid": "d0780628-e608-42a9-8109-f08468da97b9", "comment": "Malware payload", "value": "edca7456f9ee5761b3ef174e5e532f53", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749811, "uuid": "ddf80395-b011-454e-b35f-fe6ed409b123", "comment": "Malware payload", "value": "f687ff9c309b0258483146f5325fdaf48d0cff6440c49932e671e45e56e8e3b2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749811, "uuid": "163923d1-74f1-49d9-9f26-b291baef5c7b", "comment": "Malware payload", "value": "c0fe849c5076d68bbe74bda46d0084b58dbd9f0a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623749811, "uuid": "54e9aa5b-3aaf-4e50-8a55-fa1cab1c688e", "comment": "Malware payload", "value": "c1d1efb1cdd84d3f9e5a6a0335ed0c7413ff22e7d4a38f244762e10e853bf03f43fa7b2671103588de6beec208d86067", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749811, "uuid": "fe092f18-4f52-4a97-92c4-c88179fb8455", "value": "9F71197D42682CE1CF1787626979F93853C67A6187C968CC746EF9810B2FB090B2FD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749811, "uuid": "ab018390-8aea-4261-8a8f-ee60eac00dbe", "value": "48:GyUPp6HLuV0L3KOfr1WIc8JrR4dxaj2WD2k7jZAWRXXH1+bcb8Y903B8N4orBKg0:i0L1trbXrREajDZXFl+bI8YadiUpUv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623749811, "uuid": "e279b8a8-8418-4754-ba20-4ce5a0ad5768", "value": 3645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623749811, "uuid": "508630f1-f6d5-4217-b6be-893cf05d00d9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623749811, "uuid": "473ce1e5-d12e-46bd-9a2a-a28a5cbf8942", "value": "Technical Specification.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b310eb-cdc9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623755156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755156, "uuid": "f6cd12a2-186b-4bbf-9a9e-fe851da17ab2", "comment": "Malware payload", "value": "1d82ffe508e8ba642b676645b2d99e79", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755156, "uuid": "34ecf9c4-55dd-45ec-9d4d-fff1fd6097aa", "comment": "Malware payload", "value": "f7d32dacc13c20947e1e30833c1b1492179fd101748dc1fedbeff40d766f53f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755156, "uuid": "a8511099-66e5-4435-8e20-f58efe0cf567", "comment": "Malware payload", "value": "cdd22fcdceecfc51deb71b9d5c5ef8b58bf98e7a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623755156, "uuid": "aa310d84-52f4-419d-aa81-05066726bed9", "comment": "Malware payload", "value": "a00ccb9ea3f1ba5706fa11cf39f14e997c5ec886f303a4c85ac1643a4a971cf2a39b577b7bf6f97af6dceb1d8c80cd1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755156, "uuid": "f8a1bb30-818e-4ff6-88b4-86a6bc936a73", "value": "AC6265CE5806E6D0407E3379EF8F4A80F2A18A336938D479707CEA55DF3FA204665D99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755156, "uuid": "d45e9ccc-5c59-46c0-9045-9ed027bb6808", "value": "384:ck69dCWcGthIyVMFDUBx4QlmosbVinii6b:dmNcGHIyVMFDYSQQooVinB6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623755156, "uuid": "c9a6c389-6643-4c60-b09a-fed97673d25b", "value": 14829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623755156, "uuid": "e587499a-9004-440b-801b-924be93f6a94", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623755156, "uuid": "699c6b64-f76e-47d6-a6c4-f57d1b0f3a32", "value": "AZ2066 Elektronische Zustellung.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6225e11d-cde3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623766205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766205, "uuid": "9a1971cb-bd30-4073-99a2-d61e2d0e2271", "comment": "Malware payload (Formbook)", "value": "6dd01d1d6fc127246129b02432c4a2a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766205, "uuid": "1fd9270f-cab7-491a-af8f-e20f643f31ea", "comment": "Malware payload (Formbook)", "value": "f80659d8234e929bf1336caafe372417c7b34d6a8c15538ae9172e54411e172c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766205, "uuid": "f8cfbc51-c72d-46be-a845-2f56f749a64c", "comment": "Malware payload (Formbook)", "value": "dd8673247d6a551f12a46c05d27f1b2a226c978f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766205, "uuid": "9fa6291d-e270-4163-a982-db2c957dc245", "comment": "Malware payload (Formbook)", "value": "6e1b44ae4b4e8326c9246d56e7b70ef4b4da9419af5c2ecfe01bd5d4737fdb2518190fc06ec788727335c19591e5b25c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766205, "uuid": "6cc27d44-89db-44f8-938a-cb3825e93d7e", "value": "7F2412E626F1243BE42118315AA7B336EBB3B241176413AB67640F3D2F3B192CB1524B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766205, "uuid": "7aa00008-5c4c-435e-a56c-dc89bf05b7b9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766205, "uuid": "c6f54681-bbd7-4fdb-b959-0c1807a919b7", "value": "3072:cLk395hYXJDMbkoegluD8YfLHM/WAjztvuilJ4NLGw+Wfu8Ui4aBjW8KX/jV/Kt:cQqW40ug+QxdVw+FE4alWBrFKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766205, "uuid": "74f8c4f8-5a3a-4374-a72b-3ad4838919d1", "value": 217041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766205, "uuid": "43f26d12-2c4a-456b-888d-94e5aa69ca34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766205, "uuid": "9e92f505-8515-4a99-ae4b-523c994eb223", "value": "6dd01d1d6fc127246129b02432c4a2a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2fc4a7f-cdc3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623752677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752677, "uuid": "bd200f53-ce57-46fc-96ce-87a692cdbdba", "comment": "Malware payload (Formbook)", "value": "a8398675f56d106c03387decadd26ce2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752677, "uuid": "4e21bd36-124f-4326-a385-26ada0d7b6f3", "comment": "Malware payload (Formbook)", "value": "f83b9181caf9fca96aa780504a6b8aeeb30ebde24c32e2943969586a75c4a70e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752677, "uuid": "130a24c4-a701-49b3-8d82-cce7540e9d0c", "comment": "Malware payload (Formbook)", "value": "ceb0f5d3733b618019d7f0158b3ffc54014e4886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623752677, "uuid": "b7f246f0-1bab-4201-9448-4823cc105465", "comment": "Malware payload (Formbook)", "value": "71ff318aab7af9af412d0ee4e675e13a2525bdecc2082308020e43b7ef5f5e4b6d07b5a51b12a9ecd892ff7bb2ecfe35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752677, "uuid": "e0421ea6-7dab-47e5-a9e7-adceb75c487e", "value": "0E34122335CAD8F3D15746B106339BAAD7F9EB111620026B27B09F7F1A31263E5297C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752677, "uuid": "389eb8b0-376f-4fa5-ab7f-e5271d51bbd8", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752677, "uuid": "b2f4d1ea-074b-42dc-af79-31c948ee34a6", "value": "6144:Ds9X6hWrvefHmZpgAnyCatdmsdgUlSF7MU:yKhWb/jgAnPatzdgUl+wU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623752677, "uuid": "020cf0ca-96c4-4e4a-9dca-3b257270cb6a", "value": 245805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623752677, "uuid": "7f0becd2-7ae2-4873-83d4-951650212ab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623752677, "uuid": "6f461e1c-587b-469e-8f1b-147c68d07fd4", "value": "f83b9181caf9fca96aa780504a6b8aeeb30ebde24c32e2943969586a75c4a70e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bec732a-cdd0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623758088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758088, "uuid": "362117ed-4ee8-4d88-9bc4-b6609fb6155f", "comment": "Malware payload (AgentTesla)", "value": "da5f4f45f704a0d416e66edf44796d77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758088, "uuid": "b8f7218a-ac6b-4838-b9f1-126dbf1d0198", "comment": "Malware payload (AgentTesla)", "value": "f83d6476ac2660b54b78d3d5c9c88eb63a6d5bba03d661a8f804326aa17e84b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758088, "uuid": "fc0c321e-dd5a-470e-9a04-e44494d5456b", "comment": "Malware payload (AgentTesla)", "value": "d62bb5affcd48bd69bbb0efe04bb78816217d698", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623758088, "uuid": "aa8d51c3-634c-478c-9201-a700309f990f", "comment": "Malware payload (AgentTesla)", "value": "742ca60f46b2e166099d15d161d65952325656c8d9f05e741ec283e33af48addf7b1f1abc5283369be2caca16c595c07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758088, "uuid": "968b0d90-f2ac-406c-b718-b446283cb910", "value": "99D4237EB6E79A8815C6AD70CA02013EF8427ADFF3658C580C3AA58D1D0DFD72B5524E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758088, "uuid": "dd0d44ed-b102-4dd8-83b2-f913a09c0ad0", "value": "12288:DxMZEF3+5I8X0G8/oP+OXXiZrbAERCnY9Xq4BPbiwpyV6Rfm+ZC:FD3+b4WyZrbAgCZ4BPbBp5m+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623758088, "uuid": "74d86adf-4977-4de5-a087-a120c322a3e1", "value": 623328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623758088, "uuid": "c56ca1c5-a904-4bd1-a552-94b55a529ca1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623758088, "uuid": "993bfb55-f0d4-44ba-a86b-41f42b9fa924", "value": "LIST OF PRODUCTS NEEDED.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e2aa15-cd84-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623725494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623725494, "uuid": "6623d2c6-dcb5-479f-939b-d1fd9acf637a", "comment": "Malware payload (IcedID)", "value": "100123b7843ed81d9973bd2f9705016d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623725494, "uuid": "428b77a3-ba1f-48cd-9fc6-fb1df11935aa", "comment": "Malware payload (IcedID)", "value": "f84d65ddf6a721ee4343db90c97dc1e12b8cf79677bd2d9ddc9a703903a4271b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623725494, "uuid": "8d180afc-feb9-4145-8255-f4ee615834f2", "comment": "Malware payload (IcedID)", "value": "1e032bb6d85dd83b41a9489a60fda1675145a7ab", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623725494, "uuid": "74dabc33-cd2c-4b47-96e7-15048f843d5d", "comment": "Malware payload (IcedID)", "value": "853ea283b2ce9276303f143cfa08d354e88a0e6272863d8091e2c5a25177ec732e8532eae3102e427506d38673f522ef", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623725494, "uuid": "20727867-5c33-4ee7-a862-29d85a468902", "value": "D183E116FF553799C7B2493ED85800E4768432FAA654A94B6D61328FCEC8C8B279F13C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623725494, "uuid": "db08c0f1-8040-4c01-b3bc-a54f10d94582", "value": "1536:gSzCUzSY8iuXfP+9raWZhlMVGoIahaDHTU6hryF70liWWGH0AeWRN:MUzsFch2sTU2yF70liWW20SN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623725494, "uuid": "23c1e34b-d6a9-409f-bd9f-93fb85a9f79c", "value": 84746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623725494, "uuid": "4225cb73-2a3c-4041-a1bd-7bc484de6842", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623725494, "uuid": "d4c3422f-7832-4433-82f9-b4f610d1f5eb", "value": "f84d65ddf6a721ee4343db90c97dc1e12b8cf79677bd2d9ddc9a703903a4271b.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0f2acb-cde3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623766272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766272, "uuid": "1253d901-43cd-4840-a36b-4c36b994acc7", "comment": "Malware payload (Mirai)", "value": "7fe58eb68f9145c53c381ae773456a98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766272, "uuid": "612ce21d-1e70-4d44-aff0-9a359b002316", "comment": "Malware payload (Mirai)", "value": "f86dacc629db4a578144e8e7df9df413325909192613066d587123ee8f755a26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766272, "uuid": "8441d666-0e15-4345-a32b-258013858df8", "comment": "Malware payload (Mirai)", "value": "4a8183ef4ffab1732d030fcc9f5b304e23babdfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623766272, "uuid": "5321b745-b4d0-405c-8e2e-8131879249f6", "comment": "Malware payload (Mirai)", "value": "a8e4212c82cd5e4103cfeca4fb84d905234d3c39943099b72b4b6f703610eefacb7f7dd13f50bec30fa34595ada15c25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766272, "uuid": "3edbb41d-524e-4b92-99df-016be757456a", "value": "43C3391136244F0BD89746B42C2E5BE087FFE9C025E8B985291FDB764A39E3B1485F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766272, "uuid": "2ba31b8b-07a8-49c0-8d1e-d47390668e26", "value": "1536:F7bv9DtJTlbtx2SHfLxIm8f3RYde2Dm5Fv2s21RkBKn65wgt7Y3Knrr:F7z9Dtqwfamae778h7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623766272, "uuid": "d5881057-93b1-4e90-a81b-e5ac652bc052", "value": 121928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623766272, "uuid": "527aa9dc-89e6-47b1-8163-f0cee3557dec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623766272, "uuid": "d2613538-9677-40ae-8ac8-1d5eda5f101a", "value": "7fe58eb68f9145c53c381ae773456a98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689ba40d-ce20-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623792415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623792415, "uuid": "9036a5f7-b7ad-46fa-af74-ab4f665e678f", "comment": "Malware payload (DCRat)", "value": "048ac151ce97e95a980399e849daae95", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623792415, "uuid": "a29319be-eb17-4b6a-9f53-cd9f03e90651", "comment": "Malware payload (DCRat)", "value": "f896c6618235d320b62e6662673830cbd21d7be057b356eef83aac8f21684b6f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623792415, "uuid": "eae81b08-b267-4dda-857e-ac18d5169733", "comment": "Malware payload (DCRat)", "value": "3a89733c03e49f7504f6731ee9f626dad52fb369", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623792415, "uuid": "f07ea090-613c-4d6c-85e6-3274a68be9a8", "comment": "Malware payload (DCRat)", "value": "0035975bb2b9a77c79bceda9d9b91300fd8a99c2419b15fc99c0e222f644d96823a965b0be0e8dbb76d95a468bbf186e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623792415, "uuid": "af925c88-a139-4e8b-abd9-4309ce03e8bb", "value": "1A942A382EED9925F1BF9B7DD5F065568A3DB5633B43E94E0491038A0A23B41DDC0A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623792415, "uuid": "fd4a5057-e79d-43f4-9050-a80741732abf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623792415, "uuid": "00570a84-09cc-4fc4-b0d4-5426594c161a", "value": "6144:2qqDLzcjt6y7KLWARkPEFyfmnFrM2abmXYVKAguSR+/+Xb/i0OOPInjUiIXs:zqn4f76WVmnFrM2v5RcOAnjUim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623792415, "uuid": "8c30bf1d-e7de-4638-bf58-910f81342def", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623792415, "uuid": "7e0976fa-cae3-407e-9186-a6f51cebb1fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623792415, "uuid": "1ad17bab-386e-4c50-bb2e-3ad56e1537e6", "value": "048AC151CE97E95A980399E849DAAE95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf38a2bc-cdcb-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623756053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756053, "uuid": "87602f59-2a86-437a-8bd8-873126b272b2", "comment": "Malware payload (RedLineStealer)", "value": "201abecf58b4a4653f4665a322b9a573", "object_relation": "md5", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756053, "uuid": "73b778ad-3eb7-4d99-9771-63d93f5a4e07", "comment": "Malware payload (RedLineStealer)", "value": "f8aa33b99bb248f640363d937986e465239346a7f25f8e8579b92b5c975f38a9", "object_relation": "sha256", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756053, "uuid": "dfdfc0b0-cb8a-48d1-b4ed-ccb4ab1eae6f", "comment": "Malware payload (RedLineStealer)", "value": "55ce2341573c2cf780a5212d99e814c12d124d0d", "object_relation": "sha1", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623756053, "uuid": "17df42fa-1cc6-41a3-9251-e5a9897bb62a", "comment": "Malware payload (RedLineStealer)", "value": "7d479353592d53bbb33267067722fb178f7eb58dc8d3dd6e6d5b3610346269c475962c98f6a85871c28d4a4f1bf3accb", "object_relation": "sha3-384", "Tag": [ { "name": "data.exe", "colour": "#44ABFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756053, "uuid": "7a236132-adcc-4d0d-bf8e-c1174c83393c", "value": "37E3B25B0EB09482C11CF67FA0485EFB6671BF3AFD14FE886041619AF4D8E8C6876257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756053, "uuid": "e83edf46-2f58-4b1f-9753-c5a8e87d7d76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756053, "uuid": "1a5f7c81-ad81-4995-b24b-5f23243eae0a", "value": "3072:4siDKnSLsF0JTlLWgSqvWHWk1PqhA9999/7z:94WYxliEiWk1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623756053, "uuid": "d90a92a7-de0c-4f49-853c-62458d420c36", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623756053, "uuid": "a3f55f1e-eb05-47ee-9370-a09ad06780f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623756053, "uuid": "63584e68-d5a1-40ae-a2cd-d33368470b5c", "value": "KRSetp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c63c97-cd77-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623719884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719884, "uuid": "567c1470-19ec-45e6-9d93-436fe0328261", "comment": "Malware payload (Mirai)", "value": "67a08a397c20feef6d74727253ce2a9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719884, "uuid": "6bdbebf9-b10b-4dc7-83c9-4bbf3b2477d0", "comment": "Malware payload (Mirai)", "value": "faecafa4e027859d21f0bbf8d8ade4ea164dee27238f6843807825e190830978", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719884, "uuid": "16e05d10-b09b-49c0-b08f-568b02087477", "comment": "Malware payload (Mirai)", "value": "32f09d8a202ab14140d85507c4173cb24be65372", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623719884, "uuid": "3f5e6ed3-c4de-476c-a6be-54678de5a4f5", "comment": "Malware payload (Mirai)", "value": "0c5cfab26a63f5778737ff1ed03ed8b7bf46f84d9d4f019f05998ab37c96b91e95d12ed22b8a7d804aeec25f270e275c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719884, "uuid": "c412ed6e-74ff-46a6-8f76-6fe6f15b17a9", "value": "59633AE5B4018E7CFC1BEABA80264E0DFA32634556430F3E527BFDA36C621559E63C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719884, "uuid": "fb9c02ae-63bd-41e0-a488-5e7ae8f25f56", "value": "1536:Gyk6UfXL184LCA4jzPUlJtk2fLxAb/gPHRyzSs81:+L1vOP03NEEyOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623719884, "uuid": "425bb1d4-2146-49ee-a046-410cf351b86d", "value": 68680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623719884, "uuid": "dfd7fffc-e664-4b65-8c80-e120234afcb5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623719884, "uuid": "5adf199b-609e-4047-8129-efcfc58520ba", "value": "67a08a397c20feef6d74727253ce2a9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa524850-cdcf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623757736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757736, "uuid": "fb0c4a3a-1632-47c1-a873-61a3b4453bba", "comment": "Malware payload", "value": "9d9c21b719efa3bd055979c6a8f619e6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757736, "uuid": "67503e65-48c0-4bd2-a853-2c394faeeda2", "comment": "Malware payload", "value": "fb3bd8c3de2877cdef3a6e26d43cb2168fe6b317d1fc5ebde3dea47f26593ce0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757736, "uuid": "d8f5633f-dfa7-41fa-b2d2-7d1823a78c3c", "comment": "Malware payload", "value": "042a9f73b6aa9c514eb0f144a7f1d4ddc91ec782", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757736, "uuid": "fba5da78-c700-4fe2-a068-e578ea551688", "comment": "Malware payload", "value": "7f3d0baeb10d95dd59f899dc010e61e4e9edd95255387188c54250125bc2be4936114da797fa6d9629892ebd559a28ee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757736, "uuid": "ee1326c5-9365-483f-b195-af533ee4d009", "value": "86811BB22B1C9D02C60D91AA864E7E595766F062C6C711C8B3EECEF30F3E1139B32145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757736, "uuid": "b618837d-5650-4d23-a432-825bb2cc363a", "value": "96:8tLXtjLWY08VXCGNMtlj5Ah4wR/1/sLjCGaXCKRtG0:8tB908VBkjSGaXCKR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623757736, "uuid": "60cfbbac-c47e-4b0b-a6a7-0457b6127c0f", "value": 3894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623757736, "uuid": "648268e1-6eed-45b1-ade6-4aeff84897b1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757736, "uuid": "5430fcd4-0be0-43b8-81b4-9f26ce27bb5f", "value": "PRICE LIST 2020.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa03a096-cdc5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623753575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753575, "uuid": "05b826e6-2df9-451d-ad41-26a9360706f6", "comment": "Malware payload (AgentTesla)", "value": "e33d87a12a5ead1ee840f1c40af5705c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753575, "uuid": "398458e2-5487-43af-87e2-0243ababf9e8", "comment": "Malware payload (AgentTesla)", "value": "fb89ea1418248072f812a1da9f0021c385ecf567edd6b50115aaf254efd50f7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753575, "uuid": "48b7a0fd-e799-4010-8690-2f2d68111383", "comment": "Malware payload (AgentTesla)", "value": "63f70746bb89255320b342533345a2988b180643", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623753575, "uuid": "799cf461-7e02-47b8-8331-6dc984d4f0d9", "comment": "Malware payload (AgentTesla)", "value": "f41dfb6b3d9ba871156b603d047d100fd6ef258df9b6fb23c4a3c9c432f384593954c2a9d4c35f6218c12d8b7a658cf4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753575, "uuid": "dd561a2c-ce29-4dcb-ae1f-0f5e72315861", "value": "2D355B8C7655EF9EF0778A3185549C20E613ACAF8217820BA353B67F5A3F7C78E141A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753575, "uuid": "f59e7a4b-4b31-46d0-9431-ceacb5270da7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753575, "uuid": "9ad13595-2118-40e3-bedf-59ec57d2f71b", "value": "12288:gIeMI4A19VCZ6vylRwLHLtZ9kfMu34LkGtwSOOghTlT7sd51VdWD3Dhmiex56ISF:wMI48YwLyfMu3Ik1OgvE3dozhf2IFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623753575, "uuid": "a3e5edfe-1038-4ee5-89b5-61bce9efb2fa", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623753575, "uuid": "868045b1-4c2c-4759-a2e8-e43d2fe90a6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623753575, "uuid": "a9dd6d10-9b01-4803-9d9d-cc174604238c", "value": "invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8906b0d7-cd7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623721602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721602, "uuid": "b6347936-0830-48d4-b445-651a85c4907e", "comment": "Malware payload (Mirai)", "value": "8b70810c51ff2e183ee1eb4e1c2f9056", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721602, "uuid": "bbed70a2-0aa5-4001-b78a-8e0e818472ee", "comment": "Malware payload (Mirai)", "value": "fcac65a89015b877d890f8519601283444200784ea45aa582657874491f2b7bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721602, "uuid": "c130e5d0-ab48-47a4-8011-a51b8160eaa6", "comment": "Malware payload (Mirai)", "value": "8fb540d6d731622c5f3f3a8b5bde793548c120ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623721602, "uuid": "779b011e-59f9-4f8c-98c4-9d935a2bf149", "comment": "Malware payload (Mirai)", "value": "78754ae5b6dc47170e728e5481c4561d60195fd9707c94b2cd295e98535737f82e3967ede51a0cfcffbf1abdc307de67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721602, "uuid": "6bd2e02d-ba71-49bf-9f93-ce30ca6780eb", "value": "CE13F646F9C19B12C5D4527AFE0F218E33136768E3DE72139E146F206BC666B0E7B816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721602, "uuid": "b32d92b7-bd3b-49f3-b7ca-3263ed4f0c07", "value": "768:g9niEYP0UaezxPAobqVbKRPNKzSbmle3gfWmdSGAZMvnmiReZvUkYfysrVdT:g9niEYHSOKmQe3g3GMeiReZUkEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623721602, "uuid": "0e19ab76-2646-4a7b-b61b-a79ee469f01f", "value": 42948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623721602, "uuid": "5ae641f8-ae90-4ae5-9036-00e6d3087d80", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623721602, "uuid": "4722e5fe-77ab-42d0-8dbf-cf69e91107ac", "value": "SecuriteInfo.com.Mal.Generic-S.28971.31838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f45b42-cdcf-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623757811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757811, "uuid": "e2cba8e7-61cf-4600-ba5d-ef38f3222260", "comment": "Malware payload (RemcosRAT)", "value": "e04ce093d0a57efbf8084b924e1db390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757811, "uuid": "1044f406-cc92-4ce6-9289-5c32389f0fb5", "comment": "Malware payload (RemcosRAT)", "value": "fd25d0297a8890cb63206e28835e6441adb8bb2b7b72b0e85afe5270a4796446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757811, "uuid": "c01236ca-b144-45c5-b9a1-bc02931c8aab", "comment": "Malware payload (RemcosRAT)", "value": "5703ef1a59de8279db7903dd8b823973e5c16d67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623757811, "uuid": "1221e79b-c779-48b5-bbd1-607f9ce2da64", "comment": "Malware payload (RemcosRAT)", "value": "7b4dc6e4fd35cae4fea65b93648602025cd772e2a6c9c34f6eea0725421fdeb31d5fd0cc5f907eb0b9f66137d1d33bc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757811, "uuid": "f9b5699f-d780-43b5-992b-c0684a8d2d4d", "value": "FC155B59A3205872D82226B9CC3AFBA565EE3D1174688C8D17F33D45F9787C3391A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757811, "uuid": "d4d00b5d-9806-4cc8-af20-cb1ea0c27dae", "value": "5d03253373fb0f9ff309efca685fcbc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757811, "uuid": "334c4122-4316-4eca-b121-a513ea0d3d6b", "value": "12288:uu62O21Q9SUxQTnn8rh5aFUdMUgGj3LxRoBQCpK/yYPtbxPjtTHDfPnbetkkkAq4:x5RKggrhmWPyIPtbxpgq/XQBXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623757811, "uuid": "84752e0f-6a62-44e3-aa6b-f8c013904f19", "value": 932994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623757811, "uuid": "25a94cd8-52c7-4720-ac24-4d885097b1cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623757811, "uuid": "3b71a5ac-aac0-4b00-9f3b-a2e9c7e9062c", "value": "e04ce093d0a57efbf8084b924e1db390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fd5a41-cdb7-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623747397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623747397, "uuid": "e1ce6d3b-4e07-4896-b0ed-0613be445f45", "comment": "Malware payload (AsyncRAT)", "value": "e6b54146eb295792de721286a0c205f3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623747397, "uuid": "3fa7355f-d5fe-4a1d-a07b-5e5216ae6adc", "comment": "Malware payload (AsyncRAT)", "value": "fd80116dffb4a52d6a31d33d06f3ff943c38f6ada8fd3d9e9ffaeb0422a010a9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623747397, "uuid": "4e2df693-c438-4c25-88aa-2b5becd37990", "comment": "Malware payload (AsyncRAT)", "value": "f6d4b908eb0879c13716f93581a2aa5fe31b792b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623747397, "uuid": "3b5461ac-402e-4666-abcf-8408be64538f", "comment": "Malware payload (AsyncRAT)", "value": "ced55e25b7c49cd68de5d746eddd9ef5b927c91b799738bb0fc1391cdfdbb3778802c1bbbdc67f20212bbe391e99a55d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623747397, "uuid": "684ce066-7299-4e44-b4df-1762abfe38ae", "value": "55E2095393482AB4C46A377D94796B8437BA7FC159B3CA2C180530033EF3F162A69ED9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623747397, "uuid": "980bbfd0-4225-4d92-8129-a4021c661ee6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623747397, "uuid": "e33a5edd-18bb-4cae-80f9-c836fb0000d7", "value": "384:f9WzaeQoyRhDEhAQR1W+1R3WekiqvEXPXebr5h19G+uXr+br3W4YMBJSWKDTkI/Z:f5eQjdaXGNiqvEfs5hKP+bz9f0D41LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623747397, "uuid": "664e9057-8b80-465b-8ba2-aa7f5a9ae91a", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623747397, "uuid": "3282f217-ed7b-4381-aabe-12b81f52704c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623747397, "uuid": "1c18198f-d5b2-4378-afe9-1bd533dd1c31", "value": "Preview.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55557974-cddb-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623762747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762747, "uuid": "a9c8ab14-ab1c-4296-86f6-06711e82918a", "comment": "Malware payload (AZORult)", "value": "9a59be274c9b5ce35bb4142ce79fd88a", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762747, "uuid": "0c324d58-fc63-4a00-ab4a-6eb43a862481", "comment": "Malware payload (AZORult)", "value": "fdc178b4e3d9df68795dd93f12b1539f9cb7d6a4f40dd6452c2582779bb454ed", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762747, "uuid": "33d00a8a-2794-497f-9525-5d50c6791ea9", "comment": "Malware payload (AZORult)", "value": "c114441e7fc2df21d2bf12726d501bd6fb07e09f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623762747, "uuid": "cb0efbe9-21b3-43bb-ba26-c259572a5349", "comment": "Malware payload (AZORult)", "value": "1763b23bd4b87959427629a9a3e2263178a1dcb2107ad33894d92d0085220379dcd2f89720db6162a4031482363e68aa", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762747, "uuid": "80118b7a-7184-405d-b6c3-42483af7c37f", "value": "9764BE59B98138DDC76013F9643167B093EB2E5E1AB5E14E6228BE3933FD4960F12273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762747, "uuid": "05a39daf-c18d-4bab-8e22-377211720224", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762747, "uuid": "f406f9ca-0c73-4b9f-a2d6-c4fea8d4116e", "value": "3072:3Lk395hYXJHwJPBM8bjPbwAyMv7TJNMSo8z6tvp0IiFE/fdM55VNtQGQbKJus6s6:3QqyJPl/PsIvZNF2v5iFc6PIbhK7Sbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623762747, "uuid": "9d65133e-2381-40ce-87fc-4a0f89298e31", "value": 332532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623762747, "uuid": "3cf871f5-e7ae-415d-b210-ddf241d95723", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623762747, "uuid": "d7349850-88de-4282-aa6f-6de27d4c7ba9", "value": "ojmanoq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72039e2-cd9f-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623737115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737115, "uuid": "68cfac78-2d3e-4dbe-b8a5-a1e3bf818586", "comment": "Malware payload (IcedID)", "value": "54590d662209eaf22fb6c2e16a31db55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737115, "uuid": "b2656197-efbe-409c-8caa-03f8336836f7", "comment": "Malware payload (IcedID)", "value": "fdfded6aa0d48d27659273a393dd4a84e09531ec6822f3c2d7169f2429932db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737115, "uuid": "21063481-19e2-4125-aec0-8012898d558e", "comment": "Malware payload (IcedID)", "value": "60887b9ed99d50f69ff1fe0add04405ee1d134bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623737115, "uuid": "1c4eabe1-58a9-429d-9f2d-60424b678dad", "comment": "Malware payload (IcedID)", "value": "f64c95ad71b144e1e81b6eceb7f492fc490c316f5620fc8cef5028516f2d77cce4b3df9a0ac0496f6fa3046c012893c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "potimomainger.top", "colour": "#199582", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737115, "uuid": "d9019861-0386-4749-96a8-8b4a3a007a0c", "value": "FBB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737115, "uuid": "8e74fbe2-bdd3-40bc-a439-7abd86b7e2d1", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737115, "uuid": "7116b087-7200-4471-96d1-e3ac446d64a3", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8M:t082TLrbNGoVMjPR5DxDRoFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623737115, "uuid": "eb89fcd9-002c-4005-9bf1-7c06d36237b3", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623737115, "uuid": "8f652312-d75a-43e9-b5cf-e7045c0c860a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623737115, "uuid": "cff43cc9-324a-4f25-adca-ef6e5418cc69", "value": "fdfded6aa0d48d27659273a393dd4a84e09531ec6822f3c2d7169f2429932db9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d37bb86-cd9e-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1623736508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736508, "uuid": "55559e3a-5153-47d4-b4df-4342f584182c", "comment": "Malware payload (Vjw0rm)", "value": "96a3d54e8c6a3c65d35916b3779f821b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736508, "uuid": "51c7c4c2-dc46-416b-b1d4-0a1921f5f2cc", "comment": "Malware payload (Vjw0rm)", "value": "fe44c2a762aa0a7e11cfefcba962382178285832996677ae6f8e88ccd5243f16", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736508, "uuid": "e18830b1-2d04-4c6c-a309-33a284cbad27", "comment": "Malware payload (Vjw0rm)", "value": "98b3281204373801bc655363ac9900d0d3fa3a86", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623736508, "uuid": "b4ff7eaa-99a2-41a8-ae83-da3f0cb34e3e", "comment": "Malware payload (Vjw0rm)", "value": "2896508a8ff1b58b4e7b97d8607dbbdbd547aea89c3b2ad3304a5623ece5c9d3d5803153bc7bf0f0f391185342b0d16d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736508, "uuid": "c073c875-0139-4751-ab0c-ab5e91c18169", "value": "50129E4B168DD9F2A124C92D81FF464793AF9459C96EBB6813FED2130D5D716F13480C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736508, "uuid": "1e29ecd0-f9c3-4ff8-a878-5652ee363b43", "value": "192:QPKshhOt6atrUlGD5jM8F9YUddIV6ZuKryPS7vzAf+pj:QSset7qUTFOU/NZuKry67vzpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623736508, "uuid": "bf83f6be-e03d-4942-9a97-24c5aa08c99c", "value": 9439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623736508, "uuid": "bfc1a301-30ae-4050-a2e1-7e781c5b7810", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623736508, "uuid": "b6b437d5-46fd-43a0-b5eb-d54df7b2ff71", "value": "1ZNMAOPMAS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94350eab-cdb3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623745673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623745673, "uuid": "e0948aaf-97d8-45a4-8c36-17766f012d81", "comment": "Malware payload (Formbook)", "value": "a03c6141087dd21137ff34bd3d9803ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623745673, "uuid": "c35a0980-f517-4149-a2f5-5e4ae4a0cb6b", "comment": "Malware payload (Formbook)", "value": "fe688e4ea10286585515b497ff637cddfb0525f802afe8d1ddfcdcd1d6f0ee7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623745673, "uuid": "2566b762-c980-4a92-8966-46269e1cdecc", "comment": "Malware payload (Formbook)", "value": "2b6be5d2453fbb31cdfaf57841c7144151c878ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623745673, "uuid": "8c0b3097-6f62-4a6f-8728-86cef23dad08", "comment": "Malware payload (Formbook)", "value": "1e172ea8cc89631bcc4fdc7a75e20785c785f96bec9c4d0e1d13eeea10b3ac20c5cd39ff48b29332424858030e02157b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623745673, "uuid": "de71bcf4-f870-4690-bc31-8901e6d0f09b", "value": "83A412439A396321E6CE0AFBC0C2A0B08B74CDD25806C8577BDE7E516532B55A7C726F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623745673, "uuid": "c5296fc5-7b24-41e8-ade5-86f26db718b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623745673, "uuid": "b5380811-3030-4d93-b592-8e5d39872fe0", "value": "12288:fzgXJD+h7VMqlFurn0IyBFRunQeooRypq6swmY39zU1:8Xd+h7BAn0dknJoikJsE9Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623745673, "uuid": "9219b027-cd8d-4e6e-ab70-e84a85877305", "value": 460784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623745673, "uuid": "e9da5a59-9e30-484b-a31a-cf990e864d08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623745673, "uuid": "f882af15-a11a-4a98-a194-e92694df5251", "value": "a03c6141087dd21137ff34bd3d9803ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75a0f33-cdc1-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1623751825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751825, "uuid": "6e7931c7-1e2c-46f5-867d-87c14803abdd", "comment": "Malware payload (BazaLoader)", "value": "a52687906eb337943ed5fe66587ecb01", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751825, "uuid": "fd419418-8bda-404f-a896-58ae56ccb537", "comment": "Malware payload (BazaLoader)", "value": "fea4f9bef08bc96706182b62d1ebcd4aeacaee3fb91f52dee31fd0838b8386ac", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751825, "uuid": "a07b5314-792a-41fc-a34d-29b40c715863", "comment": "Malware payload (BazaLoader)", "value": "cfbadc4473671edb55145a43a91587f0a32e80ce", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623751825, "uuid": "c45eb067-9b21-4945-84ad-63d534c80991", "comment": "Malware payload (BazaLoader)", "value": "c7f54bb2a5e480337c27f72542180e63562219ba65bc95a0de8df26d64578ab8a8da74af0f0f64e8d3d1bae27967386c", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751825, "uuid": "d44e525c-5a84-44d5-a5bd-716ff2e64c8e", "value": "EA2447C73B0C6717E7738C768125B89083A8A57FCF8983412BA55D172F60D858F76A38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751825, "uuid": "c2a6fe98-aa1c-4109-a886-442c93a4a9be", "value": "0852eaf1c8bceed544c7b5e156710905", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751825, "uuid": "1813e33a-fc8d-459b-88d8-42c986b2078f", "value": "6144:ycOpR1yYPOVcP9rjRFqwG6mYzbvPIxB14jVlKOU:y/J1GA9rjRFqwx5/IhaVwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623751825, "uuid": "36675e74-b743-4b2c-9f78-6f1f1b78664a", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623751825, "uuid": "d261e20f-dde9-45ed-94cd-a04463ffc168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623751825, "uuid": "d11a8c48-02fa-4e40-9a2c-ba9a0def99a8", "value": "TTObk2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": 3 } ] } }